Small Office DHCP and DNS Evidence Audit with PowerShell

Expected Outcome

A CSV report identifies scope utilization, lease-to-record mismatches, duplicate address/name evidence, and stale candidates using documented rules, with seeded test cases that prove the logic.

Assumptions

• Windows admin host with supported DHCP Server and DNS Server management modules/RSAT

• Read permissions to the selected DHCP and DNS servers

• An explicit scope/zone list; do not audit the entire environment by accident

• Definitions for stale lease/record age and conflict conditions

Bill of Materials

• Windows Server 2016 or later

• PowerShell ISE or any text editor

• CSV file for exporting results

Build Steps

1. Define the evidence and rules

   Document which scopes/zones are in scope, the lease lifetime, aging/scavenging settings, stale threshold, and what counts as a conflict. This lab does not change PowerShell execution policy.

2. Collect scope and lease data read-only

   Query selected DHCP scopes and active/reservation lease data, preserving server, scope, IP, client ID/MAC, hostname, lease expiry, and address state.

3. Collect matching forward and reverse DNS evidence

   Query A/AAAA and PTR records for the selected zones or lease addresses, preserving record timestamp/static state and zone/server source.

4. Evaluate explicit mismatches

   Report cases such as one active lease with a DNS record pointing elsewhere, duplicate active leases for an address, hostname mapped to multiple unexpected addresses, PTR/forward disagreement, or timestamp beyond the stated stale threshold. Keep Unknown for query failures.

5. Seed safe test data

   In a disposable scope/zone or reserved test names, create one stale record and one known mismatch, run the audit, confirm both appear, then remove the test data.

6. Export evidence and recommended follow-up

   Separate observed values from recommendations. The report may flag a candidate for cleanup, but deletion/scavenging changes require a separate approved action.

Validation

• No ExecutionPolicy change is required

• DHCP and DNS evidence include source server/zone/scope

• A seeded stale record is detected according to the documented threshold

• A seeded lease/DNS mismatch is detected

• Query failures remain visible as Unknown rather than disappearing

• The audit performs no lease deletion or DNS record cleanup

Troubleshooting

• Module missing: install/use supported RSAT on an admin host rather than arbitrary Gallery modules

• Hostname differences: normalize case/FQDN carefully without discarding legitimate aliases

• Static DNS records may have no dynamic timestamp; do not label them stale solely for that reason

Cleanup or Rollback

• Remove seeded test records/reservations

• Retain the audit report if used for approved cleanup planning

Next Improvements

• Integrate additional checks for other network services.

• Create a user-friendly interface for the toolkit.