SOLVED: 2 Fixes for Error 1028 DHCP Service Failed to Initialize The Audit Log – Access Denied

If you see the following error in your event logs there are two easy fixes:

Eventsource: Windows System Event Log Windows Event ID: 1028 Message: The DHCP service failed to initialize the audit log. The following error occurred: Access is denied.

You can either disable DHCP logging or give the account that is running the DHCP service permission to the DHCP logging folder.

How To Disable DHCP Logging

1. Launch the DHCP Management Console
2. Expand the DHCP server node
3. Right-click on the DHCP server and select Properties.
4. Click on the General tab
5. Uncheck the box labeled Enable DHCP audit logging
6. Click OK to apply the changes and close the properties window

Don’t forget to do this for both IPv6 and IPv4.

How To Grant Permission To The DHCP Logging Folder

1. Launch SERVICES, locate DHCP SERVER and note which user account it is running under
   • By default that is the NETWORK SERVICE account
2. Navigate to the directory where the DHCP audit logs are stored, usually C:\System32\Dhcp
3. Right-click the folder, select PROPERTIES
4. Click on the SECURITY tab
5. Click the EDIT button, then ADD the user the DHCP SERVER service is running under
   • By default that is the NETWORK SERVICE account
6. Click OK several times to apply the changes and close the various properties windows