Type “help” for hints, ↑ for history.
Workstations on 169.254.x.x received no DHCP offer at all: the service is running, but scope
192.168.10.0 (100 addresses, from .100 to .199) is 100 % full (events 1020 then 1063).
The new access points put the festival guests' phones on the staff network, and with an 8-day lease
(option 51 = 691,200 s), every guest who has left keeps their address for a week.
Incident resolved
Analysis and fix
Immediate fix:
Set-DhcpServerv4Scope -ScopeId 192.168.10.0 -LeaseDuration 04:00:00
Get-DhcpServerv4Lease -ScopeId 192.168.10.0 | Where-Object HostName -notlike '*.tafoukt.local' | Remove-DhcpServerv4Lease
Then, on a workstation: ipconfig /release and ipconfig /renew. In that order: shorten the lease
before freeing addresses, otherwise the phones take them back for 8 days.
Lasting solution:
- move guest Wi-Fi to its own VLAN with its own scope (e.g. 10.50.0.0/22, 2-hour lease), isolated from the staff network and the tills;
- a monitoring alert when a scope goes above 80 %;
- document any network equipment added by a contractor (who, what, on which VLAN).