Hi Guys

I have a PC on that is connected to the domain. This PC has a static address.
If a user changes the address to DHCP and back the the original static address, is there any way I can prove this was done.

On the server I have looked at my address leases, that PC does not appear there.
I definitely know the PC was on DHCP because I changed it back to the static address myself.

I need to just find out when it obtained this DHCP address.

Is there any way of me checking this???

Is there and software that I can use that logs all this??