If a Windows server is configured as a DHCP server ingest the DHCP logs. This is listed in CIS v8.1, Safeguard 1.4