How to know which user changed network settings in Windows Server 2012 R2?

Question

System administration

Someone on the dhcp server changed the connection settings and instead of a static address set to receive IP via DHCP, respectively, the dhcp server fell off. How can you calculate who exactly did this (where to look in the event log) and is it possible to calculate it somehow?
Is it possible that Windows itself changed this setting?

Answer 1

how the dhcp service can knock down the manual mode settings in the tcp / ipv4 protocol settings, only with the hands of the admin rights or the network setup operator, if the audit is not configured then deafly, but you can look in the dhcp log when the IP is received and look in the system logs who was on server with and understand who changed)

Answer 2

Windows event log - everything is logged there.