DHCP and Security

[Rob.Nitzenberger () PENTAGON AF MIL (Nitzenberger, Rob, MSgt, AF/XORR)]

Need a policy read folks:

The system I "manage" has 3200 users at various locations throughout the
world, managed by a central NOC.  Our firewall permissions (protocol and
port) are highly restrictive and report any unauthorized actions (ftp,
pings, finger,.....).  The NOC gets a report from the firewall indicating
which IP was the "offender".  If I the LAN clients are configured with
static IP's, it's easy to attribute the offending action with a LAN client,
but with DHCP (which is the method of choice for our sys admin types), it
has proven difficult to "map" an IP address back to a specific user... lease
times expire, inadequate event logging..etc.

 How can I configure DHCP to balance the need for security with the wishes
of the sys admin folks?  Any Ideas?

Rob Nitzenberger
thenitz () email com