DHCP audit log files are located by default at %windir%\System32\Dhcp.
To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.
To use the DHCPsnap-in to modify the folder in which the DHCP server stores audit log files:
At the DHCP server, click Start, point to Administrative Tools, and then click DHCP.
On the Action menu, click Properties.
Click the Advanced tab, and then edit Audit log file path as necessary.