0) From a machine on the subnet with the problem.

1) Have the person look at the winipcfg more info to get the IP of the dhcp server.

2) From a dos prompt ping that IP address.

3) From a dos prompt type: "arp -a" to get the mac address that matches the IP.

4) Include the mac address and IP for the rogue DHCP server.