Assume the person reading this used to run Windows Server DHCP. “Restart the DHCP service” is almost never the Lattice fix. Shared Postgres is the fabric; identical dhcpd processes do not have a primary.

Windows/SSH commands: windows-admin. Relays: relays. DNS adapters: integrations. Helpdesk (no SSH): helpdesk. Runbooks with SQL: runbooks. Those pages are also at /docs.

1. Name the symptom

What they said	What it usually is	First click
“DHCP is down”	Silence (no Offer) or NAK or a quiet node	Overview last grant vs Work
Nothing / no IP	Silence	Work → Relays; trusted relays; pool; `/readyz`
“Can’t get an address” but they saw a message	NAK	Work → Why NAK
Has IP, no name	DNS outbox	Work → DNS (Ack never waited)
Duplicate IP	Sev-1 — two `leased` rows same IP must not happen	Capture leases + version; email support
“Failover isn’t working”	Expecting Microsoft partners	There are none. ha
Console cert scary	Self-signed day one	first-login

Heartbeat on Cluster ≠ packets on the wire. A node can be “up” with last grant hours ago (dhcpd_quiet). Point a relay; do not reboot “the primary.”

2. Silence (no Offer)

Is giaddr in a Lattice subnet? Work → Relays.
Settings → Trusted relays include that helper? Empty drops relays. relays.
Pool enabled? Gateway Don’t offer? first-subnet.
dhcpd ready: on the VM curl -sf http://127.0.0.1:8082/readyz (port may differ; Community compose uses 8082/8083). HTTP, not UDP 67.
Community: same-VLAN broadcast from a laptop often misses Docker. Prove with lattice-dhcptest or a helper.

Helper still on the old Windows box → Lattice never sees Discover.

3. NAK

Work → Why NAK says why. Common after leaving Microsoft: the PC Renews an IP Lattice never Acked → NAK → Discover → new Offer. Expected. migrate §5.

foreign_request: they asked for an IP outside this subnet (leftover scope). Reservation to someone else, excluded, leased to another MAC: read the queue, don’t guess.

4. Names missing after Ack

Not a DHCP rollback. Work → DNS. Replay is operator+.

Error starts with PTR → reverse zone missing or ACL/TSIG
No reverse zone → subnet has no reverse filled in
AD NOTAUTH → clock vs DC ≥ ~5 min, or keytab; ad-ddns
BIND BADKEY → bind-ddns

Option 6 still the DCs. Enabling DDNS does not point laptops at Lattice. dns-how.

5. Clock

Lease expiry and Kerberos are wall-clock. On the VM:

timedatectl
# NTP synchronized: yes
chronyc tracking    # if chrony is installed; offset well under 500 ms

All HA nodes (and DCs, if you use GSS-TSIG) should follow the same NTP story you already use for the domain. UTC on the VMs is fine.

6. Logs from a Windows admin’s PC

You need SSH (or ask an admin). Replace the MAC.

Community Compose:

sudo docker compose --env-file /etc/lattice/cluster.env \
  -f /opt/lattice/deploy/compose/docker-compose.install.yml \
  logs dhcpd --since 1h 2>&1 | grep -i 'aa:bb:cc:dd:ee:ff'

systemd / a unit install:

sudo journalctl -u lattice-dhcpd -o cat --since '1 hour ago' | grep -i 'aa:bb:cc:dd:ee:ff'

Info lines: dhcp offer, dhcp ack, request nak, dropped untrusted relay. Offers are logs, not Work rows. NAKs are Work.

On-the-wire (the VM, not Lattice): sudo tcpdump -n -i any udp port 67 or udp port 68.

7. Support bundle

Console Help → Collect support bundle (admin) — downloads in the browser on your PC. That is the preferred path.

If the console is dead, SSH: lattice diag -o /tmp/lattice-support.tgz, then copy the file back with WinSCP. REPORTING.md.

Never send keytabs, lattice_live_… tokens, or Patroni passwords.