Abstract: Techniques for correlation of users to IP address lease events are described herein. In one or more embodiments, an audit system is provided to collect IP address lease events from a DHCP server and authentication data from one or more sources of authentication data. The audit system may store the collected data in a common data store. The common data store may be searched to correlate the IP address lease events with authentication data. In this manner, a comprehensive record of the computers or devices used by a user within a given time period can be established through correlation of the historical IP address lease information from the DHCP server with the user login information from an authentication source. This may occur by matching events using timestamps of the events and the IP address and/or other common elements between two event sources.