Denial of Service attacks are done for buffer overflow they are normally done from outside the network..
in the logs you will see which IP is doing a DOS attack if it is External IP.
Create a firewall rule to block it or block it from your network firewall.
If it is coming from internal network that means either it is a false postive generated by some network scanner application or that IP is infected with some virus and is attacking other computers in the network..If thats the case isolate that computer patch it with all MS security patches update the latest virus defs and run a full scan in safe mode..then only connect it back to the production network..