So...I'm trying to catch when a new user and computer is created. Event ID 645 tells me a new computer is created, but invariably it seems to show the default machine name that's created from fresh Sysprep images (on our case it's like NWEA-7646552 and similar). So, I decided to capture Event ID 646 (Computer account changed), but all I get is (I think) machine password resets since it has SID S-1-5-21 in the description).
Is there a way to capture when a domain PC gets renamed? David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
