I think you'll have to audit object access to get that. Regards,
Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: David Lum [mailto:[email protected]] Sent: Friday, March 19, 2010 10:43 AM To: NT System Admin Issues Subject: Computer account creation So...I'm trying to catch when a new user and computer is created. Event ID 645 tells me a new computer is created, but invariably it seems to show the default machine name that's created from fresh Sysprep images (on our case it's like NWEA-7646552 and similar). So, I decided to capture Event ID 646 (Computer account changed), but all I get is (I think) machine password resets since it has SID S-1-5-21 in the description). Is there a way to capture when a domain PC gets renamed? David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
