Something like this?
ren today.txt yesterday.txt
adfind -b dc=mycompany,dc=com -f "objectcategory=computer" -csv
-nodn sAMAccountName objectSid | findstr /i 5.0 | sort > today.txt
fc today.txt yesterday.txt > diff.txt
blat diff.txt
Kurt
On Fri, Mar 19, 2010 at 07:42, David Lum <[email protected]> wrote:
> So…I’m trying to catch when a new user and computer is created. Event ID 645
> tells me a new computer is created, but invariably it seems to show the
> default machine name that’s created from fresh Sysprep images (on our case
> it’s like NWEA-7646552 and similar). So, I decided to capture Event ID 646
> (Computer account changed), but all I get is (I think) machine password
> resets since it has SID S-1-5-21 in the description).
>
>
>
> Is there a way to capture when a domain PC gets renamed?
>
> David Lum // SYSTEMS ENGINEER
> NORTHWEST EVALUATION ASSOCIATION
> (Desk) 971.222.1025 // (Cell) 503.267.9764
>
>
>
>
>
>
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
