Sorry - did a stupid copy/paste error...
Ignore the extraneous bits (the part that reads: '| findstr /i 5.0').
That should read:
del yesterday.txt
ren today.txt yesterday.txt
adfind -b dc=mycompany,dc=com -f "objectcategory=computer" -csv
-nodn sAMAccountName objectSid | sort > today.txt
fc today.txt yesterday.txt > diff.txt
blat diff.txt
You'll also have to put in the proper parameters to blat, but that's easy.
Run that once a day, and you should be golden.
Kurt
On Fri, Mar 19, 2010 at 13:30, Kurt Buff <[email protected]> wrote:
> Something like this?
>
> ren today.txt yesterday.txt
> adfind -b dc=mycompany,dc=com -f "objectcategory=computer" -csv
> -nodn sAMAccountName objectSid | findstr /i 5.0 | sort > today.txt
> fc today.txt yesterday.txt > diff.txt
> blat diff.txt
>
> Kurt
>
> On Fri, Mar 19, 2010 at 07:42, David Lum <[email protected]> wrote:
>> So…I’m trying to catch when a new user and computer is created. Event ID 645
>> tells me a new computer is created, but invariably it seems to show the
>> default machine name that’s created from fresh Sysprep images (on our case
>> it’s like NWEA-7646552 and similar). So, I decided to capture Event ID 646
>> (Computer account changed), but all I get is (I think) machine password
>> resets since it has SID S-1-5-21 in the description).
>>
>>
>>
>> Is there a way to capture when a domain PC gets renamed?
>>
>> David Lum // SYSTEMS ENGINEER
>> NORTHWEST EVALUATION ASSOCIATION
>> (Desk) 971.222.1025 // (Cell) 503.267.9764
>>
>>
>>
>>
>>
>>
>
> ~ Finally, powerful endpoint security that ISN'T a resource hog! ~
> ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
>
>
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
