So, I'm trying to get notified whenever a new PC is added to our domain (Event ID 645). The funny this is I have been getting notified of machines named with the random SYSPREP name and not the name these guys change the computer name to. Doing research I discover that in my case I need to look for event ID 626 "User account enabled" which catches the new machine name being enabled.
What the hell, you ask? My guys here will join the machine to the domain, then rename it, THEN reboot. Just wanted to share a weird issue... David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
