2

I am looking into how to track when a computer was renamed and by who.

I know you can pull the eventlog from one computer, but I am needing a report generated on over 1000 PC's for a two weeks period on:

  • who renamed the computer
  • when it was done.

Or if it was taken off the domain and by who and when.

Could this be done on the server side and if so how?

4 Answers 4

3
+100

There are a couple of ways by which you can perform this audit - First the more time-consuming way to get relevant two weeks info:

  • From your PDC, export all AD users and computers using windows server csved tool. The corresponding command syntax is csved -f ADfilename.csv -r objectClass=user and import the exported csv to excel file with filtering data per columns (Note: when importing set the delimiter to commas and tabs to get the appropriate headings before filtering).
  • Likewise import the PDC log file from \Windows\Debug\netsetup.log to a second spreadsheet with the same options as above. From there on, you can do a compare between the two spreadsheets (file1.csv -> file2.csv) and also filter the corresponding data. This can be done very easily with OpenOffice Calc.

Sample Event Data - With Filtering by Date/Time etc.

  • When you perform the compare you can check for the corresponding events from the actual server log and the current AD computers and users list. As per your request, focus on NETLOGON events (id 5719) for domain availability/non-availability per computer and NetBIOS events (id 6011) for changes in the domain name per user.

NOTE: This part might take a while since you need to search and filter all corresponding events while comparing and re-merging to find all changes in the NetBIOS name changes.

After doing that, you can use the following programs/scripted samples to do a long-term monitoring of your AD server events and/or corporate computers:

There are two cool things about creating permanent event consumers via script. The first thing is that it can easily be performed remotely. Therefore,, I can target a several machines with the script and create the event consumer on the remote machines. The second cool thing is the fact that permanent event consumers are cool. They monitor for and respond to events without the need for a script to be running. Talk about something cool! I run one script one time, and then my computer will always look for an event and respond to it.

  • Use third-party tools such as SolarWinds WMI Monitor to view running event statuses on your Domain Controller. Set monitoring for the following WMI namespace classes: Win32_NTDomain, Win32_LogonSession, Win32_ComputerSystem

More information on WMI NetBIOS classes is found here.

1

What you want is a source initiated subscription. This involves a GPO to point the target computers to the collector and configuring the event collector services on the collector. Once you start receiving events, you can filter to the specific events you need.

0

You could get the when part by looking at C:\Windows\Debug\netsetup.log This log shows domain join, disjoin, and rename.

The 6011 event does not report the the who part. That event is only written upon the reboot after the rename. And unless you are actively retaining events from the targets to long term archive with something like Splunk, those events may no longer appear on the individual target event logs. If you are collecting events, do a test rename and look to see if there is a different event written after you rename with your user ID before you reboot.

0

I would use my script for this task.

https://gallery.technet.microsoft.com/scriptcenter/Get-HtmlCSS3-reports-from-64cb3723

Basically, it will look for all the information in the last X days and put it into an HTML5/CSS3 view.

You can run it as a tasks daily for example

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .