Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
You can determine when a computer name was changed by looking for Event ID 6011 from source EventLog in the System log. The 6011 is logged at reboot after Event ID 6006 "The Event log service was stopped" and before Event ID 6009 <Windows version> and Event ID 6005 "The Event log service was started."
Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6011
Date: 3/3/2011
Time: 6:09:19 PM
User: N/A
Computer: <NewComputerName>
Description:
The NetBIOS name and DNS host name of this machine have been changed from <OldComputerName> to <NewComputerName>.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.