Discussion Locked

Computer name has changed

0 helpful
8 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Weird thing..

A few days ago my DC logs start filling with security failure audit from a computer name I didn't know. Well, after I trace it by the IP address, I found that it was a computer in my domain but suddenly its name has changed from "computer" to "Administrator1" and because it didn't have a computer account in DC it gave me those failure audit messages.
The system properties of the computer say that the name is the one it should be. If I ping it by name or IP or localhost again it shows the correct one but the DC and the event viewer on that computer keeps referring to the computer with the new name. I am puzzled. Any help will be appreciated.

8 replies

by tzutzasialbu

Thanks for your answers. Both the DC and the computer sees it with the new name.
I see many events related to that machine..529,672,680.

Thanks.

by allthegoodnamesweregone

in the past i've seen some really really interesting stuff like that and the root cause was the last known good configuration feature having problems overwriting certain parts of the registry. even if that's not the cause, removing the machine from the domain and adding it back should take care of the issue.

by zlitocook

I would disconnect this computer from the wall, fast and take a close look at it. If it looks fine after rejoining the network but still gives a wrong name. There is some thing going on that is not the norm. Most computers even after restoring to an older point should still have the same name, unless it came from another part of the company.
Some searching on computers on a network and name being changed but if things are still showing a different name on the computer. Some thing has been done at a admin level or in the registry.
It is just me I am paranoid, I would do a low level format or at least remove all partitions and format the drive and start over with it.

by dawgit

while I agree with the other guys on this, it sounds like it could be another operator trying to get into your network (from that computer) really check hard for hidden operators on that machine. It could be a bug, or a trojen type, or other mal-ware. Or it could be legit (ok, semi-legit) Some software, when installed, sets up it's own account 'administrator' which becomes a 'user' a .Net program for example might do this.

by tzutzasialbu

I unplugged the machine the minute I've seen the issue. Now I'm trying to find an answer. Do you have any suggestions of what I should check?

Thanks

This discussion is closed to new replies.