Weird thing..
A few days ago my DC logs start filling with security failure audit from a computer name I didn’t know. Well, after I trace it by the IP address, I found that it was a computer in my domain but suddenly its name has changed from “computer” to “Administrator1” and because it didn’t have a computer account in DC it gave me those failure audit messages.
The system properties of the computer say that the name is the one it should be. If I ping it by name or IP or localhost again it shows the correct one but the DC and the event viewer on that computer keeps referring to the computer with the new name. I am puzzled. Any help will be appreciated.
