Share via

How to Determine When the Computer Name Was Changed

  • Article

You can determine when a computer name was changed by looking for Event ID 6011 from source EventLog in the System log. The 6011 is logged at reboot after Event ID 6006 "The Event log service was stopped" and before Event ID 6009 <Windows version> and Event ID 6005 "The Event log service was started."

Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6011
Date:  3/3/2011
Time:  6:09:19 PM
User:  N/A
Computer: <NewComputerName>
Description:
The NetBIOS name and DNS host name of this machine have been changed from <OldComputerName> to <NewComputerName>.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.