One user wanted to find the original name of an account after it "being changed from Control Panel." Based on existing answers to that question, I determined that there was some confusion about which name was changed. Accounts have a display name that shows up in most user-facing places. There's also a SAM name: the internal name that you can type into a domain login prompt. It's more challenging to change the SAM name - the only convenient way I know is to use the lusrmgr.msc snap-in - while the standard Control Panel allows the display name to be changed with ease.
While changes to the SAM name produce an event in the event log (4781, to be specific) with the old and new names, that's not the case for the display name. All account properties changes produce event 4738 with the new data, but the old value is not recorded. Therefore, the only way to find the old display name would be to find the previous instance of event 4738, which might have aged out of existence.
No comments:
Post a Comment