After changing the name of the Windows computer (hostname), I needed to find out its previous (old) computer name.
It is possible to retrieve the previous computer name from the HKLM\SOFTWARE\Microsoft\SchedulingAgent registry key. Use the Registry Editor to check the value of the OldName parameter, or query the registy item value using PowerShell:
(Get-ItemProperty HKLM:\SOFTWARE\Microsoft\SchedulingAgent\).oldname
It contains the computer name that was generated during the installation of Windows. Any further computer renames will not be displayed here.
To view the full history of a computer’s hostname changes, check the Event Viewer logs for host rename events.
- Open the Event Viewer snap-in (
eventvwr.msc) - Expand Windows Logs -> System
- Filter the event log by Event ID 6011
- Open the latest event with this ID. The event description contains details of the previous and new computer name:
The NetBIOS name and DNS host name of this machine have been changed from WIN10-OLD01 to Win10-NEW01
You can list all available hostname change events from the Event Viewer log using PowerShell.
Get-WinEvent -FilterHashtable @{ LogName = 'System';Id = 6011} | Select-Object TimeCreated, Id, Message
If the Windows Event Logs have been cleared or if new events have been overwritten by the old ones (due to the insufficient size of the Event Viewer log files), the history of hostname changes can be obtained from the C:\WINDOWS\Debug\NetSetup.LOG file.
To quickly search for events relating to changes to the hostname or joining/leaving a domain/workgroup, use the Select-String cmdlet to filter the contents of this log file.
Select-String c:\WINDOWS\Debug\NetSetup.LOG -Pattern "NetpValidateName"
