Win2k Pro Dell C600 renaming itself?

[MichaelDell]

We use Ghost 7.5 to image our PCs and Ghostwalk 7.5.0.354 to change the SID and rename them before deployment. On our Dell C600 laptops, there have been some (12 or more out of hundreds) that will revert to the original computer name of the image. It may happen a few months or a year after the unit was originally imaged. One in particular has done it six or more times recently. Each time it happens, it

Has anyone seen or heard of this? I am trying to figure out where the old computer name would be stored in a manner that it could revert to it.

 

[mattjurado]

I don't use the corporate ghost, but I found this...

Perhaps you didn't change the sid after installing?
Maybe this has something to do with it?

http://service1.symantec.com/SUPPOR...sf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[bcastner]

Only when someone has mucked with the image once sealed. Obviously the Dell is not changing the name. See:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;321281

 

[bcastner]

Mark and Bryce at sysinternals.com have some thoughts that could help:

http://www.sysinternals.com/ntw2k/source/newsid.shtml

 

[MichaelDell]

Matt J:
The SID is changed by Ghostwalker. Ghostwalker is run after the image is pulled down to the workstation. Ghostwalker also renames the workstation to it's assigned name that you give it.

bcastner:
So you have seen where a computer name (NetBIOS name / host name) changes, such as computer123.va.company.com to DELLC600IMG.va.company.com after working successfully in a domain for many months to over a year with the correct name (the name changes on the workstation only, not on the DC). BTW, the article you refer to involved creating a default profile from the Administrator account's.

 

[bcastner]

I have never seen a computer changes its Netbios name.
Dell might have a clue, perhaps something as simple as a battery replacement.

 

[mattjurado]

Does anything appear in the event logs about the time this happens on one of the computers?

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[bcastner]

I hope Dell support has an answer. Other than a new CMOS battery, I cannot imagine how this is possible.

 

[MichaelDell]

Matt J:
It shows a normal shutdown with the correct name, then on the restart, it shows the image name. The only thing that has been standing out to me is that there are messages earlier in the log that states it couldn't find a domain controller to authenticate to, but since it is a laptop, there is a good chance it was the user logging in with cached credentials.

bcastner:
I doubt it is a BIOS issue. Something is reverting in the SAM. On the workstation, it still thinks it is a member of the appropriate domain. Somewhere it is holding the previous workstation name and putting it back in place.

I thought I would throw it out there an see if anyone had seen it before since Dell MS and Symantec's sites didn't turn up anything. Thanks.

 

[mattjurado]

This is a weird one. Even then, it shouldn't affect the netbios name in windows. Can't imagine a virus doing this, at least, none that I have heard of. Perhaps some registry file is being imported on the administrative side, that might be referencing something unintended?

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[bcastner]

My nickel bet is still: a CMOS battery isssue.

 

[mattjurado]

Too steep. How about a penny, I'll take that bet.

By the way, what service pack? Perhaps you might apply (or reapply) SP4 to the machine that this most frequently happens on. If it sticks for a period of time that deems the problem solved, THEN and ONLY THEN would I do this to the other machines. This way you don't have to reimage a bunch of machines when you discover this only caused more issues.

I know, this is a long shot, but this is a strange issue.

And I'm still curious if any scripts, software changes, or registry files have been applied to these desktops before this happens.

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[bcastner]

Darn you are one cheap guy Matt. :^))

If there is ever a resolution to this issue, I would very much like to hear it.

 

[nlm9802]

I would love to hear the resolution on this..

I have seen it happen many times as well, Compaq (deskpro 933), Dell (C800, C810's), and NEC (dinosaur 400's and 650's).

We also use Ghost followed by Ghostwalk

It affects perhaps 2 or 3 computers a month out of about 800. The fix is to remove it from the domain, give it a temporary name (testing1234) reboot, rename it back to what it should be, reboot, add it back to the domain, reboot.

I'd like to know what causes this to happen though.

 

[bcastner]

nlm9802,

Thanks for the report. I still want to see how this issue is finally resolved.

 

[MichaelDell]

I'll take the bet on the CMOS battery since the data for this is in the SAM and shouldn't matter what the BIOS says or thinks. I also think it is a Ghostwalker issue in that it doesn't truely change all of the attributes of the name and/or SID.

I would like to see us move to just using sysprep, but that would be too much of a change for some of the old timers to swallow.

 

[anewguy]

You are not alone. We are experiencing a similar problem.

Our clients are Windows 2000 Professional SP4. We are using Symantec Ghost 7.5 (ghost walker). It does not appear to be hardware specific as it is affecting our Dell desktops and Toshiba laptops.

Ghostwalker reports that the sid is unique but the computer name has somehow changed from something unique to a duplicate computer name. However, if you look at the Full computer name on the Network Identification tab under the System Properties, it will still have the correct unique computer name.

 

[MichaelDell]

anewguy,

If you have one that is doing it, before changing anything, go under the System Properties -> Computer Name tab -> Change button -> More button and see what it has listed for the NetBIOS name. See if it differs from what is shown on the Computer Name tab. I'd like to see what this says, but it is hard for me to see one before one the second level support guys has tried to fix it. I usually don't get pulled in until they give up.