When managing or troubleshooting Windows systems, there may be instances where you need to find the previous hostname of a computer, especially after a recent rename.

To find the initial original hostname in Windows, we can use a registry value for and to track all renamings, we can use the event viewer and event ID 6011, both ways shown below.


Table Of Contents
  1. By using the Event Viewer and Event ID 6011
  2. By using the Registry for initial original hostname
  3. Links


By using the Event Viewer and Event ID 6011

When you change the hostname of a Windows Computer this will be logged in the System logs by using the Event ID 6011.

Below for example I was creating a new virtual machine in vSphere by creating it from a vSphere virtual machine template.

Here you can see that the origin hostname of the VM template must be WIN-EM39TG9IUB8 and then during creation using the template resp. applying a VM Customization Specification was changed to WIN-7D3QS4CLJ6.

VWware provides with the VM Customization Specification the option to generate a new security identity (SID) for virtual machines created by using a VM template.

VMware therefore has built-in Microsoft’s Sysprep tool.




And finally after joining the virtual machine to my lab domain, the change is also logged below.




By using the Registry for initial original hostname

In the registry under the following path and its string value named OldName, you will find the initial original hostname in Windows. Any further renamings will not shown here. To compare with the event ID 6011, you will see below that in the registry only the initial original hostname is stored.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent\OldName


Below as already shown further above, the second renaming of the hostname when joining the computer to my lab domain, will not update the registry string value OldName and it remains to the initial original hostname.




Links

Review events and errors using Event Viewer
https://learn.microsoft.com/en-us/defender-endpoint/event-error-codes

Recall previous device names on Endpoint Manager
https://learn.microsoft.com/en-us/answers/questions/1060679/recall-previous-device-names-on-endpoint-manager

Sysprep (Generalize) a Windows installation
https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/sysprep–generalize–a-windows-installation?view=windows-11