Where to find the event logs for MAC address and host name changes ?

Where I can find this in the system logs ?

 

MAC addresses don't change (though some hardware will allow you to create a MAC address, by an large the MAC address is hard-coded into a device).

Host changes....hmmmm, not sure. Can you explain in a little more detail why you are asking this question? It may help in answering.

 

I change MAC address in the registry myself, I assume that windows keeps a log of that , where can I find that log ?

Each computer has a host name, type in "ipconfig /all" in the cmd window and on top you will see host name of your computer

 

I know what a host name is...I just don't know if it is logged. You can also see it by going into your computer properties advanced system settings (which is also where you change it)

Changing the MAC address is usually done through the driver settings, but can be changed in the registry...but if you change anything in the registry it is not logged.

My question is why do you want to know where it logged. There may be an easier way to obtain the info you are after

OK, per the host, this is not exactly what you are looking for, but in event viewer for Windows Vista and 7, EVERY logged event has general information included with it, including COMPUTER: {computername}

While the change host name event itself is not logged (at least nowhere I can find it yet), the COMPUTER: {computername} attribute changes with the hostname.

Since a hostname change results in a restart, you can approximate the time of the host name change by observing when the COMPUTER {computername} attribute changes.

Another thought: You could also observe a MAC address change by observing the logs on your router.

Since changing the router ties the MAC ADDRESS to IP Address, changing the mac address would require your computer to obtain a new ip address. Since your router issues ip addresses on a lease basis, your computer will not get the same ip address based on the old MAC Address (it would still be reserved in the ip address pool); so, your computer gets a completely new one.

Your router log should record the time the new address was given.

 

How do you know this ?

Assuming that it is logged, where would it be logged ?
In Windows logs/Under Application or /System logs or under Applications and Services logs when running Event Viewer ?

And where would it be logged in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog ?

 

Because nothing you do in the registry is logged. Microsoft could have logged starting the registry editor, I suppose, but they did not.

Windows logs events. It does not key log. I do not assume where it would be logged, because it is not. And the registry does not log activites on itself.

I'm sorry if that is not an answer you are happy with; and once again, you seem to be somewhat evasive about what you are hoping to accomplish. Generally speaking, the only real reason to change a MAC address (and you are not really changing the mac address, which as I noted is hardcoded on the device) is to hide who you really are. My sense is you're either up to no good or attempting to catch someone who is up to know good.

 

Hello, system restore ?



P.S. I go regularly surfing in an internet bar and I don't like to leave a trace about the time I have spent there or the websites I have visited > no bad intentions, just some privacy
Would you like to visit a bar that is hanging full of camera's watching your every move ?

I also browse using a proxy, nothing illegal about that...

 

Hello, system restore is not a log. It does not "record" activity or settings.

System restore is a copy of several key files that can replace the current files. If you have a problem, running system restore takes the old files that presumably were trouble free and replaces the current ones that presumably are causing a problem.

 

There is a much simpler solution - and one that doesn't involve monkeying around in someone else's computer - don't go surfing in an internet bar if you're so picky about what you're surfing.

 

I bring my OWN laptop to that bar, if not, what need would there be to change the MAC address of a computer that is not mine ?!


P.S. Talking about monkeys or keeskoppen

 

I think the point he was making was that you are being a little overly paranoid--or if he wasn't, I am.

 

You can use the Group Policy Editor to log changes to registry keys. Google Event Auditing or Audit Policy.

The logs are then viewable through Event Viewer.

 

yeah, most of the bars we have are camera recorded. if you do something stupid, you have to stand straight for it. if you don't, why should you bother? preventing them to see WHAT you did, why not? but THAT you where online at all? why should you care about that? it's not like they would care, anyways (or know how to check if they care, most likely).

and why checking eventlogs btw? just change it when you think you need to. what's the log good for?