That is a good point. Clearing the cache too soon would negate its effectiveness.

Maybe only the local SIDs should be refreshed (S-1-5-32-*) when the computer name changes? This would add only one entry in the registry (with the computer name used when doing the last enumeration).