Perhaps you use a message box asking the end-user if logged into their pc or someone elses, and depend upon end-users to help out here. If user responds 'Yes', begin rename process and write check file at end. If 'No,' bypass and perhaps send admin alert.

Have a check file named <userid.txt> so end-user can not update more than one machine. Include old name, MAC and IP address, date/time etc. Then, watch rename process over a few days, contact users logging into the machines that do not get properly updated (info in the DC security event log).

Can also check board for process to limit user login to single machine at a time to help control multiple logins during this name change.

Not the most elegant method, but will take care of the vast majority of your systems and leave you with only a few troublesome ones to correct.

Bill