diff --git a/playbook/shopfloor-setup/Shopfloor/lib/Update-MachineNumber.ps1 b/playbook/shopfloor-setup/Shopfloor/lib/Update-MachineNumber.ps1
index 0a457ba..1f6b334 100644
--- a/playbook/shopfloor-setup/Shopfloor/lib/Update-MachineNumber.ps1
+++ b/playbook/shopfloor-setup/Shopfloor/lib/Update-MachineNumber.ps1
@@ -60,16 +60,19 @@ function Update-MachineNumber {
         [string]$Site = 'West Jefferson'
     )
 
-    $out = @{ UdcUpdated = $false; EdncUpdated = $false; Errors = @(); RegImported = $null }
+    $out = @{ UdcUpdated = $false; EdncUpdated = $false; Errors = @(); RegImported = $null; OldUdc = $null; OldEdnc = $null }
 
-    # --- If UDC or eDNC is still at placeholder 9999, try to pull the
-    #     per-machine .reg backup from the SFLD share and restore all
-    #     the eFocas/PPDCS/Hssb config. The tech-typed $NewNumber is still
-    #     written last (below), so the restore never clobbers it. ---
+    # If the machine number is changing (placeholder->real OR real->real
+    # reassignment after a duplicate-image), pull per-machine state for the
+    # new number from the SFLD share: NTLARS .reg, UDC settings, UDC live
+    # data. The live-data restore is idempotent via one-shot migrated/
+    # consumption, so it stays safe on reassign too.
     $current = Get-CurrentMachineNumber
-    $isPlaceholder = (($current.Udc -in @('9999', $null, '')) -or ($current.Ednc -in @('9999', $null, '')))
+    $out.OldUdc  = $current.Udc
+    $out.OldEdnc = $current.Ednc
+    $isChanging = ($current.Udc -ne $NewNumber) -or ($current.Ednc -ne $NewNumber)
 
-    if ($isPlaceholder -and $NewNumber -ne '9999') {
+    if ($isChanging -and $NewNumber -ne '9999') {
         $sharePath = $null
         $siteCfgPath = 'C:\Enrollment\site-config.json'
         if (Test-Path $siteCfgPath) {
@@ -329,5 +332,19 @@ function Update-MachineNumber {
         }
     }
 
+    # Keep C:\Enrollment\machine-number.txt in sync. Post-imaging GE-Enforce
+    # prefers eDNC reg, but imaging-time scripts (Install-FromManifest
+    # TargetMachineNumbers filter, 01-eDNC.ps1, 03-RestoreEDncConfig.ps1)
+    # still read this file. Avoid drift on reassign.
+    try {
+        $mnFile = 'C:\Enrollment\machine-number.txt'
+        $mnDir  = Split-Path -Parent $mnFile
+        if (-not (Test-Path $mnDir)) { New-Item -ItemType Directory -Path $mnDir -Force | Out-Null }
+        Set-Content -Path $mnFile -Value $NewNumber -Encoding UTF8 -NoNewline
+        $out.MachineNumberTxtUpdated = $true
+    } catch {
+        $out.Errors += "machine-number.txt update failed: $_"
+    }
+
     return $out
 }
diff --git a/playbook/shopfloor-setup/gea-shopfloor-collections/Set-MachineNumber.ps1 b/playbook/shopfloor-setup/gea-shopfloor-collections/Set-MachineNumber.ps1
index 9625ba0..c07ad60 100644
--- a/playbook/shopfloor-setup/gea-shopfloor-collections/Set-MachineNumber.ps1
+++ b/playbook/shopfloor-setup/gea-shopfloor-collections/Set-MachineNumber.ps1
@@ -56,8 +56,52 @@ if ($new -notmatch '^\d+$') {
     exit 1
 }
 
+# --- Reassign confirmation (real -> real). Placeholder (9999/null) skips. ---
+$currentIsReal = (($currentUdc  -and $currentUdc  -ne '9999') -or
+                  ($currentEdnc -and $currentEdnc -ne '9999'))
+$differsFromNew = ($currentUdc -ne $new) -or ($currentEdnc -ne $new)
+if ($currentIsReal -and $differsFromNew) {
+    $oldDisplay = if ($currentUdc) { $currentUdc } else { $currentEdnc }
+    $confirmMsg = @(
+        "Reassign machine number from $oldDisplay to $new ?"
+        ""
+        "This will pull from the SFLD share for $new :"
+        "  - NTLARS .reg backup (eFocas / PPDCS / Hssb)"
+        "  - UDC settings (udc_settings_$new.json)"
+        "  - UDC live data backup (if present)"
+        ""
+        "Use this only when the PC was imaged with the wrong number."
+    ) -join "`n"
+    $confirm = [System.Windows.Forms.MessageBox]::Show(
+        $confirmMsg,
+        "Confirm Reassignment",
+        [System.Windows.Forms.MessageBoxButtons]::OKCancel,
+        [System.Windows.Forms.MessageBoxIcon]::Warning
+    )
+    if ($confirm -ne [System.Windows.Forms.DialogResult]::OK) {
+        Write-Host "Reassignment cancelled."
+        exit 0
+    }
+}
+
 $mnResult = Update-MachineNumber -NewNumber $new -Site $site
 
+# --- Audit log: one line per machine-number change. Best-effort. ---
+try {
+    $logDir = 'C:\Logs\Shopfloor'
+    if (-not (Test-Path $logDir)) { New-Item -ItemType Directory -Path $logDir -Force | Out-Null }
+    $logFile  = Join-Path $logDir 'reassign.log'
+    $now      = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $whoami   = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+    $oldDisp  = if ($mnResult.OldUdc) { $mnResult.OldUdc } elseif ($mnResult.OldEdnc) { $mnResult.OldEdnc } else { '(none)' }
+    $regFlag  = if ($mnResult.RegImported) { 'OK' } else { 'skip' }
+    $udcFlag  = if ($mnResult.UdcSettingsRestored) { 'OK' } else { 'skip' }
+    $dataFlag = if ($mnResult.UdcRestored) { 'OK' } else { 'skip' }
+    $mtcCnt   = @($mnResult.MTConnectUpdated).Count
+    $line     = "$now $env:COMPUTERNAME user=$whoami $oldDisp -> $new udc=$($mnResult.UdcUpdated) ednc=$($mnResult.EdncUpdated) reg=$regFlag settings=$udcFlag data=$dataFlag mtc=$mtcCnt"
+    Add-Content -Path $logFile -Value $line -Encoding UTF8
+} catch {}
+
 $results = @()
 if ($mnResult.UdcUpdated) {
     Write-Host "UDC: $currentUdc -> $new"
diff --git a/playbook/shopfloor-setup/gea-shopfloor-nocollections/Set-MachineNumber.ps1 b/playbook/shopfloor-setup/gea-shopfloor-nocollections/Set-MachineNumber.ps1
index 9625ba0..c07ad60 100644
--- a/playbook/shopfloor-setup/gea-shopfloor-nocollections/Set-MachineNumber.ps1
+++ b/playbook/shopfloor-setup/gea-shopfloor-nocollections/Set-MachineNumber.ps1
@@ -56,8 +56,52 @@ if ($new -notmatch '^\d+$') {
     exit 1
 }
 
+# --- Reassign confirmation (real -> real). Placeholder (9999/null) skips. ---
+$currentIsReal = (($currentUdc  -and $currentUdc  -ne '9999') -or
+                  ($currentEdnc -and $currentEdnc -ne '9999'))
+$differsFromNew = ($currentUdc -ne $new) -or ($currentEdnc -ne $new)
+if ($currentIsReal -and $differsFromNew) {
+    $oldDisplay = if ($currentUdc) { $currentUdc } else { $currentEdnc }
+    $confirmMsg = @(
+        "Reassign machine number from $oldDisplay to $new ?"
+        ""
+        "This will pull from the SFLD share for $new :"
+        "  - NTLARS .reg backup (eFocas / PPDCS / Hssb)"
+        "  - UDC settings (udc_settings_$new.json)"
+        "  - UDC live data backup (if present)"
+        ""
+        "Use this only when the PC was imaged with the wrong number."
+    ) -join "`n"
+    $confirm = [System.Windows.Forms.MessageBox]::Show(
+        $confirmMsg,
+        "Confirm Reassignment",
+        [System.Windows.Forms.MessageBoxButtons]::OKCancel,
+        [System.Windows.Forms.MessageBoxIcon]::Warning
+    )
+    if ($confirm -ne [System.Windows.Forms.DialogResult]::OK) {
+        Write-Host "Reassignment cancelled."
+        exit 0
+    }
+}
+
 $mnResult = Update-MachineNumber -NewNumber $new -Site $site
 
+# --- Audit log: one line per machine-number change. Best-effort. ---
+try {
+    $logDir = 'C:\Logs\Shopfloor'
+    if (-not (Test-Path $logDir)) { New-Item -ItemType Directory -Path $logDir -Force | Out-Null }
+    $logFile  = Join-Path $logDir 'reassign.log'
+    $now      = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $whoami   = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+    $oldDisp  = if ($mnResult.OldUdc) { $mnResult.OldUdc } elseif ($mnResult.OldEdnc) { $mnResult.OldEdnc } else { '(none)' }
+    $regFlag  = if ($mnResult.RegImported) { 'OK' } else { 'skip' }
+    $udcFlag  = if ($mnResult.UdcSettingsRestored) { 'OK' } else { 'skip' }
+    $dataFlag = if ($mnResult.UdcRestored) { 'OK' } else { 'skip' }
+    $mtcCnt   = @($mnResult.MTConnectUpdated).Count
+    $line     = "$now $env:COMPUTERNAME user=$whoami $oldDisp -> $new udc=$($mnResult.UdcUpdated) ednc=$($mnResult.EdncUpdated) reg=$regFlag settings=$udcFlag data=$dataFlag mtc=$mtcCnt"
+    Add-Content -Path $logFile -Value $line -Encoding UTF8
+} catch {}
+
 $results = @()
 if ($mnResult.UdcUpdated) {
     Write-Host "UDC: $currentUdc -> $new"