subspace_1 Posted February 2, 2010 Share Posted February 2, 2010 A collegue of mine insists that changing the sid on the cloned computers is not necessary before joining the domain as the computer account created in the AD is a different one each time. In fact for the machines (XP laptops, all the same branded laptop model) are cloned without new SID! What do you say about this? Do the same things apply to win7 and win2008r2? Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/ Share on other sites More sharing options...
s0nic69 Posted February 2, 2010 Share Posted February 2, 2010 this should help you. http://blogs.technet.com/markrussinovich/archive/2009/11/03/3291024.aspx Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/#findComment-592192080 Share on other sites More sharing options...
sc302 Veteran Posted February 2, 2010 Veteran Share Posted February 2, 2010 what happens is the computer has a identifier (very long key), that identifier gets put into the dc when the pc is joined. if that identifier is duplicated amongst all or most or some of the computers and computer level securities (like group policies) will not get applied properly and you will have a ton of issues. To save from that headache of the domain seeing all of the same computer (even though you may change the name of the pc it does not change the identifiers in the registry or the identifiers in active directory) it is best to use some sort of sid regenerator (new sid, sysprep, ghost walker, etc). You want a ton of random domain issues keep doing it the way he is without regenerating the sid at each deployment. http://windowsitpro.com/article/articleid/14919/what-are-the-problems-with-workstations-having-the-same-sid.html http://download.cnet.com/DSM-Duplicate-SID-Monitor/3000-2094_4-11011883.html when you start dealing with this issue on a large scale (1000+ pc's) you start to see the reason behind newsid and sysprep. Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/#findComment-592192156 Share on other sites More sharing options...
Owen W Veteran Posted February 2, 2010 Veteran Share Posted February 2, 2010 On 02/02/2010 at 23:38, sc302 said: what happens is the computer has a identifier (very long key), that identifier gets put into the dc when the pc is joined. if that identifier is duplicated amongst all or most or some of the computers and computer level securities (like group policies) will not get applied properly and you will have a ton of issues. To save from that headache of the domain seeing all of the same computer (even though you may change the name of the pc it does not change the identifiers in the registry or the identifiers in active directory) it is best to use some sort of sid regenerator (new sid, sysprep, ghost walker, etc). You want a ton of random domain issues keep doing it the way he is without regenerating the sid at each deployment. http://windowsitpro.com/article/articleid/14919/what-are-the-problems-with-workstations-having-the-same-sid.html http://download.cnet.com/DSM-Duplicate-SID-Monitor/3000-2094_4-11011883.html when you start dealing with this issue on a large scale (1000+ pc's) you start to see the reason behind newsid and sysprep. Windows 7 does not use SID's for computers, but rather, unique SID identifiers per user. SID changing is not compatible with Windows 7 or Windows Server 2008 R2. As the link above suggests: "In other words, it’s not the SID that ultimately gates access to a computer, but an account’s user name and password: simply knowing the SID of an account on a remote system doesn’t allow you access to the computer or any resources on it." Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/#findComment-592192166 Share on other sites More sharing options...
Joel Posted February 2, 2010 Share Posted February 2, 2010 On 02/02/2010 at 23:43, Owenw said: Windows 7 does not use SID's for computers, but rather, unique SID identifiers per user. SID changing is not compatible with Windows 7 or Windows Server 2008 R2. As the link above suggests: "In other words, it?s not the SID that ultimately gates access to a computer, but an account?s user name and password: simply knowing the SID of an account on a remote system doesn?t allow you access to the computer or any resources on it." You're confusing user SIDs with machine SIDs. As sc02 said, if you clone a currently-joined computer and deploy that image throughout the domain, you WILL have issues. There is a reason that sysprep includes the option to change machine SIDs, and newsid just took it one step further for ease of use. Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/#findComment-592192184 Share on other sites More sharing options...
Owen W Veteran Posted February 3, 2010 Veteran Share Posted February 3, 2010 On 02/02/2010 at 23:52, Joel said: You're confusing user SIDs with machine SIDs. As sc02 said, if you clone a currently-joined computer and deploy that image throughout the domain, you WILL have issues. There is a reason that sysprep includes the option to change machine SIDs, and newsid just took it one step further for ease of use. OK, fair point, but you do know they removed SID changing from Windows 7's version of SYSPREP, right? Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/#findComment-592192256 Share on other sites More sharing options...
sc302 Veteran Posted February 3, 2010 Veteran Share Posted February 3, 2010 I was just reading, the generalize option in windows 7 sysprep will regenerate the machine sid. there are other docs/sites that go over this, but this covers it http://www.brajkovic.info/windows-server-2008/windows-server-2008-r2/how-to-change-sid-on-windows-7-and-windows-server-2008-r2-using-sysprep/ Also within imaging utilities like acronis and ghost, they have options to regenerate the sid during imaging so that you don't have to run sysprep. Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/#findComment-592192756 Share on other sites More sharing options...
subspace_1 Posted February 3, 2010 Author Share Posted February 3, 2010 thanx guys for your massive response! I 'm looking into the sources you gave, just one aspect that i didnt figured out: if i have a system image PRIOR to joining to the domain will joining it to the domain CHANGE the Computer SIDs anyway, so i wont have to bother at all? Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/#findComment-592193458 Share on other sites More sharing options...
Joel Posted February 3, 2010 Share Posted February 3, 2010 On 03/02/2010 at 00:12, Owenw said: OK, fair point, but you do know they removed SID changing from Windows 7's version of SYSPREP, right? He said the machines are XP. On 03/02/2010 at 08:21, subspace_1 said: if i have a system image PRIOR to joining to the domain will joining it to the domain CHANGE the Computer SIDs anyway, so i wont have to bother at all? Change it anyway. Run sysprep before taking your image and restore your machines using that image. Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/#findComment-592194042 Share on other sites More sharing options...
sc302 Veteran Posted February 3, 2010 Veteran Share Posted February 3, 2010 The system identifier gets put on during the install process, not during a join of the domain. Sysprep it before you image it. Link to comment https://www.neowin.net/forum/topic/871854-changing-sid-with-newsid-or-sysprep-for-cloned-computers/#findComment-592194426 Share on other sites More sharing options...
Recommended Posts