ActiveDirectory machine accounts: same SID after machine rebuild?

Question

When a new Windows server machine joins a domain, AD seems to create a machine account "DOMAIN\MACHINENAME$" for that machine with a SID.

If the machine gets reimaged (with another OS, here: W2K8 instead of W2K3) and then rejoins the domin, will AD re-use the existing domain account with the same SID?

(Reason I'm asking is that we use some machine accounts as logins in SQL2008 databases..)

Thanks Max

Answer 1

Max: Yes. The existing accounts and SIDs will be re-used.

As long as you don't delete the machine accounts from AD you'll be fine. When you disjoin the old machine the account will be disabled. When you join a new computer (or a new OS on the old computer) to the domain, using the name of an existing computer object in the Directory, the SID of the old computer object will be used. Your machine logons in SQL Server will continue to work fine.

Updated ENTIRELY for Oleg: You're mistakenly conflating the "machine SID" assigned locally in the registry of the member computer with the SID assigned by the DC to the computer object in the Active Directory.

Yes-- resetting the password on the machine account in Active Directory is what happens when you join the domain with a computer named the same as an existing computer object in the Directory. Joining the doamin doesn't change the SID assigned to that existing computer object, though. The SID of the AD computer object is the SID referenced in the SQL Server logons that the poster is talking about, not the local computer SID of the domain member computer.

Local machine SIDs of domain member computers mean nothing in an AD environment.

I'd recommend you read this blog entry from Mark Russinovich, creater of the "NewSID" tool, to get a better idea of why your tirade re: SID re-generation is off-base in a peer-to-peer environment.

Answer 2

I always laughed at people that thought newsid (never used it) was doing something for them!

in this case a server would be presenting itself as domain\servername$ to the sql server thus as long it was a functional domain member the login would work.

non functional would be a domain joined server being cloned without sysprep being run.

Answer 3

Imaging with modern full supported tools like sysprep do imaging in steps. They remove some hardware drives before imaging and configure to start some procedures after the first boot of the image. So after you boot the image on new hardware you start a small part of Windows Setup, install new hardware components and configure Windows. You can define (or generate) new computer name for the new machine and add this new computer to the Active Directory domain. So all problems are already solved and imaging software has a corresponding options for different situations. You should only correct choose this options and correct use th imaging software.

Moreover it is possible to start you custom EXEs/CMDs after the first run of the image on the new computer. So you can makes all software specific customization. You all well known software products you immediately will find exact instruction for such customization. You must only define which imaging software use use.

UPDATED mostly for Evan Anderson: OK, you that I be more exact. There are different tools to make imaging. There are exist since NT 4.0 time. First time they was not supported by Microsoft. Starting with Mark Russinovich’s tool NewSID (see http://technet.microsoft.com/en-us/sysinternals/bb897418.aspx) the correct way to imaging way demystificated. The main problems are following:

There are not only an account DOMAIN\MACHINENAME$ in the domain with a SID, but there is a local information like a local domain so named Primary Domain. The local Primary Domain has unique SID (it's not the same value as the SID of account DOMAIN\MACHINENAME$). There are a trust between this local Primary Domain and Active Directory domain so called Trusted Domain. About the terminology which I use you can read on http://msdn.microsoft.com/en-us/library/ms722415(VS.85).aspx in so named LSA API. This API exists since Windows NT 3.1 and be published by Microsoft since Windows NT 3.51. So account in DOMAIN\MACHINENAME$ in the Active Directory are used de facto for trusted relationship (see http://msdn.microsoft.com/en-us/library/ms721868(v=VS.85).aspx). Locally the password of DOMAIN\MACHINENAME$ account will be saved as a secret in registry in the part HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. This password will be changed in about 30 days intervals by computer. Since NT 4.0 you can configure this interval and I am not sure, but about since Windows 2000 you can configure in policy to switch automatic password changing at all.

So it you just save an image of a computer with a ghost for example without using and local SID generation, then you will have saved in the image a password of DOMAIN\MACHINENAME$ account from the time of imaging. If you just restore this image on the same computer after a mouth after creating of image you will have a problem. You will be required to rejoin the computer one more time to the domain. About 13 year ago I wrote programs which do all this actions for Windows NT 3.51 and then NT 4.0.

To make things easier Microsoft created his own tool (sysprep see http://support.microsoft.com/kb/302577) which are full supported since Windows 2000. In makes options to prepare computer be "impersonate" before imaging and configure to make a mini setup after the first start of duplicated image (see http://technet.microsoft.com/en-us/library/bb878150.aspx). So one makes typically an image from the computer removed from a domain and after the first start the duplicated computer receive a new identity: local SID, new computer name, this computer can be automatically rejoint to domain.

To make rejoint to domain there are two ways: either one create computer accounts in the domain or one configure sysprep (see for example http://technet.microsoft.com/en-us/library/bb490332.aspx) to use a predefined domain account which hat permission to add computers to Active Directory Domain.

Sorry for the long answer, but you will really have no problem if you will use sysprep for computer imaging. This tool can be used in environment with 100 000 of Client computers and 1000 of servers which all (or almost all) created with respect of imaging. All computers / servers which will be duplicated will be practically removed from domain before creating of image as a part of imaging process. All customizing of software like SQL Server is a standard solved problem, but the solution are based on concrete imaging tool like sysprep. Just download Windows Automated Installation Kit (which has sysprep), study it (read http://www.microsoft.com/downloads/details.aspx?familyid=901663E1-934F-4793-8EAE-7C0A1CCB83A5&displaylang=en and http://www.microsoft.com/downloads/details.aspx?familyid=F1BAE135-4190-4D7C-B193-19123141EDAA&displaylang=en for other operation systems as Windows 7 there are also corresponding articles) and use it.