Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When a new Windows server machine joins a domain, AD seems to create a machine account "DOMAIN\MACHINENAME$" for that machine with a SID.

If the machine gets reimaged (with another OS, here: W2K8 instead of W2K3) and then rejoins the domin, will AD re-use the existing domain account with the same SID?

(Reason I'm asking is that we use some machine accounts as logins in SQL2008 databases..)

Thanks Max

share|improve this question
add comment

3 Answers

Max: Yes. The existing accounts and SIDs will be re-used.

As long as you don't delete the machine accounts from AD you'll be fine. When you disjoin the old machine the account will be disabled. When you join a new computer (or a new OS on the old computer) to the domain, using the name of an existing computer object in the Directory, the SID of the old computer object will be used. Your machine logons in SQL Server will continue to work fine.

Updated ENTIRELY for Oleg: You're mistakenly conflating the "machine SID" assigned locally in the registry of the member computer with the SID assigned by the DC to the computer object in the Active Directory.

Yes-- resetting the password on the machine account in Active Directory is what happens when you join the domain with a computer named the same as an existing computer object in the Directory. Joining the doamin doesn't change the SID assigned to that existing computer object, though. The SID of the AD computer object is the SID referenced in the SQL Server logons that the poster is talking about, not the local computer SID of the domain member computer.

Local machine SIDs of domain member computers mean nothing in an AD environment.

I'd recommend you read this blog entry from Mark Russinovich, creater of the "NewSID" tool, to get a better idea of why your tirade re: SID re-generation is off-base in a peer-to-peer environment.

share|improve this answer
Sorry, but your are wrong! Only after rejoining of computer to domain it will work definitively. But rejoining is the same as reseting the password of DOMAIN\MACHINENAME$ account, which is almost the same as deleting and creating of this account one more time. By the way depend on who created this computer account before, rejoining can fail. So it is easier to reduce the problem to recreating of account. For technical details see UPDATE part of my answer serverfault.com/questions/143905/… –  Oleg May 21 '10 at 0:15
@Oleg - Evan's rep isn't 37.2, it's 37.2k. As in 37,200. As in when he talks everyone else listens. –  MDMarra May 21 '10 at 1:53
Instead of clearing the question what from servers one plan to "reimage" (the server with SQL server or a server from which connection to SQL server will be made) and and clearing which image with ONOTHER OS (so looks for me more as a clone) one plan to use, which is not a classical re-imaging (see en.wikipedia.org/wiki/Re-imaging) you start with downgrading of the first answer on the serverfault.com and comparing who reputation points. Such kind of discussion is too stupid for me.<br/> Thank you for the polite reception on your site! You are very friendly! –  Oleg May 21 '10 at 14:36
add comment

I always laughed at people that thought newsid (never used it) was doing something for them!

in this case a server would be presenting itself as domain\servername$ to the sql server thus as long it was a functional domain member the login would work.

non functional would be a domain joined server being cloned without sysprep being run.

share|improve this answer
add comment

Imaging with modern full supported tools like sysprep do imaging in steps. They remove some hardware drives before imaging and configure to start some procedures after the first boot of the image. So after you boot the image on new hardware you start a small part of Windows Setup, install new hardware components and configure Windows. You can define (or generate) new computer name for the new machine and add this new computer to the Active Directory domain. So all problems are already solved and imaging software has a corresponding options for different situations. You should only correct choose this options and correct use th imaging software.

Moreover it is possible to start you custom EXEs/CMDs after the first run of the image on the new computer. So you can makes all software specific customization. You all well known software products you immediately will find exact instruction for such customization. You must only define which imaging software use use.

UPDATED mostly for Evan Anderson: OK, you that I be more exact. There are different tools to make imaging. There are exist since NT 4.0 time. First time they was not supported by Microsoft. Starting with Mark Russinovich’s tool NewSID (see http://technet.microsoft.com/en-us/sysinternals/bb897418.aspx) the correct way to imaging way demystificated. The main problems are following:

There are not only an account DOMAIN\MACHINENAME$ in the domain with a SID, but there is a local information like a local domain so named Primary Domain. The local Primary Domain has unique SID (it's not the same value as the SID of account DOMAIN\MACHINENAME$). There are a trust between this local Primary Domain and Active Directory domain so called Trusted Domain. About the terminology which I use you can read on http://msdn.microsoft.com/en-us/library/ms722415(VS.85).aspx in so named LSA API. This API exists since Windows NT 3.1 and be published by Microsoft since Windows NT 3.51. So account in DOMAIN\MACHINENAME$ in the Active Directory are used de facto for trusted relationship (see http://msdn.microsoft.com/en-us/library/ms721868(v=VS.85).aspx). Locally the password of DOMAIN\MACHINENAME$ account will be saved as a secret in registry in the part HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. This password will be changed in about 30 days intervals by computer. Since NT 4.0 you can configure this interval and I am not sure, but about since Windows 2000 you can configure in policy to switch automatic password changing at all.

So it you just save an image of a computer with a ghost for example without using and local SID generation, then you will have saved in the image a password of DOMAIN\MACHINENAME$ account from the time of imaging. If you just restore this image on the same computer after a mouth after creating of image you will have a problem. You will be required to rejoin the computer one more time to the domain. About 13 year ago I wrote programs which do all this actions for Windows NT 3.51 and then NT 4.0.

To make things easier Microsoft created his own tool (sysprep see http://support.microsoft.com/kb/302577) which are full supported since Windows 2000. In makes options to prepare computer be "impersonate" before imaging and configure to make a mini setup after the first start of duplicated image (see http://technet.microsoft.com/en-us/library/bb878150.aspx). So one makes typically an image from the computer removed from a domain and after the first start the duplicated computer receive a new identity: local SID, new computer name, this computer can be automatically rejoint to domain.

To make rejoint to domain there are two ways: either one create computer accounts in the domain or one configure sysprep (see for example http://technet.microsoft.com/en-us/library/bb490332.aspx) to use a predefined domain account which hat permission to add computers to Active Directory Domain.

Sorry for the long answer, but you will really have no problem if you will use sysprep for computer imaging. This tool can be used in environment with 100 000 of Client computers and 1000 of servers which all (or almost all) created with respect of imaging. All computers / servers which will be duplicated will be practically removed from domain before creating of image as a part of imaging process. All customizing of software like SQL Server is a standard solved problem, but the solution are based on concrete imaging tool like sysprep. Just download Windows Automated Installation Kit (which has sysprep), study it (read http://www.microsoft.com/downloads/details.aspx?familyid=901663E1-934F-4793-8EAE-7C0A1CCB83A5&displaylang=en and http://www.microsoft.com/downloads/details.aspx?familyid=F1BAE135-4190-4D7C-B193-19123141EDAA&displaylang=en for other operation systems as Windows 7 there are also corresponding articles) and use it.

share|improve this answer
This has nothing to do with what the poster is asking. –  Evan Anderson May 20 '10 at 22:15
This has even less to do with what the poster is asking, now. The poster isn't asking about deploying machines. He's asking about whether or not logons, associated with existing AD machine SIDs, will continue to be valid if new computers (or new OS's on existing computers) are joined to the domain using the same names as the existing computer objects. –  Evan Anderson May 21 '10 at 1:33
I think the hang up is the word "reimage" and oleg is thinking cloning. which is not the case. –  tony roth May 21 '10 at 2:01
@tony - he shouldn't be hung up on it. The OP states it's to upgrade the OS, so it can't be a clone. I think he's just hung up on trying to prove EA wrong haha –  MDMarra May 21 '10 at 2:18
well 37.3k is one heck of a number, does the guy have a life? –  tony roth May 21 '10 at 2:43
show 2 more comments

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.