Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make an image of computer that is in domain. The image itself isn't supposed to be used for anything else then to bring the computer back into state it was saved with (including domain membership). This is test environment to test how drivers behave.

I would like to know how I can prepare domain to support this. I believe there might be some problems with internal passwords synchronization between computer and domain (after 1-3 months redeployment of an image).

What things I need to set up in domain for this to work?

share|improve this question

If you have a default Active Directory Domain, you don't need to do much. The only thing the computers needs is an computer account I think. But you need to do more on the computer your are imaging. Can you share with us how you are imaging, which imaging method (Windows Deployment Services, Altiris. In most of the cases you need to run Sysprep, to generate an new SID for the computer.

share|improve this answer
Well the thing is I don't want new SID. I want it to be as before. The computer will be imaged, some stuff installed, and then reimage, and again install new apps. And so on. We're using ntfsclone, dd without sysprep, as like I said before it's not really something I think is nessecary for that case. Each laptop has different hardware and each laptop will have it's own image. – MadBoy Mar 6 '11 at 20:18
If you reimage and you create a computer with the same SID in your network, you can get serious problems in your network. I would not advise you to do that.See also here:The Machine SID Duplication Myth (and Why Sysprep Matters). It's described in the SID Duplication part. – Guido van Brakel Mar 7 '11 at 3:19
up vote 0 down vote accepted

To get AD to never forget computer that was reimaged multiple times one has to refuse passwords that are changed at domain controller level. This article has all info necessary.

To do this, add the following registry value on all domain controllers: Key = HLM\SYSTEM\CurrentControlSet\Services\NetLogon\Parameters Value = RefusePasswordChange REG_DWORD 1 Default = 0

For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 154501 How to disable automatic machine account password changes

Windows XP and later versions
In Windows XP and later versions, machine account password settings can also be configured by using Group Policy Editor (Gpedit.msc). To configure these settings, follow these steps:

  • Click Start, click Run, type Gpedit.msc, and then press ENTER.
  • Expand Local Computer Policy, expand Windows Settings, expand Security Settings, expand Local Policies, expand Security Settings, expand Local Policies, and then expand Security Options. Configure the following settings:

  • Domain Member: Disable machine account password changes (DisablePasswordChange)

  • Domain Member: Maximum machine account password age (MaximumPasswordAge)
  • Domain Controller: Refuse machine account password changes (RefusePasswordChange)

MaximumPasswordAge has a default value of 30. The Group Policy user interface allows for a maximum value of 999 days, and the component allows for a maximum of 1,000,000 days through the registry.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.