Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When a computer is joined onto a domain, how is the joined computer verified by the domain controller? I hear there is a SID involved. How is that SID generated? Is there any chance that the SID will change with the addition/removal of hardware/software? Appreciate if anyone could elaborate.

share|improve this question

migrated from Jul 7 '11 at 22:39

This question came from our site for computer enthusiasts and power users.

I don't know how the SID is managed, but once I generated a VM image from a live machine that was part of a domain. Then I booted the VM up and logged in to the domain (while the original box was still logged in). The result was the VM worked fine and the original machine could no long login to the domain - had to login as a local admin and rejoin it to the domain. – The White Phoenix Jul 7 '11 at 19:36
up vote 2 down vote accepted

A "computer account" is created on the domain controller, using a randomly-generated password (which is stored in "LSA secrets" of the local registry and changed every few weeks).

The computer account, like any other Windows NT account, is identified by a static SID, which is generated at account creation time (domain SID + incrementing RID); never changes (unless the account is deleted). The SID is not used for network authentication.

share|improve this answer

The SID is generated by the DC and will not change if hardware is changed. Cloning a system will copy the SID and give issues as noted by @The White Phoenix.

share|improve this answer
I'm not sure what OS you mean. The SID is generated by the DC on which the computer account is created by combining a RID from the RID Pool (comes from RID Master FMSO Role server) and the domain SID. – HostBits Jul 8 '11 at 0:57
He is clear. he says "generaetd by the DC" noting else. – TomTom Jul 8 '11 at 12:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.