up vote 0 down vote favorite
share [g+] share [fb]

When a computer is joined onto a domain, how is the joined computer verified by the domain controller? I hear there is a SID involved. How is that SID generated? Is there any chance that the SID will change with the addition/removal of hardware/software? Appreciate if anyone could elaborate.

link|improve this question
100% accept rate
I don't know how the SID is managed, but once I generated a VM image from a live machine that was part of a domain. Then I booted the VM up and logged in to the domain (while the original box was still logged in). The result was the VM worked fine and the original machine could no long login to the domain - had to login as a local admin and rejoin it to the domain. – The White Phoenix Jul 7 '11 at 19:36
feedback

migrated from superuser.com Jul 7 '11 at 22:39

This question came from our site for computer enthusiasts and power users.

2 Answers

up vote 2 down vote accepted

A "computer account" is created on the domain controller, using a randomly-generated password (which is stored in "LSA secrets" of the local registry and changed every few weeks).

The computer account, like any other Windows NT account, is identified by a static SID, which is generated at account creation time (domain SID + incrementing RID); never changes (unless the account is deleted). The SID is not used for network authentication.

link|improve this answer
feedback
up vote 0 down vote

The SID is generated by the DC and will not change if hardware is changed. Cloning a system will copy the SID and give issues as noted by @The White Phoenix.

link|improve this answer
I'm not sure what OS you mean. The SID is generated by the DC on which the computer account is created by combining a RID from the RID Pool (comes from RID Master FMSO Role server) and the domain SID. – Cheekaleak Jul 8 '11 at 0:57
He is clear. he says "generaetd by the DC" noting else. – TomTom Jul 8 '11 at 12:06
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.