Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a number of machines running Win2k3 and 2k8R2 that I would like to join to a domain. All the machines have been imaged from the same image, without using sysprep or anything similar. This means they all have the same SID. Am I going to run into any issues if I try to join all of these to the same domain?

I've already tried this with a couple test machines, and I experienced issues when the domain controllers came from the same image as all the other computers (I was seeing error log messages complaining that the domain controller SID was the same as the machine SID).

I did another test with freshly installed domain controllers (so they had different SIDs), and everything seemed okay.

I've done some research on this, and found some conflicting information. I can find a lot of references to this post, which seems to indicate that the duplicate SIDs are okay. I also find a lot of people saying horrible unspeakable things will happen unless I correct the SIDs.

Are these duplicate SIDs going to cause a problem?

Before anyone suggests any of these:

  • Doing fresh installs of all these machines with new SIDs is out of the question, it would take many months to get through all the machines.
  • Newsid.exe has been officially deprecated, and is not something that I would feel comfortable attempting. The developer of it has not tested it on anything newer than XP.
  • Sysprep is not supported on existing machines. (second paragraph)
share|improve this question
add comment

1 Answer

up vote 10 down vote accepted

Duplicate machine SIDs are not a problem. This is why tools like NewSID are deprecated. In fact, in the blog post about why NewSID is deprecated, there are about 2 pages of text that explain why it's not a problem.

The only time that a local machine SID is exposed outside of that machine is when the first DC in a domain is promoted. It's local SID is used to create the domain SID. This explains why you have problems with cloned DCs.

share|improve this answer
1  
@jscott I was literally editing that link in at the same time as you. My edit got cancelled because of yours. Great minds :) –  MDMarra Mar 3 '12 at 3:31
2  
<facepalm>"Cloned DCs" </facepalm> –  l0c0b0x Mar 3 '12 at 3:32
    
My thoughts exactly. It takes about 5 minutes to run dcpromo. In this case, it's better to click through the wizard. :) –  MDMarra Mar 3 '12 at 3:35
    
I should have elaborated, I took two cloned machines and made them both domain controllers. I didn't clone one after it was made a domain controller. –  devicenull Mar 3 '12 at 3:44
1  
Either way, you shouldn't do that without sysprepping first. –  MDMarra Mar 3 '12 at 3:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.