Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Scenario: we're in the process of setting up central virtualised server that acts as a demonstration environment. This VM (running Windows 7) will be cloned and put on sales laptops so demonstrations can be done "in the field" - using a VM allows us to ensure that we have a good working standard build, without having to worry about what the actual laptop.

The central VM needs to be on our coporate Active Directory domain. We ideally want to remove the domain membership from the cloned versions before it goes on to the sales laptops - in some cases, we'll be getting the VM to the sales guys remotely, so we don't want to have to support them in taking the machine of the domain.

Now, we can't just remove a clone from the domain, as being a direct clone it will also take the central VM off the domain. Removal of the domain will probably be done whilst the machine is on the corporate network - so whilst we could try and isolate the clone from the network, I'm expecting this to be forgotten about at some point.

So - I'm thinking that we need to look at using sysprep to do the dirty work, using the [Identification] section to take it off the domain and stick it on a workgroup. Has anyone any experience of this and advise of any caveats given what we want to do? It seems straightforward enough that it's making me think I've missed something...

Cheers :-)

EDIT (in answer to questions)

  • We're intending to use VirtualBox on the laptops to host the virtual machines; it's both fairly straightforward for non-techs to use, whilst being completely reliable without going to the extreme of having a Server OS on the laptop.

  • No domain access is needed - the VM is entirely standalone; however it needs to be on the domain whilst being centrally hosted and network-accessible due to our security policies.

  • Remote access isn't an option - this leaves us at the mercy of a third party's network (i.e., can we raise a VPN connection - or even get on a network in the first place?) or the mobile network (is the signal going to be good enough and reliable enough for a sustained demo?). Having a VM locally hosted where no external connctivity is required ensures that demos can occur regardless of local conditions.

share|improve this question
I'm sorry, but the following part of your question doesn't make any sense: "Now, we can't just remove a clone from the domain, as being a direct clone it will also take the central VM off the domain." – joeqwerty Apr 20 '12 at 16:28
As @N8J points out - if I try to remove an exact clone from the domain (by making the clone a member of a workgroup, for example), it has the knock-on effect of removing the original machine as the machine SIDs are identical. Similarly, I can't rename the machine and then remove it as AD will register the name change, and knock the original machine (that's not aware of the name change, but the SIDs are still identical) off the domain. – Chris J Apr 23 '12 at 9:33

1 Answer 1

You want to have a VM running on sales laptops in your environment? Will they be booting from the virtual machines VHD or running a VM program? Will there be any need for domain resource access? You are correct in your thinking that sysprep will remove any of the domain markings and joni the image to a default workgroup.

You can have a centralized VM that the sales team can all access remotely, that might be better unless your company likes the imaging of machine, etc.

@joeqwerty I think what he is saying is that it would disable the computer account in AD if there are two machines with the same information on the domain at the same time, they wouldnt be able to login.

share|improve this answer
Questions answered inline. On the remote access front - this isn't an option: some demos are performed in places with fairly limited connectivity (either we can't raise a VPN due to a corporate firewall at the place we're doing a demo thus we can't rely on a 3rd party site's network, or the mobile signal isn't reliable enough to allow for connectivity via 3G [either due to the remoteness of a site, or on the flip side, mobile congestion). As such, having a locally hosted VM is the most reliable way to have a demonstration system. – Chris J Apr 23 '12 at 9:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.