I'm hoping someone can confirm my observations because I'm questioning my memory...

The title kind of says it all. While working rapidly on deploying a number of similar systems, it appeared that we were able to create systems with the same name and Active Directory allowed us to add them to the domain.

Problem was that one of the machines would no longer "see" the domain, saying it wasn't able to see it anymore.

I removed a machine from the domain and then re-added it with a variation to the name; am I misremembering something, or is it possible to add two machines to AD and effectively drop the other machine from the domain? Am I wrong in thinking this is something that AD shouldn't allow in the first place? I thought it would give a warning, as AD does when you try adding a username that already exists withing the AD structure.

  • I would like to add it is possible to add multiple computers with the same name within the same forest (different domains). Microsoft recommends you don't do this though. – user103433 Dec 7 '11 at 16:54

No, computer names must be unique. When you added the second computer with the same name, windows changed the sid in the AD database that goes with that name making the first machine not able to talk to the domain.

To keep the first machine on the domain, you'd need to remove the second machine from the domain, then readd the first machine back to the domain. Then add the second machine to the domain under a second name.

To keep the second machine on the domain, take the first machine from the domain, rename it and add it back to the domain under the new name.

  • beat me by 8 seconds :) – MDMarra Aug 22 '09 at 3:29
  • The names have to be unique for it to work properly, I know that...well, you confirmed it. But what I was wondering was why it let me do this. I actually first wondered if what happened was really what I thought happened, since the behavior is different when, say, adding another user with the same name (error!) – Bart Silverstrim Aug 22 '09 at 3:31
  • 1
    Well, it is common practice to pre-create computer accounts in OUs before they are actually joined to AD. In order for those computers to go into the proper OU when they are joined, they need to be able to join AD in place of an account that already exists. – MDMarra Aug 22 '09 at 3:34
  • @MarkM: Thanks for the heads up...I hadn't run into that! We normally create the machines by joining then moving the resulting objects. So you can create the machine names, and joining the machine automatically creates and associates names to the SIDS? – Bart Silverstrim Aug 22 '09 at 3:49
  • That's basically right. That way don't have to worry about the correct GPOs applying and you don't have to remember to move things. – MDMarra Aug 22 '09 at 4:02

The machine name is the same, but the SID changes when you add a new computer with the same name as the old one. The SID is what everything in AD is tied to, not the same. This effectively "bumps" the old machine out of AD, as the corresponding SID no longer exists.

  • Apparently my fingers flew slightly faster than yours. – mrdenny Aug 22 '09 at 4:17

Are you properly sysprepping the machines so as to get a different SID? I think your issue isn't as much the hostname as it may be SID related. Either way, you shouldn't have the same machine in AD multiple times, but I do believe that AD actually allows this to happen.

I think the crux of your problem may be SID related.

  • Yes, they're SIDded to a different ID (used NewSID). – Bart Silverstrim Aug 22 '09 at 3:32
  • Side note...yeah, I knew that, I didn't mean to add them multiple times! It was an accident in the names as we were trying to add batches of systems in rapid succession... – Bart Silverstrim Aug 22 '09 at 3:33

Couple thoughts-

NewSID is really not a supportable way to do this at all. You should be using Sysprep on any Windows 2000 or better device.

AD will enforce the computer name uniqueness check with regard to the sAMAccountName attribute which will have the computer's name (followed by a $ sign).

Since AD is a distributed system, it's entirely possible that two computers could be created with the same name on two domain controllers between replication cycles. Assuming they're created in the same container, AD would turn one into a conflict object.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.