7

I needed to setup 2 vms and naively simply setup one from scratch, made sure it worked correctly, then copied it to another host. Now getting message "the trust relationship between this workstation and the primary domain failed" which apparently is due to the SID being the same on both machines. I've looked around and see a lot of conflicting info about sysprep and how to resolve at this point.

Can I just update SID the machine having domain issues and then all will be well? If so, how can I accomplish that? Thank you

Improve this question
2
  • 1
    I want to think that removing the problem server from the domain and then joining it back will create a new SID. If so, you could do that and then the server will have a new SID.
    – Art.Vandelay05
    May 12, 2017 at 16:58
  • Are these two servers the only ones in the domain? Or are they part of a larger domain? If the former, did you clone them before or after promoting to DC?
    – I say Reinstate Monica
    May 13, 2017 at 3:48

6 Answers 6

Reset to default
8

The only Microsoft supported method to change the SID of the computer is to run sysprep with the /generalize option

edit: So.. clarifying. This goes back to the idea that the computer SID really doesn't matter (except for domain controllers) because it's really the computer account SID in the domain that matters and not the computer/machine SID itself. Removing/deleting/Rejoining the computer will create a unique computer account SID in the domain and would really resolve his issue. But it would not, in the technical sense, create a new SID for the computer itself.

Mark Russinovich discussed the unique machine SID "myth" and there is a follow up article by a different author that goes into additional detail. Finally, there is this MSDN post that, I find, illustrates the machine vs domain computer account SID pretty clearly.

Personally, I've run into the duplicate SID issue where a cloned system was used to create the Domain Controller for a new domain at the start of a domain migration project and the servers in the source domain were not able to authenticate users on the new target domain or join the target domain due to the SID duplication. So, 99% of the time, it doesn't matter.. but when it does matter, it sucks. As a result, I still recommend users generate new machine SID's when they are able to.

Improve this answer
1
  • I eventually saw that comment in some of the sysprep documentation pages. We did this, updated settings after and it worked out.
    – dmr83457
    May 13, 2017 at 13:06
2

"Can I just update SID the machine having domain issues and then all will be well? If so, how can I accomplish that?"

Yes, you can. In Active Directory you will need to delete the computer object of your problem server and then rejoin it to the Domain. This will get you a new SID for the server. However, doing this creates a new Computer Object for your server so all of its group memberships, permissions, etc. will need to be recreated because it has a new SID. Active Directory doesn’t see it as the same server.

EDIT I followed my own instructions and found that my server was issued a new SID. My forest is Windows Server 2012 level.

Before I deleted my server from AD and removed it from the domain enter image description here

The SID after rejoining the domain. enter image description here

I had to restart two times after joining back to the domain. So, to me, the computer receives a new SID from Active Directory after

  • deleting the computer object in AD
  • Removing from Domain
  • Joining the Domain again
Improve this answer
7
  • 1
    Rejoining it to the same domain does not change the SID of the computer. In general, the computer SID does not matter anymore with some exceptions (domain controllers, WSUS, and a few others).
    – Rex
    May 12, 2017 at 19:29
  • @Rex I posted pictures of the results from my answer. The pics are in my edited answer. What am I missing? Seems to me my Computer object was issued a new SID. I might be wrong though.
    – Art.Vandelay05
    May 12, 2017 at 20:18
  • Technically, the machine SID itself has not changed in your screenshots. The computer machine SID is the xxxx-2834132745. The -13155 and -6646 portion represent the computer object (xxxx-BB4$ object) SID in the domain. You can read more here: blogs.msdn.microsoft.com/aaron_margosis/2009/11/05/…
    – Rex
    May 15, 2017 at 13:57
  • 1
    This goes back to the idea that the computer SID really doesn't matter (except for domain controllers) because it's really the computer account SID that matters and not the computer/machine SID itself. Removing/deleting/Rejoining the computer will create a unique computer account SID in the domain and would really resolve his issue. But it would not, in the technical sense, create a new SID for the computer itself.
    – Rex
    May 15, 2017 at 14:00
  • @Rex Yeah, that's what I was thinking that it would resolve the issue because AD only cares about the computer object SID, right? Because that is the process for "id-ing" the objects in AD.
    – Art.Vandelay05
    May 15, 2017 at 14:01
2

If the instance is not busy, or its a new installation, run C:\Windows\system32>Sysprep\sysprep.exe and check generalize

Improve this answer
0

Check out the spiritual successor to NewSID, SIDCHG:

Command-line utility to modify local computer SID and computer name, for Windows 2016/10/8.1/2012 R2/8/2012/7/2008 R2/2008/Vista/2003/XP. It replaces current computer SID with new random SID. In addition, it changes the WSUS ID for Windows Updates, the MachineGuid, the Device Identifier for modern Windows apps, the MSDTC CID, the Dhcpv6 DUID, and the encryption state to preserve encrypted files, Windows Action Center settings, Certificates and other encrypted stored information.

Improve this answer
0

enter image description here

kindly use following command.

VBOXMANAGE.EXE internalcommands sethduuid "S:\vm3\VM3.vdi.vdi"

Improve this answer
-1

Download NewSID from any website. Go to local Administrator account who has SID issue, run this tool and restart the computer. Now the system will be able to access Domain account.

Improve this answer
1
  • NewSID does not work with server 2008 and above.
    – Rex
    May 15, 2017 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .