Re: Concrete Examples of Duplicate SID problems--Do y'all have any?

Shenan Stanley wrote:
Ian wrote:
Did some fairly extensive benchtests on this, and AFAICS in the
situation where two computers have an identical
user-account/password pair it makes no odds whether SIDs of the
accounts are identical or not. Microsoft seem to indicate that
having differing SIDs should provide security between the two
computers.. but it doesn't, as is easily demonstrated.

Over the course of my career I've imaged numerous 2000/XP
computers, and never seen these purported problems 'in the wild.' I
use NewSID, but I'm unsure whether it makes any measurable
difference.

I don't regard sysprep as being a usable tool, mainly because it
loses the default userprofile setup. What is the point of
sysprepping, if the settings, so painstakingly done, are lost? You
might as well start from scratch in that case.

Usual policy these days for new computers is to image from a stock
copy for that model, then change the serial and re-activate.

As far as I can tell from the write-ups, the SID question does not
apply to domain accounts either, only to local accounts.

Haven't researched sysprep in a while, eh?
http://support.microsoft.com/kb/887816


I have, I use it daily, and I agree with everything he said. All that article points out is that Microsoft no longer think we have the intelligence to set up our own "default user" profiles and decided to use the local administrator profile to rebuild the "default user" profile in effect. Easily worked around by using the local admin profile to set up your default user profile.

That doesn't address the rest of the mangleations that you don't encounter if you don't use Sysprep. Firewall being turned back on for instance, the security database being randomly mangled as well. A few other things, all of which we've managed to work around with a post-image job using Altiris, but not everyone has Altiris or a comparable desktop management environment.


As far as the SID - again - 60 seconds of automated time vs potential issues (even if no one has actually seen them in years.. - although that could be because most change the SID and/or join domains now..) leads me to the decision to continue chaning the SIDs on newly images systems..


Agree with you entirely. Use sysprep if you want a one image fits all model and are willing to work around the mangleations, or if you have only a few hardware platforms use a dedicated image for each, use a proper SID changing tool, and steer well-clear of Sysprep. Best advice I can think to give in the real world environments we all work in.

.

Relevant Pages

  • SIDs
    ... I need to find out which SIDs are modified by Sysprep. ... There are some computers in the domain and I don't want to ... SIDs without running Sysprep. ...
    (microsoft.public.win2000.security)
  • Re: Concrete Examples of Duplicate SID problems--Do yall have any?
    ... situation where two computers have an identical ... user-account/password pair it makes no odds whether SIDs of the ... I don't regard sysprep as being a usable tool, ... apply to domain accounts either, ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Certain groups not seen
    ... You are seeing SIDs instead of account names for specific containers from ... or do the accounts not show up at all? ... Double check any differences that exist between these computers and other ... > container on my domain controller are not visible on computers in the ...
    (microsoft.public.win2000.security)
  • Re: New Domain
    ... If you use ADMT to migrate the computer accounts, you can translate the SIDs on the profile so that the new object uses the old profile. ... When you migrate that will come across, unless you choose to retranslate the permissions, which is an option that ADMT and 3rd party migration products give you. ...
    (microsoft.public.windows.server.active_directory)
  • Re: sysprep
    ... Sysprep is required for applying an image to a new computer. ... Sysprep in Vista is different from XP and before ... Sysprep with Altiris is built-in. ... updated sid changer other then sysprep that changes sids. ...
    (microsoft.public.windows.server.general)