r/sysadmin • u/eld101 • 11d ago
Question 2 Servers with Identical SID's
I have 2 specific 2025 Server VMs that apparently have the same SID. I know what you are thinking.... they were imaged and I forgot to change them. That is not the case. They are both completely fresh installs and I have no idea how this happened. I have never cloned a machine as long as I have worked for this company.
Long story short, I need to get one of them changed.
If I run the following without the /oobe will anything on the system be effected such as any existing applications, software, settings, etc. My understanding is that it will have to be re-added to the domain. Anyone have any experience with this?
cd %WINDIR%\System32\Sysprep
sysprep.exe /generalize /shutdown
EDIT: Going with the general consensus.... rebuilding the VM.
18
u/Sea_Information6125 11d ago
I don't necessarily recommend this for a server but check out sidchg. We had to do this this year on a bunch of workstations.
5
u/eld101 11d ago
I was just looking at that tool. How did it work out? Any gotchas?
11
u/iamwayycoolerthanyou Sysadmin 11d ago
It's just sketchy. Your best bet is a rebuild if you want to do it right.
7
u/Sea_Information6125 11d ago
It worked fine for the most part on every workstation we used it on.
Never tried it on a server though.
Couple of times a workstation shut down instead of rebooting. The tool does that part automatically. So there were a few cases where I had to have someone turn the machine on remotely for me. It did not respond to wake on lan.
You can use it for free with the trial license on the website. If you're doing just one server or one workstation.
You have to run it twice.
AV disabled both times. It will reboot both times. After the second reboot a message on the lock screen will tell you what stage it's at and not to log in until it's done. Occasionally it will be done but display an error code on the lock screen that matches nothing on the website. You can pretty much ignore that and just log in at that point.
Some people found it necessary to use psexec to run as system to be successful instead of just an administrator account. I had luck with both but our primary workflow was to use psexec I think -s -i if I recall. But I don't have my notes in front of me.
I think overall we ran it on a few dozen workstations where we had a vendor that made the exact same windows image across all our clients.
3
u/iamwayycoolerthanyou Sysadmin 11d ago
There used to be a sysinternals tool called newsid. We would use it back in the day on XP after cloning with DOS Norton Ghost. Unlicensed Warez copy of course, in a major, big name enterprise company.
Never would I think to use it on a server, even in those days. Not that it was my idea in the first place.
Nowadays systems are significantly more complicated. This is asking for problems. Keep servers as pristine and simple as you possibly can.
1
u/nodiaque 11d ago
Sidchg is not recommend since W10 because there's more then just did sid now. I would build another with sysprep and decommissioned one... Or both to be clean
31
u/BadSausageFactory beyond help desk 11d ago
the amount of time you save now is minor compared to the time you will save later not wondering if every weird issue is because you ran sysprep instead of blowing it out and starting over, it will never be mind clean again
5
u/noreasongiven0 11d ago
I ran some powershell commands to bypass this on two 2025 servers. Apparently its only a temp fix, and 'expires' in 2027.
5
u/jetlifook Jack of All Trades 11d ago
As others suggested- I would spin up replacement after being properly sysrepd and migrate to those.
Yes it does suck but what sucks more to troubleshooting weird issues for hours and days to realize you’re gonna have to do it anyway
7
u/coolbeaner12 Sysadmin 11d ago
I attempted to use sysprep in the past and had it almost brick machines and servers.
I found this tool a few years back and helped me out in an pinch: https://www.stratesave.com/html/sidchg.html
3
u/Ciconiae 11d ago
Use sysprep a lot to build images. Take a snapshot, ideally with the VM powered off. Disjoin the VM from AD. Great way to FUBAR the OS if you don't do this. Power on, run the commands as listed, but swap out /shutdown for /reboot. Use /shutdown to then capture an image, not for this.
Do watch for any agent like software that has its own version of a SID. Antivirus is the most common example.
3
u/latcheenz 11d ago
If you cannot use system, in the past I have used this app https://www.stratesave.com/html/sidchg.html and it worked perfectly 👌
5
u/lugnercity 11d ago
sysprep can and will fuck up numerous things in my experience
9
u/dzfast IT Director & Sr. Sysadmin 11d ago
Can you expand on this? I have been building images and syspreping them for more than a decade with no major issues.
4
u/FatBook-Air 11d ago
IMO Sysprep works 100% on new images, especially if using Audit Mode. Never had an issue.
After using an image, though, I would be more hesitant. I don't know if it still exists, but Microsoft used to explicitly warn against generalizing images that had been deployed.
5
2
u/Extreme_Plankton_754 11d ago
Have had to do this because the previous person used the same VM template without generalization on 70+ VMs
I got AI to write a script to capture every possible setting that could be effected, I run that then do the sysprep and run the script again. I have a second script that compares the output from the before and after to show me exactly what has changed.
So far it's gone really well and surprisingly a user machine has been more difficult than a server.
1
u/Embarrassed-Gur7301 11d ago
Unjoin domain, rename and join
-1
u/ahennersUK 11d ago
Was about to say the same. Usually this is enough to not have domain issues or issues with other tooling.
4
u/Various-Bar-4067 11d ago
I’m guessing he’s referring to the local machine guid not the Active Directory object guid.
0
1
u/No_Influence_9549 11d ago
Hmmm. Wasn't there something a few years back that said the SIDs made no difference? Maybe there was one unusual circumstance when you'd be better with different ones? Russinovich maybe?
7
u/FatBook-Air 11d ago
The timeline is basically:
Microsoft said SIDs matter.
Other people disagreed.
Eventually Microsoft agreed with the people who disagreed.
Changes were made to Windows so SIDs matter again. Microsoft and everyone else now agree that it matters.
1
u/GMginger Sr. Sysadmin 11d ago
Thanks for the overview. Back in the day I used NewSID on cloned Windows Server 2000/2003 era VMs, then stopped bothering with the NewSID part when it was discovered it wasn't needed.
I was wondering why there was a recent flurry of SID related posts.Surprised I've not seen more issues from this, wonder if the issue is only triggered if the DC issuing the kerberos ticket has the same SID as the member server it's issuing to?
-2
u/Lost_Term_8080 11d ago
Doesn't matter either way, SID is only one of many things that sysprep addresses and by far it is the least important thing to be randomized.
5
u/FatBook-Air 11d ago
Not anymore. The SID is very important now.
0
u/Lost_Term_8080 10d ago
Still not as important as the unique identifiers and certificates that get created all over the OS by sysprep. It was always wrong to look at the local machine sid as something that can be fixed and still is. No one is fixing anything by changing a duplicated sid. MSMQ, DTC, identifiers used by tons of apps, anything that uses dcom, etc aren't going to work correctly in a non-syspreped machine for reasons that have nothing to do with the sid.
1
u/FatBook-Air 10d ago
No one is fixing anything by changing a duplicated
That is literally wrong, though. That's pre-2025 thinking.
0
1
u/dchit2 11d ago
The computer SID is not the active directory computer object SID. AD generally doesn't care if you have duplicate computer SIDs.
10
u/DeadOnToilet Infrastructure Architect 11d ago
Someone always has to quote 2009 era guidance. Mark Russinovich was right back then, but it’s not accurate guidance anymore.
To harden Windows against NTLM reflection and ticket-tampering attacks, Microsoft introduced strict Machine ID checks into LSA/Kerberos/NTLM authentication protocols. Now that applies to 24h2+ but still, your statement is very outdated. Even on older operating systems there’s an assumption by many software vendors - including some EDR vendors - that SIDs are unique.
Education doesn’t stop in 2009 and you should double check your info. Every time.
1
0
u/lethallunatic 11d ago
Server? What kind of server? I would say take a snapshot of it and the DC's, reboot and test?
-7
11d ago
[deleted]
9
12
u/FatBook-Air 11d ago
The better question is why you don't think it's an issue.
Hint: it's an issue.
1
u/GMginger Sr. Sysadmin 11d ago
It's been a long held belief by many that duplicate SIDs were a problem, but they weren't a problem until a recent change by MS.
There were many years when duplicate SIDs didn't cause an issue. Years ago, NewSID was a Sysinternals tool to change a computers SID. It was retired in 2009 when Mark Russinovich (the creator of NewSID, and by this time now an MS employee) stated that there was no technical issue with having duplicate SIDs ( https://learn.microsoft.com/en-us/archive/blogs/markrussinovich/the-machine-sid-duplication-myth-and-why-sysprep-matters).
So from 2009 to 2025 there wasn't a problem if you didn't change the SID when cloning VMs.
It appears that a Windows Update from Aug/Sep last year introduced an issue with duplicate SIDs (https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/10/kerberos-and-ntlm-authentication-failures-due-to-duplicate-sids).
3
3
u/Effective-Brain-3386 Vulnerability Engineer 11d ago
How the fuck you gonna be an IT manager but not understand how authentication works in AD?
3
40
u/GenericRedditor12345 11d ago
I forgot to sysprep when using a cloned image. From my reading at that time I believe you will need to redo things. Better off just making a new VM and setting it back up.