peterha
Goto Top

Notebook Imaging - NEW ID? Notewendig oder automatisch?

Hallo liebe Gemeinde,
hallo Timo,

kurze frage vorm Urlaub noch ;)

Wenn ich ein Notebook geimaget habe und es in die Domäne nehme wird doch eine neue SID generiert richtig? Oder muss das manuell gemacht werden? Soweit ich weiß wird beim Eintritt in eine Domäne ne neue SID generiert?

Danke für Antowrten face-smile

vg
Peter

Content-Key: 141808

Url: https://administrator.de/contentid/141808

Ausgedruckt am: 29.03.2024 um 12:03 Uhr

Mitglied: DerWoWusste
DerWoWusste 30.04.2010 um 09:40:31 Uhr
Goto Top
Nicht notwendig. Mark Russinovich hat letztens seine eigene Software "NEW SID" als "snake oil" bezeichnet, weil sie zu rein gar nichts gut ist (er war jahrelang einem Missverständnis aufgesessen).
Mitglied: onkel-ossi
onkel-ossi 30.04.2010 um 12:13:15 Uhr
Goto Top
The Machine SID Duplication Myth
On November 3 2009, Sysinternals retired NewSID, a utility that changes a computers machine Security Identifier (machine SID). I wrote NewSID in 1997 (its original name was NTSID) because the only tool available at the time for changing machine SIDs was the Microsoft Sysprep tool, and Sysprep doesn’t support changing the SIDs of computers that have applications installed. A machine SID is a unique identifier generated by Windows Setup that Windows uses as the basis for the SIDs for administrator-defined local accounts and groups. After a user logs on to a system, they are represented by their account and group SIDs with respect to object authorization (permissions checks). If two machines have the same machine SID, then accounts or groups on those systems might have the same SID. It’s therefore obvious that having multiple computers with the same machine SID on a network poses a security risk, right? At least that’s been the conventional wisdom.

The reason that I began considering NewSID for retirement is that, although people generally reported success with it on Windows Vista, I hadn’t fully tested it myself and I got occasional reports that some Windows component would fail after NewSID was used. When I set out to look into the reports I took a step back to understand how duplicate SIDs could cause problems, a belief that I had taken on faith like everyone else. The more I thought about it, the more I became convinced that machine SID duplication – having multiple computers with the same machine SID – doesn’t pose any problem, security or otherwise. I took my conclusion to the Windows security and deployment teams and no one could come up with a scenario where two systems with the same machine SID, whether in a Workgroup or a Domain, would cause an issue. At that point the decision to retire NewSID became obvious.

I realize that the news that it’s okay to have duplicate machine SIDs comes as a surprise to many, especially since changing SIDs on imaged systems has been a fundamental principle of image deployment since Windows NT’s inception. This blog post debunks the myth with facts by first describing the machine SID, explaining how Windows uses SIDs, and then showing that - with one exception - Windows never exposes a machine SID outside its computer, proving that it’s okay to have systems with the same machine SID. Note that Sysprep resets other machine-specific state that, if duplicated, can cause problems for certain applications like Windows Server Update Services (WSUS), so MIcrosoft's support policy will still require cloned systems to be made unique with Sysprep.

Quelle: http://blogs.technet.com/markrussinovich/archive/2009/11/03/3291024.asp ...

Gruss
Timo - ach ne, der bin ich ja nicht face-wink
Mitglied: dog
dog 30.04.2010 um 14:39:08 Uhr
Goto Top
Tja und da kommen wir zum eigentlichen Witz an der Sache:
Sysprep setzt WSUS eben nicht zurück.
Ich hatte den Spaß jetzt schon mit mehreren Anläufen und durfte dann per psexec die ganzen SUS-IDs neu erstellen...
Mitglied: DerWoWusste
DerWoWusste 30.04.2010 um 15:51:20 Uhr
Goto Top
Da kann man schön sehen, dass auch Oberinsider wie Russinovich nicht alles Überblicken, was in dem Softwarewust bei MS geschieht.
Erst schreibt er
Note that Sysprep resets other machine-specific state that, if duplicated, can cause problems for certain applications like Windows Server Update Services...
und schreibt nicht dazu, was denn diese "certain" apps sein sollen bzw. welcher Art die sind und dann liegt er (laut dog) auch noch falsch mit seinem Tipp zum Kloning und sysprep - wobei ich hier anderer Ansicht bin: unsere Klone brauchten keine neue WSUS-ID und wurden dennoch upgedated.