Skip to main content

Duplicate/Identical SID - SnapDeploy Image of Domain Controller

Thread needs solution

 

Good day All:

 

I've been using SnapDeploy for several years (without any duplicate SID errors/alarms), but I've recently started doing something new:  I'm snap-deploying Server20xx images that will become MS AD DS domain controllers.

In addition to the usual customizations, the images are prepped with the Windows Optional feature of MS AD DS Services installed, BUT NOT YET CONFIGURED.

  PS C:\> Install-WindowsOptionalFeature -FeatureName AD-Domain-Services -IncludeManagementTools

Then after deploying two images, I complete the domain creation on one, and go to join the other to the new domain and receive the error below.

Is it possible that some sort of Domain Controller services-specific SID is being assigned to these hosts, that SYSPREP (executed by SnapDeploy agent) is not able to detect/remove/alter? 

~Brian

0 Users found this helpful

Removing the Feature/Role does not solve the problem, so perhaps Windows AD DS is checking something like User SIDs and not machine SIDs. 

 

I will check tomorrow with psgetsid64.exe and WMIC to compare the SIDs on the two resulting images (ADC01 and ADC02 hosts).

 

Correct me if I'm wrong: I just assumed that SnapDeploy was performing a genuine (customized?) SYSPREP to the images when I create them or during the first boot. In re-reading the documentation (ASD6_userguide_en-US.pdf) just now It is not entirely clear to me if that is the case.

 

FYI on the same "build environment" where I use online image capture for SnapDeploy, I also build OVA/OVF Appliance images for use as VM Templates

(but I sysprep manually the image to shut down the VM before export'ing with ovftool.exe)

In testing a pair of those OVAs deployed, this problem doesn't exist.

So this is definitely something about the SnapDeploy is using SYSPREP.

Results of GIDs when using a OVA that has been manually sysprepp'd:

 

I will compare to the SnapDeploy results later today.

I confirm two systems deployed from the same SnapDeploy image (.tib/.tibx)  are confirmed to have duplicate USER and SYSTEM SIDs:

~BAS

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 2
Comments: 1727

Hello Brian.

I suggest you raising a ticket with our support at https://kb.acronis.com/content/8153

This specific scenario requires more details and maybe a session with you to check everything in details.

Best regards.

While I'm waiting on that support contract renewal process, results of another test:

 

I tried creating user "Administrator" during the manual deployment (from WinPE/USB Media) of .TIBX file; same result, Machine and Administrator user SID are unchanged, even if I tell SnapDeploy to re-create that user.

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 2
Comments: 1727

Brian A. Seklecki wrote:

While I'm waiting on that support contract renewal process, results of another test:

 

I tried creating user "Administrator" during the manual deployment (from WinPE/USB Media) of .TIBX file; same result, Machine and Administrator user SID are unchanged, even if I tell SnapDeploy to re-create that user.

Hello! Could you please tell me the reference number of the ticket so I can update it?

Best regards. 

> can yo
 

 We're still working on it.

 

Can an Acronis authorized reseller sell us an Support Contract extension for a perpetual license that has expired?

Or do we have to purchase that directly from Acronis?

Update:

I just noticed, while making documentation, and lookimng at the text closely on a screenshot, that during a manual deployment (how I'm testing; from standalone bootable media), that it explicitly says:

"Security Identifier: Left security identifier as in Master Image"

(This is after the SID Checkbox is grey'ed out/uncheckable)

PS it is the same for Win10 and WinSvr2016 (OS Kernel image v1607 and beyond up to 21H2)

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 2
Comments: 1727

Brian A. Seklecki wrote:
> can yo
 

 We're still working on it.

 

Can an Acronis authorized reseller sell us an Support Contract extension for a perpetual license that has expired?

Or do we have to purchase that directly from Acronis?

Hello!

Please refer to this KB with more details about the maintenance: https://kb.acronis.com/content/20218 

Best regards.

 

Update -- I now have a valid support contract restored on some Server and Workstation licenses.  I will open a formal ticket attached to those.

Case ID: 06245214
frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 2
Comments: 1727

Brian A. Seklecki wrote:

Update -- I now have a valid support contract restored on some Server and Workstation licenses.  I will open a formal ticket attached to those.

Case ID: 06245214

Hello!

You can expect a reply from our support as soon as possible.

Best regards.