Scripting new SID for PCs

[MkII]

Is this possible? Shockingly in my LA we have 5,000 client PC's all imaged off a few image, that no one ever bothered to sysprep or newsid.

 

In March we switch to AD and obviously this is a problem. Our able but anti AD / AD project leader says he's scripting the creation of new SIDs on all 5,000 PC's, and it doesn't sweem right to me, having run newsid and seen how it takes at least 3 minutes to execute, obviously needing elevated privileges.

[Dom_]

Never tried but it might be possible to do it via PSexec?

[MkII]

Possible yes but not quick/ transparent like i'd presume you'd need.

[K.C.Leblanc]

Never tried but it might be possible to do it via PSexec?

 

I'd have though this would work, PSEXEC lets you specify which user account to use. However I'd expect if you change a computers SID you'll then have to rejoin whichever domain it's attached to.

[Michael]

You'd be better off running Sysprep with an answer file, so they then automatically re-join the domain.

[srochford]

I think a massive amount of care is needed here!

 

You can't just run newsid and leave it there; I'm pretty sure that will break the link to AD (the SID for the computer is stored in AD; not sure if that's the only link but it won't be good to have one SID on the machine and another in AD)

 

You could have a machine startup script which ran newsid and then rejoined the domain using netdom.

 

Another alternative might be to use sysprep; provided that there are no local accounts on the machines you won't lose anything (domain profiles will be fine, any files created by domain users will also be OK because the ACL will contain a domain SID and that won't change)

 

What I think you could do is use a machine startup script to generate a sysprep.inf for each machine (it's going to fairly straightforward; the only thing that will be different is the machine name and that's going to be the same as the machine is now). I don't think you even need to run mini-setup - the hardware hasn't changed - you just need the "regenerate security identifier option"

 

Logic would be something like:

 

Have I already been sysprepped (check for flag file or registry entry) - yes, quit

Copy sysprep folder from server and edit line with computer name to match "my name"

Run sysprep and force reboot at end

Machine will then restart, sysprep itself and join the domain

Next time the machine starts up on the domain it will find it's already been done and not re-run the process

 

I'd really, really want to test this carefully :-)

 

Not sure when the domain was first set up but although MS have always said that you must have unique SIDs in a domain, I think it was only really Active Directory that made it essential (and possibly not even until Server 2003). Certainly, back in the NT days, it didn't seem to matter.

[MkII]

Thankyou for those replies.

 

The machines aren't on a domain yet.

[Tamarside]

I agree with you, Steve - this one will take some careful planning and LOADS of testing.

 

Given that it isn't currently an AD domain (Wow! No AD in 2009!!!) we can ignore existing SID's.

 

Your suggested structure (copied below) makes a lot of sense, so I thought perhaps we could all collaborate on a solution to overcome this issue.

 

Have I already been sysprepped (check for flag file or registry entry) - yes, quit

Copy sysprep folder from server and edit line with computer name to match "my name"

Run sysprep and force reboot at end

Machine will then restart, sysprep itself and join the domain

Next time the machine starts up on the domain it will find it's already been done and not re-run the process

 

It'd have to be done in VBScript, thus giving access to all the WMI calls.

 

Who's up for it?

[Michael]

If the machines aren't on the domain, then Sysprep is definitely what you need. Simply extract the files from the Windows CD from the \Support\Tools\Deploy.cab file to C:\Sysprep

 

Within C:\Sysprep I use/created Sysprep.inf using Setupmgr.exe

 

;SetupMgrTag
[GuiUnattended]
   AdminPassword="password" (for example)
   EncryptedAdminPassword=NO
   OEMSkipRegional=1
   TimeZone=85

[userData]
   ProductID=XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
   FullName="Logistix Computer Solutions"
   OrgName="Logistix Computer Solutions"

[TapiLocation]
   CountryCode=44
   Dialing=Tone
   AreaCode=0121

[RegionalSettings]
   LanguageGroup=1
   Language=00000809

[identification]
   JoinDomain=DOMAIN_NAME
   DomainAdmin=administrator (for example)
   DomainAdminPassword=password (for example)

[Networking]
   InstallDefaultComponents=Yes

[unattended]
   TargetPath=\WINDOWS

[branding]
   BrandIEUsingUnattended=Yes

[Proxy]
   Proxy_Enable=0
   Use_Same_Proxy=0

 

This 99% automates the Sysprep procedure and joins the domain. I just manually specify the computer name and that's it. The only thing left of course is to move the Computer Objects in Active Directory to the relevant OUs so machines pick up domain policies.

[MkII]

That's nice Michael. Tho' I wouldn't fancy manually entering 5000 computer names

[Tamarside]

Matk, I'm in the middel of a CMIS upgrade (Yay!! Lucky old me!)

 

Once done, I'll post a VBScript that'd take the local PC name and write it into Michael's answer file.

 

What would still be needed is a method to a) check if the machine's been Sysprepped and joined to the domain and b) something (like a start-up script) to kick it all off.

 

Once you have all that, you can go and test and report back, and once finetuning's completed you should have an automated solution, and the beer's will be on you! :-D

[Michael]

That's nice Michael. Tho' I wouldn't fancy manually entering 5000 computer names

 

The only reason I manually specify a computer name is so I can put machines in numerical order (like in an ICT Suite). If it doesn't matter, you can specify a list of computer names and Sysprep automatically uses the next available name. Only problem with this, is Workstation14 could be positioned next to Workstation25 (for example).

[Tamarside]

Michael, you've done a lot already simply by posting the answer file.

 

I'm working on the assumtion that they'd want to keep all 5 000 PC's named exactly as they are, so I'm building a simple script to find the localhost name, then write that into the answer file, prior to Sysprepping.

[Michael]

I'm working on the assumtion that they'd want to keep all 5 000 PC's named exactly as they are, so I'm building a simple script to find the localhost name, then write that into the answer file, prior to Sysprepping.

 

Yes that would work, but I thought the 5000 machines were imaged from the same image, so theoretically they must all have the same name too? Just a thought... I can't see how the machines would have different names without using Sysprep?

[danrhodes]

Yes that would work, but I thought the 5000 machines were imaged from the same image, so theoretically they must all have the same name too? Just a thought... I can't see how the machines would have different names without using Sysprep?

 

Depending on how they ghosted the machines, I know the latest version of ghost can get a name say Computer and add a number to the end of each it ghosts so Computer1, Computer2, but this is only when using the console and im not even sure how it works, or even how reliable it is. Try using Ghost Walker instead of NewSid?

 

D

[Michael]

I suppose that is possible. Maybe Ghost allows you to specify "rules" for naming as you say.

[danrhodes]

You can run a logon script to change the comp name, all you have to do is change the script so that it puts a random jumble of say 5 numbers and letters at the end, but this takes away naming conventions that you may wish to have in place.

 

This script will re-name the pc to "computer1" then force a reboot of the computer.

 

On Error Resume Next

 

Const wbemFlagReturnImmediately = &h10

Const wbemFlagForwardOnly = &h20

 

strComputer = "."

strNewComputername = "computer1"

 

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")

Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem", "WQL", _

wbemFlagReturnImmediately + wbemFlagForwardOnly)

 

For Each objComputerSystem in colItems

objComputerSystem.Rename(strNewComputername)

Next

 

On Error Resume Next

 

Const wbemFlagReturnImmediately = &h10

Const wbemFlagForwardOnly = &h20

 

strComputer = "."

 

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")

Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_OperatingSystem", "WQL", _

wbemFlagReturnImmediately + wbemFlagForwardOnly)

 

For Each objOperatingSystem in colItems

objOperatingSystem.reboot()

Next

[MkII]

Sorry, I was busy today. The 5000 do have unique names. All equipment is allotted an asset number, which formed the PC name. Recently that changed to service tag for the PC's, but still, the current name must stay, so Steve's original idea was good - take the current name and name the PC that.

 

Sorry not to have added that earlier

 

(we currently run Netware (client 4.91 sp5))

[DrPerceptron]

If they are Dell systems, you can pull the Service Tag out of Win32_BaseBoard namespace (I think, I can pull the STag for my laptop out of it...)

 

Likewise, if you didn't mind visiting all the PC's, you can leave the computername part out of sysprep.inf and it will ask you to enter the name of the PC before carrying on it's way.

[MkII]

Yeah I need to use the existing name and no interaction.

[srochford]

OK; it's taken a bit of time but I've finally come up with a script which I think will work. I've written a blog posting to describe it - let me know if you think it will be of any use!

[tjb]

Great work Steve, I'd like to try this script out tomorrow however when I tried to download the zip file it appears to be corrupt. If you could please check it out that would be great.

[FN-GM]

not had time to read this properly, but i have a startup script that will do this doesn't take long to run either.

 

If your interested let me know

 

Z

 

If i have the script here, you don't need to rejoin the machines on the domain. I had the same problem when i started my old job.

 

net stop wuauserv

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f

net start wuauserv

wuauclt /resetauthorization /detectnow

Edited January 14, 2009 by FN-GM

[srochford]

Attachment seems OK here but I've uploaded it with this message. If that doesn't work, email me - [email protected] - and I'll send it to you directly.

sysprep.zip

[srochford]

not had time to read this properly, but i have a startup script that will do this doesn't take long to run either.

 

If i have the script here, you don't need to rejoin the machines on the domain. I had the same problem when i started my old job.

 

That's the wrong SID - that just deals with machines in Windows Update - not the ID that's used for security purposes (although if the machines have been cloned without that change making then it does make sense to do that)