NewSID has been retired

[cookie_monster]

Mark Russinovich has written an interesting blog about SID duplication and how after discussion with the Windows security and deployment teams no one could come up with a scenario where two systems with the same machine SID, whether in a Workgroup or a Domain, would cause an issue. It's an interesting read.

 

Mark's Blog : The Machine SID Duplication Myth

[CHR1S]

I just skimmed the article so apologies if its been covered but I have had WSUS go mental because of duplicate SIDs and im sure something else did too but I cant remember.

[cookie_monster]

I just skimmed the article so apologies if its been covered but I have had WSUS go mental because of duplicate SIDs and im sure something else did too but I cant remember.

 

 

WSUS is affected by the WSUS ID in the registry not the system SID I've had the same problem.

 

http://msmvps.com/blogs/athif/pages/66376.aspx

 

I don't think I'll stop syspreping clients anyway it's just interesting from a security perspective and it's straight from the MS security team.

Edited November 6, 2009 by cookie_monster

[ajbritton]

It's worth reading through the comments. Several people make the point that although Windows may not rely on having unique machine SIDs, there is other software that does.

[p858snake]

Mark Russinovich has written an interesting blog about SID duplication and how after discussion with the Windows security and deployment teams no one could come up with a scenario where two systems with the same machine SID, whether in a Workgroup or a Domain, would cause an issue. It's an interesting read.

 

Mark's Blog : The Machine SID Duplication Myth

 

I can... Classroom of 30 or so computers, all imaged without sysprep/newsid.... Means you can all access each other admin shares and have fun with the shutdown command...

[MkII]

Thanks for the info and followups. I'm sure there are problems on our new domain with duplicate SIDs. Machines baulk straight away.

[mrbios]

Interesting stuff about the difference between domainSID and machineSIDs never knew any of that before now, quite a good read, certainly appears plausable that you shouldn't need to be i think it needs ALOT more testing than what the microsoft security team can do themselves in order to write it off as being a "pointless task"

[ajbritton]

I can... Classroom of 30 or so computers, all imaged without sysprep/newsid.... Means you can all access each other admin shares and have fun with the shutdown command...

 

Surely that's because you're either logged on as a Domain Admin (and therefore have local Admin rights on all Domain joined machines) or are using a local account which exists on all PCs and has the same password.

[p858snake]

Surely that's because you're either logged on as a Domain Admin (and therefore have local Admin rights on all Domain joined machines) or are using a local account which exists on all PCs and has the same password.

Nope SID magic, we were all using our own accounts and they were no where near domain admin accounts.

[cookie_monster]

It's worth reading through the comments. Several people make the point that although Windows may not rely on having unique machine SIDs, there is other software that does.

 

Absolutely, the article is refering to Windows security only I don't think you can rule out problems with third party software this is why I will continue to sysprep units.

 

 

I can... Classroom of 30 or so computers, all imaged without sysprep/newsid.... Means you can all access each other admin shares and have fun with the shutdown command...

 

 

Only if you logon as the local admin or know the local admin password on each station this is because they will have the same SID. If you logon as a domain user which all users will in a domain it has no affect on security.

[cookie_monster]

Nope SID magic, we were all using our own accounts and they were no where near domain admin accounts.

 

 

As all of the machines are identical each additional 'local' account created on each machine will have the same SID so Windows cannot tell them appart this means that identical local accounts will be able to access other clients (if they're admins). This does NOT affect domain accounts only local accounts, as your users shouldn't be logging on as local accounts it doesn't affect security. Also if the passwords are different on each client authentication to another client will fail.

[ajbritton]

As all of the machines are identical each additional 'local' account created on each machine will have the same SID so Windows cannot tell them appart this means that identical local accounts will be able to access other clients (if they're admins).

 

Not quite. Windows does not need to 'tell them apart' as such. A remote connection will be authenticated by username/password and as long as these match a local user account on the target PC then the connection will succeed. This is nothing to do with machine SIDs. The only time Windows would confuse two accounts based on matching machine SIDs would be in the instance where an ACL was created on a removable device and the device was connected to a second PC with the same machine SID. The second PC would see entries in the ACL as referring to local accounts rather than accounts on a different PC.

Edited November 9, 2009 by ajbritton

[cookie_monster]

Not quite. Windows does not need to 'tell them apart' as such. A remote connection will be authenticated by username/password and as long as these match a local user account on the target PC then the connection will succeed. This is nothing to do with machine SIDs. The only time Windows would confuse two accounts based on matching machine SIDs would be in the instance where an ACL was created on a removable device and the device was connected to a second PC with the same machine SID. The second PC would see entries in the ACL as referring to local accounts rather than accounts on a different PC.

 

 

A remote connection will not be authenticated by username and password it will be authenticated by "user account" SID and password, the username will be translated to a SID the username is for our benefit only (I correct myself that is only for domain accounts). As the user account SID and password will be identical on both machines Windows will not be able to differentiate. You are correct in what you say but the identical SIDs complicates the issue which is where the security problem arrises.

 

 

This highlights your point about file security nicely.

 

http://windowsitpro.com/article/articleid/14919/what-are-the-problems-with-workstations-having-the-same-sid.html

Edited November 9, 2009 by cookie_monster

[mac_shinobi]

A remote connection will not be authenticated by username and password it will be authenticated by "user account" SID and password, the username will be translated to a SID the username is for our benefit only. As the user account SID and password will be identical on both machines Windows will not be able to differentiate.

 

Not sure if I am being daft here but if you have

 

User A with SID 1234

User B with SID 5678

 

and 6 computers ( marked 1,2,3,4,5 and 6 ), Assuming Each user was allowed to do multiple logins at the same time and User A logged into computers 1,2 and 3

 

User A has the same password on each login and the same username ( same username SID ) then how would it be able to differentiate between computers 1, 2 and 3 ?

 

Same applies to User B reference explanation of User A

 

Because although the same user is logged into 3 machines ( User A on 1, 2 and 3 and User B on 4,5 and 6 ) if it is using the Usernames SID and the login accounts password then how would it know any different, for all it knows its on the same computer because the username SID and the user accounts password would always be the same ?

 

:confused:

 

Im either missing the point completely and a planes gone over my head or something ?

[cookie_monster]

Not sure if I am being daft here but if you have

 

User A with SID 1234

User B with SID 5678

 

and 6 computers ( marked 1,2,3,4,5 and 6 ), Assuming Each user was allowed to do multiple logins at the same time and User A logged into computers 1,2 and 3

 

User A has the same password on each login and the same username ( same username SID ) then how would it be able to differentiate between computers 1, 2 and 3 ?

 

Same applies to User B reference explanation of User A

 

Because although the same user is logged into 3 machines ( User A on 1, 2 and 3 and User B on 4,5 and 6 ) if it is using the Usernames SID and the login accounts password then how would it know any different, for all it knows its on the same computer because the username SID and the user accounts password would always be the same ?

 

:confused:

 

Im either missing the point completely and a planes gone over my head or something ?

 

 

 

It gets worse because you could have different usernames on each PC but with the same SID so as ajbritton says you then have no security

 

User A with SID 1234

User B with SID 1234

 

What are the problems with workstations having the same SID?

 

Understanding Shared Account Password Management

http://technet.microsoft.com/en-us/magazine/2008.09.passwords.aspx?pr=blog

Edited November 9, 2009 by cookie_monster

[ajbritton]

the username will be translated to a SID the username is for our benefit only.

 

NB - This process relates to local user accounts.

 

Indeed, but this process happens at the remote machine (by the file server process as Mark refers to it) that the connection is being made to, so when connecting from machine A to machine B...

 

Machine A sends an SMB request to machine B. This includes the username/password. It would be pointless sending a SID as only machine A would know anything about it.

 

Machine B authenticates the username/password either against the domain or the local user account database. At this point a 'logon session' is created on Machine B holding the access token that will be used to access the resource on Machine B. A UID pointer is returned to Machine A

 

Machine A stores the UID in the open SMB request for Machine B.

 

When a request to access a secured resource goes from Machine A to Machine B, the open SMB channel is used along with the UID that Machine B then uses to refer to the original logon session created during authentication.

 

The point is that the SID does not travel from source PC to destination PC. The only place the Machine A SID has any relevance is on the Machine A and the same applies for the Machine B SID.

 

(apologies for multiple edits but I'm just coming to terms with this stuff myself)

Edited November 9, 2009 by ajbritton
Added notes on 'logon session'

[ajbritton]

A new comment on Marks original article has appeared that explains what I've been trying to, but does a much better job.

 

Mark's Blog : The Machine SID Duplication Myth

 

Comment dated Saturday, November 14, 2009 5:08 PM by Steve Gray

[cookie_monster]

Yep i'd forgotten how the process works on a workgroup level. It's still not much of an issue if no one logs on as the local admin and everyone else logs on with a domain account. Good article though.