→ The Lansweeper Customer Excellence Awards 2024 - Submit Your Project Now! Learn More & Enter Here

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
DGoodwin
Engaged Sweeper
Add WMI scanning of duplicate Machine SID's and a report to show them.

I am sure there are a lot of people cloning images and this would help to eliminate the errors of security identifiers. Even though we here are in a domain that assigns a domain SID, the local machine SID could still be the same. We are using a sid changing utility to make sure this is not an issue just in case.

"When Windows XP is installed, a machine SID is configured to contain a statistically unique 96-bit number. The machine SID prefixes the SIDs of user accounts and group accounts that are created on the computer. The machine SID is concatenated with the relative ID (RID) of the account to create the account's unique identifier."


It would be really helpful to find the sid's and verify that the are not the same.

Microsoft write up: http://technet.microsoft.com/en-us/sysinternals/bb897418.aspx
8 REPLIES 8
Hemoco
Lansweeper Alumni
I've already read the article some days ago.
While Mark Russinovich is probably one of the best known technical Microsoft guru's I think he is wrong with this.
Windows might nog have a problem with the duplicate SID but a lot of third party applications use the sid in one way or another.

I remember from some years ago that SMS 2.0 client simply didn't work with duplicate sids.
DGoodwin
Engaged Sweeper
Interesting follow up, SID's are no longer going to need to be changed. NewSID will not run on Win7 and has been retired. It also breaks the local Admin accounts. The following explains it a little better than I can: SID Myth
We are looking at the possibility of not changing them anymore.

ps. Ghost Walker will work. (ghstwalk)
Hemoco
Lansweeper Alumni
I see that you can already create a report to find duplicate sids.
The -500 account at the end means that this is the local administrator account.

Select Top 100 Percent tblUsers.SID, Count(tblUsers.UserID) As Total
From dbo.tblComputers Inner Join
tblUsers On dbo.tblComputers.Computername = tblUsers.Computername
Group By tblUsers.SID
Having tblUsers.SID Like '%-500'


You can create reports based on this.
DGoodwin
Engaged Sweeper
Found this which does work and have tested it on multiple machines (using newsid as a backup check)

Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Set colAccounts = objWMIService.ExecQuery _
("Select * From Win32_UserAccount Where LocalAccount=True")

Result = ""
For Each objAccount in colAccounts
If Left (objAccount.SID, 6) = "S-1-5-" and Right(objAccount.SID, 4) = "-500" Then
CompSID=Left (objAccount.SID,len(objAccount.SID)-4)
Result = CompSID
End If
Next
MsgBox "SID is: " & Result


I found it Here

Modify it as you see fit.
DGoodwin
Engaged Sweeper
A computer's SID is stored in the Registry's SECURITY hive under SECURITY\SAM\Domains\Account. This key has a value named F and a value named V. The V value is a binary value that has the computer SID embedded within it at the end of its data.

As far as i can tell, you have to grant rights to the admins to access this registry key. If not, the only the "system" account has access to it.

example:
"V"=hex:00,00,00,00,e0,00,00,00,02,00,01,00,e0,00,00,00,18,00,00,00,00,00,00,\
00,f8,00,00,00,00,00,00,00,00,00,00,00,f8,00,00,00,00,00,00,00,00,00,00,00,\
01,00,14,80,c0,00,00,00,d0,00,00,00,14,00,00,00,44,00,00,00,02,00,30,00,02,\
00,00,00,02,c0,14,00,7a,04,05,01,01,01,00,00,00,00,00,01,00,00,00,00,02,c0,\
14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,00,7c,00,05,00,00,\
00,00,00,14,00,85,03,02,00,01,01,00,00,00,00,00,01,00,00,00,00,00,00,18,00,\
85,03,02,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,00,00,18,00,df,\
07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,00,18,00,d5,03,\
02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,00,00,18,00,d5,03,02,\
00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,\
04,00,00,00,00,00,05,15,00,00,00,21,58,8a,12,2c,2b,74,58,27,30,c9,dc

the SID I'm searching in this now is:
S-1-5-21-311056417-1484008236-3704172583
Hemoco
Lansweeper Alumni
Lansweeper uses only WMI and registry to get it's information
Anonymous
Not applicable
Maybe using the same API as for any account? I've tested here for my hostname account and I could read it right using LookupAccountName function from AdvAPI32.dll
Hemoco
Lansweeper Alumni
Any idea to get the computer sid out of the registry?