How can I tell if two machine's HAVEN'T been sysprepped? 2

[PJamesD]

Hi,

two cloned machines, - is there an easy way to tell if both of thoses machines have not been sysprepped (and just merely had their hostnames changed).

thanks
P

MCSA (2003)

 

[Roadki11]

I think the easiest way to tell would be to look at the local(not Domain) administrators SID on each computer. If they were sysprepped they should have different SIDs, if they are the same you can probably bet they were cloned and the hostname was changed. You can see the local admin SID by using regedit and looking at the profilelist key, all local and domain accounts will be listed here by SID.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Window NT\CurrentVersion\ProfileList



RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[PJamesD]

Thanks very much for your help

The local administrator accounts have been renamed, but the they're showing up as "administrator" which is slightly weird.

But I think I've confirmed that they have been sysprepped - thanks



MCSA (2003)

 

[porkchopexpress]

For future ref NewSID will display the current SID and allow you to change it if both are the same.

http://technet.microsoft.com/en-us/sysinternals/bb897418.aspx

 

[PJamesD]

Cheers porky, good to know, appreciated.



MCSA (2003)