Sysprep/Ghost Walker/SID

[tazsk8s]

Can someone tell me what the adverse implications might be for using Ghost Walker to change the SID on our machines instead of Sysprep? I have seen all the recommendations to use sysprep, but why? Are we setting ourselves up for dire consequences if we don't? We've tried both, I frankly haven't seen any difference, but when I mentioned Ghost Walker to someone else they reacted as if the sky was going to fall if we continued to use it. What am I missing?

Should add some base info on our system, approx. 400 W2k workstations, Novell servers, no Windows domain at all.

Thanks for any/all info.

 

[DanMc]

I prefer ghostwalker. The new one from Ghost 7.5.

Sysprep has a fixed list of "important places" where the SID is stored. It goes there and changes them.

Ghostwalker scans the whole registry and FINDS anyplace that the SID is stored and changes it. This is more thorough, because you might have an application that used the SID for it's own purpouses when it was installed. (The same way a lot of apps make use of the computername when they are installed)

Sysprep changes is the places that Microsoft knows the SID is used for Windows and Windows networking purposes. If you search the registry of a sysprep'd clone, you will find the OLD SID still stored in a few places.

There are some limitations of ghostwalker. First, it is not supported by Microsoft. (Microsoft designed sysprep to automatically enforce licensing, ghost just cares about functionality and leaves licensing issues up to you) But if you have Ghost, Symantec will support you on cloning issues anyway. Ghostwalker is doing a low-level search and replace of the SID, so the new SID needs to be the same number of characters as the old SID. (big deal, right?) Another possible problem is that someday, Microsoft might change NTFS or the way the SID is stored and Symantec will have to update ghostwalker.

http://www.sysinternals.com

has a free utility (With Source!) called "newsid" that is similar to sysprep and ghostwalker.