Machines loosing their SID

[JohnConnolly]

I have a constant problem with WinNT workstations loosing their SID. Does anyone know why this happens? How to stop it happening?

The only way I know to recover from this is to switch the machine from our domain to a non-existent workgroup and then switch it back to our domain. Then the user gets upset when most of his/her desktop vanishes along with mapped network disks etc. Anyone know a better way to get the SID back?

John Connolly

 

[darranagl]

Did you create the workstations with Ghost?

If you did the will all have the same SID which causes a sh*t load of problems.

Try running NEWSID off the off the NT CD (I can't find my NT CD to check the name and directory )c New Zealand, a great place to visit.

http://www.southland.org.nz

 

[JohnConnolly]

No, I didn't use Ghost - the workstations were installed from their CD's.

I can't find "newsid" on the WinNT CD (or was that a joke? - sorry if I'm being thick...).

 

[darranagl]

Sorry I thought it was on the CD (like I said I can't find my CD to check it) but you can download it from

http://www.sysinternals.com/ntw2k/source/newsid.shtml

Hope it helps
New Zealand, a great place to visit.

http://www.southland.org.nz

 

[JohnConnolly]

I just got a copy of NewSID. Haven't tried it yet but I'm a bit alarmed after reading the instructions. There's a comment that says the registry will grow in size when NewSID is run so I'm worried about what will happen if a machine looses its SID several times.

 

[darranagl]

Hopefully the 'NEWSID' will fix the problem and you won't have to use it again, in the perfect world anyway. New Zealand, a great place to visit.

http://www.southland.org.nz

 

[Highland]

Have you checked the PDC, BDC for any errors....???? How often does this fault occur...??? Does it affect all your workstations...??? What error do you get on a failing workstation....???

 

[JohnConnolly]

Sorry for my ignorance but what's a "PDC, BDC"? All my systems are in Spanish so I have to try to translate back into English.

I'm not sure how frequently we have the problem but probably at least once a month over 25 machines. Only some workstations seem to have this problem but they are all running the same OS (WinNT SP6a).

When rebooting a workstation with the problem we get a message "Couldn't connect to domain server" (rough translation!). On the domain server we get hundreds of NETLOGON error messages in the Event Log (another rough translation). The message detail is:

"The machine SNEEZY tried to connect to the server SUSHI using the relationship of established trust for the domain CARTOONP. However the machine lost the security identifier (SID) when it configured the domain again. Establish the relationship of trust again." (another lousy translation...).

Once the macine has rebooted it can access the server shares with no problems.

 

[Highland]

Sorry....!!!

Ok the PDC is your Primary Domain Controller, the BDC (u may or may not have one..!!!) is a Backup Domain Controller.....

Can you tell us the Event ID Error Code Number...???

 

[JohnConnolly]

Oh right. The Event ID is 5513

 

[JohnConnolly]

I just tried running NewSID - it doesn't fix the problem - still get an "unable to connect to server" message.

 

[Highland]

According to eventid.net the method u are using to re-register the Workstations (changing to workgroup then domain) is the way to resolve this issue.....

I agree with yourself though, there must be an underlying reason why this is happening.....???? We recently had an issue on our network where no servers/machines were able to see the Domain Controller and received a similar message, however once the fault had been sorted they were able to re-establish their trust relationships without any need to recreate the domain accounts...

It must be something on the actual domain controller which is corrupting the database....????

Is it the same workstations which are failing or is it random.....????

Do you know if you have both PDC's and BDC's on your network....???

Here's a couple of links which explain the problem....

http://www.eventid.net/display.asp?eventid=5513&source=

This link mentions a couple of utilities used to resolve the issue...I haven't heard of them before, so I'm just about to go and see what they do....!!!!

http://www.thethin.net/archive3.cfm?id=47658

 

[JohnConnolly]

I've looked at the links. Is the "resource kit" something that has to be puchased separately? (can't see any sign of it on the WinNT Server CD's).

 

[Highland]

The resource kit is a seperate product from Microsoft....!!!

Just been looking at a problem this morning and it was to do with the registry on a server....we used a utility called pagedefrag which analyses and "defragments" the pagefile and registry hives on your servers.....it might be worth a try....????!!!

Have you had any more problems recently....???

 

[Highland]

Here's the link for pagedefrag...

http://www.sysinternals.com/ntw2k/freeware/pagedefrag.shtml

Time for some lunch....!!!