SID of VM displayed in Active Directory after deploying VM from template

[java_cat33]

I've seen this quite a few times now, where I deploy a VM from template, sysprep does its thing via VirtualCenter and the server is joined to the domain with a unique SID. However when you browse AD, not only do you see the correct object, but you also see it's SID (well that's what I think it is).

See the attached object

Anyone seen this before?

VC 2.5 U1

[Dave_Mishchenko]

There might be something helpful on this thread - http://communities.vmware.com/thread/144347.

[java_cat33]

Thanks Dave - pitty the thread hasn't been answered. It might pay for me to log a call and see what VMware has to say.

[kjb007]

You've actually got two computer objects below. It appears the computer originally connected and created an account with the 2nd object, and then re-registered with a new SID with the current object. This is telling me that the 2nd computer object did not get properly updated, or deleted, and needs to be removed.

-KjB

[java_cat33]

Yes that is what I have been doing up until now - haven't had any issues. Have you had this problem? I've only had it on the development domain.

[kjb007]

Not that there's an issue, per se. Are you manually creating an object first? Or are both accounts visible after a template deployment only? Does this happen for template deployment, and is the object that has a SID with it the same SID every time?

I've actually seen this type of issue in the physical world when I've had a server joined to a domain. Then reimage, and rejoin the domain. Obviously, now there's two ad objects with different SIDs. I've also seen this when there are multiple domain controllers, and ad is out of sync, or replication is slow, so you may want to check that too.

-KjB

[java_cat33]

No I don't manually create the computer object first - both accounts are only visisble somtimes after a template deployment..... it's not consistent. The SID is different everytime. I've checked the replication logs and they seem OK too. We only have two DC's in this domain - and it's the only domain in the forrest. I'll run some AD checks against the DC's and see what is reported.

[java_cat33]

Unresolved

[JayStone]

I have noticed this same thing after creating a VM that was joined to the domain, cloning it to a template, and then continuing to run the original VM. After creating new VM from that template, when it first comes up it thinks it is still the machine that the template was created from and some sort of name collision occurs. To avoid this, I've adopted the practice making sure that a VM is in a workgroup before cloning it to a template. I suppose that converting a VM to a template instead of cloning it to one would also work.