While there have been compelling posts on why NewSID is not needed, Microsoft still recommends to not image in such a way that you end up with identical Security Identifiers (SID). I prefer to trust Microsoft with this. What is a bit jarring, is that some management software works off of SIDs and will require for you to have unique SIDs. What I never found was a list of what NewSID fails to work with and what it will fudge up. Here’s some findings that may help when deciding to use this in your environment.
Here are some facts I’ve encountered while testing on Windows XP (Though most can likely be extrapolated to Vista and 7).
- Say goodbye to encrypted files, they will not be adjusted to the new SID.
- The tool requires administrative rights.
- Terminating the newSID during operation will likely lead to an unstable system. This might be a problem because:
- NewSID takes several minutes to run! Any power loss or unwanted user intervention should be taken into consideration. For a 2.4 Ghz Dell /w 512mb ram it took over 5 minutes to complete with a Fresh XP install containing email client software, Office 2003 and 2007, Wordperfect and a couple other programs. Keep in mind, this would take considerably longer on a system with its HDD filled up to the brim or with many more individual programs. Larger file space usage and registry equals longer NewSID run time.
- The tool will run on Windows XP x64 though it executes as a 32 bit program.
- “A backup of the computer is strongly recommended” as expressed by the creator.
- Remote Desktop Requests appeared to fail after running NewSID. I was able to recreate this behavior.
- System restore will function fine jumping accross restore points. However keep in mind that a user can revert to the old SID if they perform a restore before the change.
With that said I have seen problems with several programs posted on the internet:
master.dbo.syslogins. NewSID wasn’t written with SQL awareness so after using it to change the machine SID (which in turn changes the SID for each local group) you’re going to be left with the old group SIDs in SQL, new group SIDs in the OS, a SQL service that won’t start”