Was my PC or Server Cloned and SysPrepped?

To find out if a server was cloned check out this registry key (this is for Windows Server 2008 R2 but I would image would be the same or similar for most flavors of Windows):

HKEY_LOCAL_MACHINE\SYSTEM\Setup\CloneTag

CloneTag will actually tell you the date and time when SysPrep was run on it.


Now if you want to check the SID values (perhaps with the source to make sure they are in fact different) use the PsGetSid utility.  You can just run PsGetSid from a command prompt to get the SID from your local PC or use "\\" to get the SID of computers connected to your LAN.

The output would be similar to this from my two Citrix servers (and this tells me my SIDs are different):
--------------------------------------------------------------------------------------------------

C:\PSTools>psgetsid \\lan-citrix1

PsGetSid v1.44 - Translates SIDs to names and vice versa
Copyright (C) 1999-2008 Mark Russinovich
Sysinternals - www.sysinternals.com

SID for \\lan-citrix1:
S-1-5-21-2052776799-13871689-1737724133


C:\PSTools>psgetsid \\lan-citrix2

PsGetSid v1.44 - Translates SIDs to names and vice versa
Copyright (C) 1999-2008 Mark Russinovich
Sysinternals - www.sysinternals.com

SID for \\lan-citrix2:
S-1-5-21-3592252623-8394611391-4172714545



--------------------------------------------------------------------------------------------------



Now does any of this really matter?  Ask Mark Russinovich (or at least check out this blog entry of his:)

The Machine SID Duplication Myth (and Why Sysprep Matters) 

** On a side Note - if you do Clone Citrix servers and you use the Citrix Gateway, you need to edit the STA ID for each clone acting as a Secure Ticket Agent. **


This applies to Presentation Server or XenApp.  XenApp 6.x in my case.
To change the STA ID edit the CtxSta.config file.
This can be found here:  %ProgramFiles(x86)%\Citrix\system32\CtxSta.config
Open the file with Notepad.
Simply change the STA ID value with anything you like and save. I just tweaked one number.

For example - in the file:
GlobalConfig
UID=STAD8D1856594FF <= change this to something unique.