Home / server / Questions / 244801
Accepted
Shadow00Caster
Asked: 2011-03-09 09:49:45 +0800 CST

Change Exchange 2010/domain member server SID

  • 772

Background: 5 ESXi servers running in DRS, ~20TB storage. Loads of virtual servers including DC's/child DC's/member servs all 2K8 and Exchange 2010 servers.

Majority deployed from a template (not joined to domain), renamed and then joined to domain.

I'm pretty sure 90% of my machines have the same SID, at the very least I know my 3 Exchange 2010 servers have same SID (1 CAS/HUB, 2 MBX in DAG).

I know I can change the SID of my machines using NewSID, my question is can I do this to a machine already joined to the domain, let alone an Exchange 2010 server.

Any insight is helpful, thanks!

windows-server-2008 exchange-2010

4 Answers

  1. Exchange servers are very sensitive to domain membership and computer name, so I'd guess they are very sensitive to their SIDs, too; anyway, changing a machine's SID effectively breaks its trust relationship with the domain, so it will require to be de-joined and re-joined; and that's definitely something that you don't want to do to an Exchange server.

    If you are really serious about this, then creating new servers (with new SIDs...), moving roles to them and removing the old ones would be your best approach here. Anything else might work, but it's practically guaranteed to get you into lots and lots of troubles.

    • 4

  2. Sysprep does alot more than just changing the SID. You should not deploy a non-syspreped image. Once domain joined I'm not sure what the behavior is if the sid changes. If you have already deployed a non-syspreped image I would urge you to come up with a rebuild plan.

    • 2
  3. Best Answer

    Are you seeing any specific issues from this situation?

    I'd recommend using sysprep in your procedure of deploying from a template, the "Customization Specifications" of the template deploy wizard will do this for you.

    That said, duplicate machine SIDs alone shouldn't break anything; the domain RIDs of the computers are already different from each other because they were independently joined to the domain. See this article for too much information.

    • 1

  4. If you are referring to the issue described to here:

    http://msexchangeteam.com/archive/2010/09/01/456094.aspx

    My opinion if something goes wrong and you need to engage Microsoft for support, you probably should not be using tools that are not supported. NewSID was retired a while back, that is not something I would run on a server that is already in production. I would agree with Massimo, turn up fresh servers and move resources to them, then after you have the old servers unplugged from the network for a while you can decommission them.

    • 0