This common
prefix is the machine SID, and it’s randomly generated when Windows is installed. Because it’s
generated randomly, each machine should have a unique one.
The claim you quoted is partially right, but it’s missing an important detail — Windows tries to give each machine a unique machine SID, but there’s no absolute guarantee of global uniqueness.
How it works
- When you install Windows (or run
sysprepto generalize it), the OS generates a random 96-bit value for the machine SID. - This machine SID becomes the prefix for all local user and group SIDs on that system.
- The randomness comes from a cryptographically secure pseudo-random number generator seeded with various entropy sources (hardware IDs, clock, etc.).
Uniqueness expectation
- Probability of collision is extremely low (think UUID-like rarity).
- Microsoft does not maintain a global registry of SIDs — uniqueness is statistical, not enforced.
- The only common cause of duplicate machine SIDs is cloning a Windows image without running
sysprep.- In that case, the clone inherits the SID, causing SID conflicts in Active Directory or certain security scenarios.
Why it’s “unique enough”
- 96 bits of random space means there are 7.9 × 10²⁸ possible SIDs.
- Even if every computer in the world generated a SID every second for the age of the universe, the odds of a collision are practically zero.
- That’s why Microsoft considers the SID “unique” for practical purposes.
But… Mark Russinovich’s finding
- In 2009, Mark Russinovich (Sysinternals) famously explained that duplicate machine SIDs don’t actually break most things in modern Windows, except in certain domain and security software contexts.
- Still, Microsoft’s best practice: always run
sysprepbefore deploying cloned Windows images to ensure a fresh SID.
Prepare the reference machine
Install Windows normally on a reference system (physical or VM).
Install updates, drivers, and base software that you want to include in all deployed systems.
Don’t join it to a domain yet (join after deployment).
Configure system settings as desired.
2️⃣ Clean up and check
Remove temporary files, caches, and sensitive data.
Ensure no user data is left on the system.
Optional: Run disk cleanup or dism /Online /Cleanup-Image /StartComponentCleanup.
Run Sysprep (Generalize)
Open an elevated Command Prompt (Run as Administrator).
Navigate to the Sysprep folder:
cmd
Copy
Edit
cd %WINDIR%\System32\Sysprep
Run:
cmd
Copy
Edit
sysprep /generalize /oobe /shutdown
/generalize → Removes machine-specific info (including SID, event logs, unique IDs).
/oobe → Boots next time into “Out-Of-Box Experience” so end-users can set username, time zone, etc.
/shutdown → Turns off the machine when done, ready for imaging.
Important:
Once /generalize is run, the next boot will generate a new machine SID and other unique IDs.
You can only generalize a given Windows installation a limited number of times (usually 8).
4️⃣ Capture the image
After Sysprep shuts down the system, don’t boot it normally (booting will regenerate the SID and break your clean image).
Instead, boot into:
Windows PE (from installation media)
Imaging tool (e.g., DISM, MDT, Clonezilla, Acronis, Macrium Reflect)
Capture the disk to a .wim, .iso, or image file.
5️⃣ Deploy to target machines
Apply the captured image to new systems.
On first boot, Windows runs OOBE and creates a fresh SID per machine.
Then join to domain or apply post-deployment scripts.
In step 4, after Sysprep has shut the system down, you have two main imaging paths:
Option A – Create a .wim file (Microsoft-native format)
.wim is the Windows Imaging Format — used by Windows Setup, MDT, and WDS.
You can make it from Windows PE with DISM.
Steps:
Boot into Windows PE
You can use a USB made with Windows ADK or Windows installation media.
At the first Windows Setup screen, press Shift + F10 to open Command Prompt.
Find your system drive
cmd
Copy
Edit
diskpart
list vol
exit
Usually your Windows partition is C: in the live system, but in WinPE it may be D:.
Capture the image
cmd
Copy
Edit
dism /Capture-Image /ImageFile:D:\install.wim /CaptureDir:C:\ /Name:”Sysprepped Windows”
/ImageFile: → Destination for .wim (save to another drive, like a USB drive D:).
/CaptureDir: → Partition containing Windows (C:\ in WinPE might be D:\ in your case).
/Name: → Friendly name for the image.
Verify
cmd
Copy
Edit
dism /Get-WimInfo /WimFile:D:\install.wim
Option C – Use 3rd-party disk imagers
If you don’t care about .wim and just want a cloneable image for labs:
Macrium Reflect Free (save as .mrimg → restore to new VM/PC)
Acronis True Image
Clonezilla (good for Linux/Windows labs)
Veeam Agent for Windows Free
These can save sector-by-sector images as .img, .iso, or proprietary formats.