The Microsoft policy concerning disk duplication of Windows XP installations

This article briefly describes methods that Windows XP supports for cloning or for duplicating a Windows XP installation.

Microsoft supports several methods for proper deployment of the Windows XP operating system. It is recommended that you use a supported method to avoid compromising security.

Computers that run the Windows XP operating system use a security ID (SID) as a unique identifier. If you use disk-duplication software, you must ensure the uniqueness of these security IDs.

When Windows XP is installed, a machine SID is configured to contain a statistically unique 96-bit number. The machine SID prefixes the SIDs of user accounts and group accounts that are created on the computer. The machine SID is concatenated with the relative ID (RID) of the account to create the account's unique identifier.

The following example displays the SIDs for four local user accounts. Note that only the last four digits are incremented as new accounts are added. Cloning or duplicating an installation without taking the recommended steps can lead to duplicate SIDs. In the case of removable media, a duplicate SID might give an account access to files even though NTFS permissions for the account specifically deny access to those files. Because the SID identifies both the computer or domain and the user, unique SIDs are essential to maintain support for current and future programs.

Microsoft policy statement

Microsoft does not provide support for computers on which Windows XP is installed by duplication of fully installed copies of Windows XP. Microsoft does support computers on which Windows XP is installed by use of disk-duplication software and the System Preparation tool (Sysprep.exe).

Microsoft supports the following Microsoft operating systems if they are imaged by use of the Sysprep.exe utility:

• Windows NT Workstation 4.0
• Windows NT Server 4.0 (stand-alone server, not primary domain controllers or backup domain controllers)
• Windows 2000 Professional
• Windows 2000 Server (must be imaged before you run DCPromo)
• Windows 2000 Advanced Server
• Windows XP Home Edition
• Windows XP Professional
• Windows Server 2003, Standard Edition
• Windows Server 2003, Datacenter Edition
• Windows Server 2003, Enterprise Edition
• Windows Server 2003, Web Edition

Microsoft does not provide support for computers that are set up by use of SID-duplicating tools other than the System Preparation tool. If an image was created without the use of sysprep, Microsoft does not support the running of Sysprep after the image is deployed as a way to bring the computer back into compliance.

You can find more information about the Sysprep utility, along with the utility itself, in the CD:\Support\Tools\Deploy.cab folder on the Windows XP CD-ROM. For more information about ensuring the uniqueness of SIDs and supported methods for cloning or duplicating a Windows installation, click the following article number to view the article in the Microsoft Knowledge Base:

The following are examples of unsupported third-party tools that you can use to change SIDs:

• NewSID http://technet.microsoft.com/en-us/sysinternals/bb897418.aspx (http://technet.microsoft.com/en-us/sysinternals/bb897418.aspx)
• GhostWalker http://service1.symantec.com/SUPPORT/ghost.nsf/docid/1999050308324125 (http://service1.symantec.com/SUPPORT/ghost.nsf/docid/1999050308324125)

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

The Microsoft Knowledge Base provides a variety of articles that outline specifications and how-to information for the proper deployment of the Windows operating system.