I'm questioning my sanity here. Has anyone else ha...
# microsoft-os
m
I'm questioning my sanity here. Has anyone else had trouble with Server 2025 RD License Server and Server 2025 CALs? I'm attempting to stand up a WS2025 RD license server and cannot get it to issue licenses to RDSH's. I thought maybe my network security policies and apps were getting in the way, but I encounter the same issue on a fresh license server build with no policies or apps. The health checker on the license server comes back clean and there are Server 2025 CALs installed. The 2025 RDSH reports connectivity is available to the license server and the correct license model is set. The same 2025 license servers are not issuing CALs to a test 2022 RDSH that was previously working with a WS2022 license server.
License servers were made from a template. I'm beginning to think there are dup SIDs
ding ding ding. The template wasn't sealed properly and had a duplicate SID with another machine.
o
yeah was about ready to say that as we had similar where customer didn't do sysprep properly for cloning and didn't do 'generalization' and another role was having issues due to it. All of this due to the hardening stuff now.
👍 1
m
I'm on the lookout for event id 6167 in my environment now. The systems guys in my org don't sysprep gold images and this won't be the last time this comes up for me. Also the reason why I always ask them to give me a blank VM with an ISO in it when building Citrix images (this stuff isn't automated yet).
s
I posted about Windows 2025 VMs that were cloned without sysprep a while back. This is going to catch a lot of people off-guard, and I'm worried MS might release an update for earlier Server versions which could break a lot of environments.
👍 1
c
Sorry to bring this back, but had our 1st W25 VDA registration to DDC W25 attempt ran into this; the W25 VDA could not register against the W25 DDC. DDC reports event id 6167, nothing on the VDA shows an error (outside it can not register). Customer said they 'cloned' the VMs from a VMware template, as per their normal routine. I assume that the target machine (DDC) is the one having the stink. Is the registry key the only option, unless they attempt to build a 2nd DDC on W25 (Hardening administrative actions: What IT pros need to know - Windows IT Pro Blog) ? Is this a valid check for duplicate computer SIDS Use Ntdsutil to find and clean up - Windows Server | Microsoft Learn. How would we validate the new DDC 2 is good prior to installing the DDC software on it.
m
Rebuild the 2025 servers with a generalized install of Windows is what I would do. They are going to need to change their template process is what it comes down to. https://support.microsoft.com/en-us/topic/kerberos-and-ntlm-authentication-failures-due-to-duplicate-sids-76f7394d-c460-4882-9ed1-d27e0960f949
c
are we sysprepping w25 gold image machines now during the sealing process? I guess we have to in order to get past this.