Your demand is NOT wipe data after sid change, so sysprep could not be the your choice.
How to fix duplicate SIDs on 80 Windows 11 clones. Need some guidance please!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 68%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EG%3C/text%3E%3C/svg%3E)
gogta
90
Reputation points
Hi folks,
Ran into a replication issue where ~80 Windows 11 enterprise machines were deployed via a master image clone without proper generalization. Result: identical SIDs across the block.
We need to remediate this without wiping user data or breaking domain trust if possible. Currently evaluating options:
- Official Sysprep: Standard path, but risk of losing customized application state and profile paths is a major constraint for us.
- Third-party alternatives: I’ve seen tools popping up in some discussions saying wittytool SID changer can change Windows SID without losing settings.
- Legacy tools (Newsid, etc.): Out of the question for modern Windows 11 architecture.
Does anyone have hands-on experience using similar utilities on live Windows 11 environments? Looking for feedback on stability, or if biting the bullet with Sysprep is our only realistic choice here.
Thanks.
Windows for business | Windows Client for IT Pros | Devices and deployment | Other
2 answers
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 71%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDD%3C/text%3E%3C/svg%3E)
da danniel 5 Reputation points2026-07-08T06:38:50.3333333+00:00 -
gogta 90 Reputation points
2026-07-14T03:22:13.0266667+00:00 you are right, so I've tested the third party tool, it worked.
Sign in to comment -
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 36%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EXN%3C/text%3E%3C/svg%3E)
Xuan Nhu 730 Reputation points Independent Advisor2026-07-07T10:09:21.75+00:00 Hi gogta, I would not recommend using any third-party SID changer on live Windows 11 machines; Microsoft’s supported method for duplicated Windows installations is to run Sysprep /generalize before capturing the image, and Microsoft explicitly states that it does not support computers set up by using SID-duplicating tools other than Sysprep. Also, be careful with the root cause: a duplicated local machine SID by itself is usually not the same as a duplicated AD computer account identity, so if you are seeing “replication” or domain trust issues, also check for cloned domain-join state, duplicate computer accounts, certificates, WSUS/SCCM client IDs, Intune/Entra device IDs, and secure-channel errors. For the 80 machines already deployed, Microsoft’s documentation is strict: if an image was created without Sysprep, running Sysprep after deployment is not supported as a way to bring that image back into compliance; the clean supported remediation is to rebuild or reimage from a properly generalized image, then restore user data and rejoin the domain. If you still pilot Sysprep on an existing device, understand the risk first: Sysprep can remove the PC from the domain, replace the computer SID only on the OS volume, and may affect installed apps, local profiles, encrypted files, and device-specific configuration. My practical recommendation is to validate one or two test machines, back up user data and BitLocker recovery keys, document application state, then either reimage with a supported Sysprep-generalized image or use a profile migration process rather than trying to “patch” the SID in place.