:Resolve AD domain join failures for instances created from the same image

Problem description

Multiple ECS instances created from the same Windows Server image cannot access or join the same Active Directory (AD) domain.

Cause

ECS instances created from the same Windows Server image share the same security identifier (SID), which prevents them from joining the same AD domain. Modify the SID of each instance before setting up the domain environment.

Solutions

Create Windows instances with unique SIDs

Use the latest public image to create instances. The latest public images already have unique SIDs.

Create a custom image

1. Complete Steps 1 to 7 in the Modify the SID of a Windows instance section.

2. Execute the script:

   .\AutoSysprep.ps1 -PostAction "shutdown"

3. Create a custom image from this instance. See Create a custom image from an instance. You can then create instances from this custom image.

Modify the SID of a Windows instance

The built-in Windows sysprep command removes system-specific information, including the SID, from a Windows image. This section uses the PowerShell script AutoSysprep.ps1 to run sysprep and modify the SID. The sysprep command resets the user profile to default and deletes all desktop files. To auto-delete the script after execution, place it on the desktop before running sysprep.

Procedure

1. Create a snapshot of the system disk to prevent data loss.

   See Create a snapshot.

2. Connect to the ECS instance remotely.

   See Connect to a Windows instance using Workbench.

3. Open the system terminal and run the powershell command to enter PowerShell interactive mode.

   Note

   Run the powershell command as an administrator.

4. Switch to the root directory of the C drive.

   cd\

5. View the system SID:

   whoami /user

6. Download the AutoSysprep script tool and upload it to the C drive.

7. Go to the directory of the AutoSysprep.ps1 script and view its instructions:

   .\AutoSysprep.ps1 -help

8. Execute the script:

    .\AutoSysprep.ps1 -SkipRearm -Password "<$Password>" -PostAction "reboot"       //<$Password> is the password that you want to set.

9. Log on to the instance again and verify that the SID has changed:

   whoami /user

More information

Parameters

The AutoSysprep.ps1 script supports the following parameters:

• -SkipRearm: Keeps the current Windows license state. Without this parameter, AutoSysprep restores the original license state.

• -Password: Resets the instance password. Requirements:

  • 8 to 30 characters. Cannot start with a forward slash (/).

  • Must contain at least three of the following: uppercase letters, lowercase letters, digits, and special characters. Allowed special characters:

    ( ) ` ~ ! @ # $ % ^ & - _ + = | { } [ ] : ; ’ < > , . ? /

  • Default value for -Password: randomly generated by AutoSysprep.

  Note

  If you forget to set a password, reset it in the ECS console after modifying the SID.

• -Hostname: Resets the hostname. Limitations:

  • 2 to 15 characters. Cannot contain periods (.) or consist entirely of digits.

  • Can contain uppercase letters, lowercase letters, digits, and hyphens (-).

  • Cannot start or end with a period (.) or hyphen (-). Consecutive periods or hyphens are not allowed.

  • Default value for -Hostname: randomly generated by AutoSysprep.

• -PostAction: Action after the script completes. Valid values:

  • shutdown: (Default) Stops the instance after the SID is modified.

  • reboot: Restarts the instance after the SID is modified.

  • quit: Stays in the current session after the SID is modified.

• -help: Displays script description and parameter details.

Error when viewing script instructions on Windows Server 2008

Symptom

Run the following command:

.\AutoSysprep.ps1 -help

Solution

Grant the required permission:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

'Not digitally signed' error when running the script on Windows Server 2008

Symptom

Run the following command:

 .\AutoSysprep.ps1 -skiprearm -postaction "reboot"

Solution

Run the script with bypass execution policy:

powershell -executionpolicy bypass -file c:\AutoSysprep.ps1 -skiprearm -postaction "reboot"