Sysprep does not remove SUSClientID

[Kuval]

I have only just recently had this problem with my clients not showing up in WSUS. I found that the latest clients I have pushed out using Ghost all have the same SUSClientID so only one will show at a time in WSUS.

MS Article 903262 states this will only happen on images that are not Sysprep'd. Well I have always used Sysprep and all my clients have reported fine until just recently this year.

I know how to fix the problem but can anyone tell me why it is happening all of a sudden? I really hate to add more to the imaging process if Sysprep is suppose to do the trick.

Thanks in advance for the help.

[Mr Frances]

We have also noticed it with are recently created images. I think it may have started when the new Windows Update Client was released.

What we did recently was stopped the Auto Update Services and manually deleted the reg key before running SysPrep.

[HELLIAN]

It's not just using Sysprep, but using the proper parameters. You also need to use the -reseal parameter (or equivalent) to ensure that the mini-setup will initialize new GUIDs when a new machine is cloned.

Without that particular step, the SusClientID will simply be cloned from the master image, resulting in your duplicates.

[Kuval]

Proper parameters are set so new GUIDS are created. That's the main reason for sysprep. Like I said I've been using sysprep for years and WSUS since it came out and have never had this problem. I was thinking the same thing as Shankomatic because I've noticed other strange things since MS has been patching the WU clients. It's possible because we know MS can break one thing while patching another. It would just be nice to find the answer or that is is going to get fixed so I don't have to reset the SUSClientID my own way.

[HELLIAN]

If it's any consolation, this whole thing with the SusClientID is totally fixed in WSUS 3.0, by eliminating the use of a GUID to identify client computers.

However, in keeping with the fix-one-thing-break-another, WSUS 3.0 is now dependent on unique machine names. While this is not an issue for normal network environments, we've heard of a couple where they intentionally have duplicate computer names in a non-domain environment, and that's definitely causing problems on the WSUS 3.0 server.

[Mr Frances]

This might explain the problem....

In the past when we ran SYSPREP and resealed, it generated a new GUID. The machine still has a new GUID, but the SUS Client ID is being kept. It appears WSUS tracks on the SUS Client ID now and not the GUID. These machines are being SYSPREPed the same as in the past, but the machines SUSClientID are remaining intact and causing duplicates.

While it is possible the duplicate SID problem is solved, the problem is moved the the SUSClientID, which SYSPREP is not clearing.

[KEATON!]

I can confirm that if the WSUS 3 clients not correctly imaged then only one client shows up in the console until the SUSClientID is deleted. Renaming the PC does not fix this. I have just had 280 PCs delivered all with the same name and GUIDs. Renaming the PC and joining the domain does not reset the SUSClientID and I implemented Torgeir's script to do this at startup.

Before you ask this is a new job and the PCs were ordered before I started. It seems the junior tech "helped out" buy installing the image on a new PC, running mini-setup and then delivering it for cloning.

[Mr Frances]

Even if it the machine were imaged the proper way with SYSPREP, with a new Name and SID, the WSUS Client ID is not being stripped and the problem exists.

[KEATON!]

Yes, quite possibly. I was referring to Lawrence's claim that the client is identified by name. It seems it is identified by the SUSClientID not just the name. I believe that this change was a response to having lots of computers with the same name but different SUSClientIDs. In this case the name would appear in the console twice. Now this is fixed and the old name is removed. i.e. if there are two SUSClientIDs with the same name the older one is deleted. But if there are two names with one SUSClientID the last PC to report is the one listed.