Month: October 2025

Posted on

Duplicate SID Issue Haunts Us Again

Mark Russovich wrote in 2009: duplicate SIDs do not matter for security: https://learn.microsoft.com/en-us/archive/blogs/markrussinovich/the-machine-sid-duplication-myth-and-why-sysprep-matters. Well, 16 years later, duplicate SIDs DO matter for security: https://support.microsoft.com/en-us/topic/kerberos-and-ntlm-authentication-failures-due-to-duplicate-sids-76f7394d-c460-4882-9ed1-d27e0960f949.

I recently started watching this guy’s streams on the Internet called Live Windows Training. It just so happened that a week before Microsoft posted this KB on the duplicate SID issue, this guy who has owned a computer repair shop for over 30 years figured it out. You can watch him articulate how he figured this out in this Youtube video: https://www.youtube.com/watch?v=jxBmUa_aKdo.

He used SIDCHG to fix the issue. Sure beats sysprepping or re-imaging all of the computers!

Googling “KB5065426 sid” brings up all kinds of posts on the issue.

-Soli Deo Gloria

Posted on

If At First You Don’t Succeed: Try 3 Different AIs

I was going back and forth with ChatGPT on creating a script that would launch procmon.exe silently via the task scheduler so I could monitor excel.exe when it saved any file ending in .csv, .xls or .xlsx. This went on for several hours, but I was not making any progress, even switching over to using Sysmon to see if I can have it do the logging I needed. Pro tip: if you have Sysmon running on a system, Procmon will be unable to load its driver and therefore will not work. You have to uninstall Sysmon first, then Procmon will work.

Procmon would start, I could see it in the task manager, but it wasn’t creating a PML file and I couldn’t terminate procmon with procmon.exe /terminate. I decided to go over to Gemini and chat back and forth with it and wasn’t making any progress there either. On a whim, I took the script that ChatGPT created and fed it into Grok.com. Grok starting churning away, checking the Internet for command line options and what did it find? ChatGPT hallucinated 2 of the command line options!

What was happening is that procmon was displaying an error, but since it was running under the SYSTEM account with /QUIET, there is no GUI to present to the user. Procmon was running in an errant state, but I couldn’t tell that. As soon as I removed the two invalid command line options, everything was right as rain.

The script ChatGPT created is too cool not to share, so here it is: https://github.com/adamleinss/PowerShellMisc/blob/master/procmon_task_scheduler.ps1. Along with this script, I uploaded the PMC file you can import into Procmon. The important bit is to make sure “Drop filter events” is checked under Filter so the PML file doesn’t increase in size unnecessarily.

-Soli Deo Gloria