Ghost Solution Suite

 View Only

  • 1.  (GSS2.0)Domain Admin account got locked out after sysprep.

    Posted Jun 22, 2007 10:05 AM

    Hi

     

    We use a sysprep for ghost imaging, basically it let the computer leaves the domain and do a mini-setup then join back to our domain automatically. The reason we don’t use the one provided by GSS is we’ve had lot of trouble with it. We went to sysprep and let it do the “join domain” part for us.

     

    Recently we upgraded our GSS to V2. I don't know for what kind of reason, our sysprep.int got wiped out so I wrote a exactly same one as before and everything seems fine, but after couple of deployments, during the mini setup, computers could not join the domain by itself and we found the domain admin account(ghost console service account) which we use in sysprep.int got locked out. I thought it just a temporary error so we unlocked this account, but unfortunately, after another deployment, it happens again. and just let you know that all of our computers are the same model.

     

    Here is the sysprep I have.

     

    ;SetupMgrTag
    [Unattended]
       OemSkipEula=Yes
       InstallFilesPath=C:\sysprep\i386
       OemPnPDriversPath=drivers\

    [GuiUnattended]
       AdminPassword=loacladminpassword
       EncryptedAdminPassword = No
       OEMSkipRegional=1
       TimeZone=35
       OemSkipWelcome=1
       AutoLogon=Yes
       AutoLogonCount=1

    [UserData]
       ProductKey=something
       FullName="something"
       OrgName="something"
       ComputerName=*

    [Display]
       BitsPerPel=32
       Xresolution=1024
       YResolution=768

    [SetupMgr]
       DistFolder=C:\sysprep\i386
       DistShare=windist

    [Networking]
       InstallDefaultComponents=Yes

    [Identification]
       JoinDomain="domain name"
       DomainAdmin="ghost_something"
       DomainAdminPassword="Passwordhere"

     

    Any help?

     

    Thanks in advance.

     

    -Nelson

     



  • 2.  RE: (GSS2.0)Domain Admin account got locked out after sysprep.

    Posted Jun 24, 2007 10:01 PM

    Can you please provide more information on how do you create the sysprep'd image, do you run sysprep manually then using multicast to create the image, or the image is created through Console task?  You mentioned after couple of deployments the console service account got locked, so I would guess a console task is being used when deploying the sysprep'd image (please correct me if this is incorrect).  Does the task include any steps other than clone step?  Does the console machine is member of a domain and what is the current logon user (domain user or local user)?  Does the same scenario and the answer file worked OK before the upgrade, what is the previous ghost version?

     

    Thanks,

    Jenny

    Message Edited by Jenny Fu on 06-24-200707:04 PM



  • 3.  RE: (GSS2.0)Domain Admin account got locked out after sysprep.

    Posted Jun 25, 2007 09:51 AM

    Jenny, Thanks for your reply

     

    I created the image though the console, I imported the sysprep from C:\Sysprep, and then I went to "Edit unattend file" to verify the entire context showing ok then create an image at last.

     

    We use console task for deployment all the time. The task includes the configuration step which contains computer name changing other than Clone.

     

    Console machine is a member of the domain and during the deployment we logon console as a domain admin (not GHOST_user)

     

    Previous ghost version was 10.x I believe. Now we have 11.01 which is the newest version just got confirmed by Symantec.

     

    -Nelson



  • 4.  RE: (GSS2.0)Domain Admin account got locked out after sysprep.

    Posted Jun 26, 2007 02:05 AM
    Hey,
     
    Thanks for your detailed explanations.  This scenario is pretty normal and there is no obvious reason why you can't.  However after revisiting your answer file, I found one thing that I missed during my initial read.  That is the DomainAdmin entry.  You used the Console Service account as a domain user account, which is incorrect.  The Console Service account named "GHOST_ConsoleMachineName" is created by Ghost Configuration Server in the domain.  Once this account is created on a domain, the domain is supported for configuration operations (such as join to the domain, remove from the domain and back to workgroup).  This account only does two things - to create and remove computer accounts in the domain.  You can't use this account as a domain USER account to login to a domain.  You need to create your own domain user account and use it for a client machine to login to the domain.  You can use a domain user account that you used when you add the domain into the domain supported list in the Console machine.
     
    Hope this helps.
    Jenny


  • 5.  RE: (GSS2.0)Domain Admin account got locked out after sysprep.

    Posted Jun 27, 2007 09:44 AM
    Hi
     
    Here is something i didn't mention
     
    We escalated the Ghost_username account to a domain admin because when we was on GGS1, we had couple problems with permission of this account, so we contacted Symantec, and they told us to escalate the permission of it, so we did it and everything worked since the modification.
     
    And we are not willing to change any line of the sysprep, because that's the way it worked, just wondering why the issue started happen since V2 upgrade, we need a proper reason for changing it, and need to know why it worked, now it's not.
     
    Thanks.

    Message Edited by default on 06-27-200706:48 AM



  • 6.  RE: (GSS2.0)Domain Admin account got locked out after sysprep.

    Posted Jun 28, 2007 01:03 AM
    Hey,
     
    To help me investigate this issue, can you provide more details about the "Account Lockout Policy" settings?  What is your domain controller's OS?  Have you had a chance to check the windows event log and see whether there is an account locked out log? 
     
    You need to enable "success" & "failure" in the following settings, so Windows will create an event log when an account is locked out.
    "Audit account logon events",
    "Audit account management", and 
    "Audit logon events".
     
    Once you get an account locked log, can you please post it in here?
     
    Thanks,
    Jenny