Share via

Windows 11 24H2 SMB authentication failure between domain-joined machines cloned from same image

Wilmer Ramos 25 Reputation points
2026-04-02T16:56:41.92+00:00

We are experiencing SMB authentication issues between domain-joined machines after deploying multiple Windows 11 24H2 devices using a cloned image.

Environment:

  • OS: Windows 11 24H2 (fully updated, including recent cumulative updates such as KB5068861)
  • Domain environment (Active Directory)
  • Multiple client machines deployed from the same golden image
  • Some machines acting as file/print servers (shared printers and administrative shares like C$)

Issue:

When attempting to access shared resources (e.g. \\hostname\share or \\hostname\C$), authentication fails even when using valid domain administrator credentials.

  • Users are prompted for credentials
  • Credentials are rejected consistently
  • Access to shared folders and printers is blocked
  • Behavior is inconsistent with previous Windows 10 deploymentsWe are experiencing SMB authentication issues between domain-joined machines after deploying multiple Windows 11 24H2 devices using a cloned image.
Windows for business | Windows Client for IT Pros | User experience | Other
0 comments
Answer accepted by question author
  1. MotoX80 37,516 Reputation points
    2026-04-04T13:37:34.85+00:00

    Install the Known Issue Rollback and then use the group policy editor to disable it. Download link in the answer from GTS-NJ.

    https://dotnet.territoriali.olinfo.it/en-us/answers/questions/5648842/latest-win-11-updates-have-enforced-sid-and-now-i

    2 people found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thomas4-N 13,065 Reputation points Microsoft External Staff Moderator
    2026-04-04T10:48:43.07+00:00

    Hello Wilmer Ramos,

    I came across this article that looks very similar to what you're describing: KB5070568 – Kerberos and NTLM authentication failures due to duplicate SIDs

    It points to Windows updates released on/after August 29, 2025 (starting with KB5064081) introducing stricter SID uniqueness enforcement during Kerberos/NTLM authentication. If your machines were cloned without Sysprep, they likely share the same machine SID — and Windows now blocks the authentication handshake between them, which would explain why valid credentials are still being rejected.

    You can verify this by checking Event Viewer > System log on affected machines for lsasrv Event ID 6167: "There is a partial mismatch in the machine ID."

    If this is indeed the case, the fix per the article is to rebuild affected machines using Sysprep (sysprep /generalize) so each gets a unique SID before redeployment.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.