Cloned PC's randomly logging in with safe mode?

Posted by This_guy_works@reddit | sysadmin | View on Reddit | 7 comments

This one is a bit difficult to google any results, as looking up safe mode on windows 10 machines shows a lot of results for \*how\* to boot into safe mode, but nothing regarding what to do if the computer randomly boots to safe mode. Long story short, we cloned about 50 PC's in our business off of one master PC image. This wasn't the best way to do things, I know, but we had to rush something out last minute. The one really weird issue we have been seeing is that randomly, maybe once per week per device, when end users log into a machine, it will immediately boot into safe mode, and load the Edge browser. There is no group policy and folder redirects being applied, it just takes the credentials and loads in a few seconds, but staff are not able to work as not everything loads correctly. A reboot fixes the issue and only takes a minute to complete, but it's very bizarre and makes the IT department look bad. We're trying to find out why this is happening, and if so, if we can prevent this from happening in the future. We do use DUO for our MFA, and I have seen the DUO prompt come up each login, even when the safe mode kicks in, so I am wondering if that is interfering with something? It doesn't matter if staff have logged into the PC's previously and have a profile, seems to come up regardless on if someone has used the PC recently or not. Basically wondering if anyone has seen this before, and how we can address it.

7 Comments

[-]

BrainWaveCC@reddit

> This wasn't the best way to do things, I know, but we had to rush something out last minute. Feel free to provide more details on how this cloning was done, and with what tools, but I'm pretty sure that this will turn out to be a huge part of the problems you are experiencing. > We're trying to find out why this is happening, and if so, if we can prevent this from happening in the future. Um.... Lobby with your management team to get a better heads up for major work like this, and use a more appropriate and supported provisioning and deployment methodology...

This_guy_works@reddit (OP)

We used clonezilla off of a known good image computer. Cleared off all the old profiles and cloned the drive, then on the new drive once back in the machine we did Windows updates. Seemed to work fine during our brief testing, but of course some issues weren't found until days/weeks after they went live.

The approved, supported cloning approach for Windows, involves using **SysPrep** See the **Summary** found at the following: [https://learn.microsoft.com/en-us/troubleshoot/windows-server/backup-and-storage/windows-installations-disk-duplication](https://learn.microsoft.com/en-us/troubleshoot/windows-server/backup-and-storage/windows-installations-disk-duplication) You're going to continue to have issues until you rectify what I expect are duplicate SIDs...

Makes sense, and no, SysPrep wasn't done prior to cloning the drives. At this point am I boned, or can I do anything such as run SysPrep on each machine we cloned and reboot to fix the issues with is likely being caused by the SIDs? If I remove them from the domain, do sysprep, reboot, and then re-join will that work?

jeezarchristron@reddit

Not familiar with clonezilla. Is this a pure clone or does it run sysprep after you clone a new pc with the image?

253IsHome@reddit

Its just a wrapper for dd in a live linux environment. All those duplicate SIDs. Christ.

SithLordAJ@reddit

I haven't seen this specific issue, but windows isnt free. You can't just clone the same image everywhere and expect it to work. Windows will malfunction as a consequence of the copy protections it has. You need to sysprep each machine and then deal with activation. If you dont, strange issues like you're experiencing will continue to crop up. Otherwise, clonezilla and sysprep (protip: sysprep first, then clone the sysprepped drive before it boots up) isnt exactly a bad way of doing what you need to do. If they are different models, drivers might be different and then you might need to do a bit more work, but that's unlikely to be a major issue.

Reply to Post

7 Comments