I work in a very controlled environment. An image is created by an entity outside of our control that is tailored (read: locked down) for our environment.
The client support technicians are to take this disk (physical or ISO) and use it whenever they re/image a computer. Once the image is applied to the computer, the computer is joined to the domain and patches are applied (WSUS, SCCM, etc) before turning the PC over to the customer.
We are concerned the technicians are creating their own "image" (applying patches, etc) and "ghosting/cloning" (WDS, Ghost, Acronis, etc) THAT image (and changing the SID) rather following standard procedures. Is there a way to tell if PC has been properly imaged or "ghosted"?
As the junior sysad/new-kid-on-the-block, I've been tasked to figure this out.
Thank you,