The SID (Security Identifier) on a NT Workstation, on a NT Member Server, and on a PDC is generated during the GUI phase of setup. The SID is used on the local machine, in conjunction with a RID to assign a unique ID to user accounts on that machine.. The Sid of a BDC is taken from the PDC as they share a common account database.
When a Workstation joins a domain. it is given a Domain SID by the PDC which is the PDC SID plus a unique RID. The Workstation also remembers the domain SID.
In Windows NT 4.0 (and earlier), the PDC does not make use of the Workstations SID. There is a high probability that this will change in the future.
So, can I clone my Workstation or Member Server? Yes, if you do it before the GUI phase of setup. If you do it after the SID has been established, you are tempting the fates.
For more detail, see KB article Q162001
See tip 343.
