Use virt-clone to make the copy, then use virt-sysprep to remove identity that lives inside the guest operating system. The source VM must be shut down for both operations. virt-clone creates a new libvirt name, UUID and network identity on the host, but it does not change passwords, static network settings, /etc/machine-id or SSH host keys inside the copied OS. virt-sysprep is the in-place guest cleanup step; after it finishes, boot the clone and configure its hostname, network policy, users and keys for its new role.
What each tool changes
A VM has two identity layers. Libvirt stores host-side identity in the domain definition: the domain name, UUID, virtual hardware details and MAC address. The guest OS stores another identity set in its own files and configuration. A safe clone treats those layers separately.
As an Amazon Associate I earn from qualifying purchases.
| Layer | Tool | Typical changes | What remains unchanged |
|---|---|---|---|
| Libvirt host configuration | virt-clone |
New domain name, UUID, copied or arranged storage, and a new or explicitly assigned MAC address | Guest passwords, hostname, static IP configuration, machine ID and SSH host keys |
| Guest filesystem | virt-sysprep |
Selected cleanup operations such as machine ID, SSH host keys, hostname data and other deployment-specific state | Anything not selected or enabled; the operation set must be reviewed for your libguestfs version |
The virt-clone manual describes the boundary plainly: it duplicates disks and makes host-side changes, not changes inside the guest OS. The virt-sysprep manual likewise warns that it modifies the selected guest or image in place. Therefore, cloning alone can produce two machines with the same internal identity even when libvirt shows different UUID and MAC values.
Free tools Windows power users keep installed
One-click scans. No signup required.
Before you clone
- Power off the source guest. An inactive domain is required by
virt-clone. Do not use suspend as a substitute; perform a normal shutdown and verify that the domain is shut off. - Protect a reusable source. If the source is a clean template, create a storage snapshot, copy the disk, or clone the disk before running sysprep. Sysprep edits its target in place and cannot be treated as a read-only inspection.
- Choose storage deliberately. Decide whether the clone gets a full independent copy, a Btrfs reflink clone, an existing destination file, or a skipped device. Shared or accidentally reused storage can make two domains write to the same filesystem.
- Check privileges and capacity. The system connection normally requires administrative access, and the destination path must be writable by libvirt’s QEMU process. The time and space required depend on disk size, storage backend and copy method; the manuals publish no universal performance figure.
- Record deployment settings. Have the new hostname, IP policy, users, SSH enrollment method and any application-specific credentials ready before first boot.
Clone from the command line
1. Verify that the source is off
List domains and confirm the source is not running:
#1 Best Overall
virsh --connect qemu:///system list --allIf it is active, shut it down from the guest or with libvirt and wait until its state is shut off. Do not edit its disks while it is running.
2. Create the new domain and disk
A deterministic clone names the source, destination domain and destination disk explicitly:
virt-clone --connect qemu:///system
--original SOURCE
--name CLONE
--file /var/lib/libvirt/images/CLONE.qcow2Replace SOURCE, CLONE and the path with values for your host. The command copies the source storage to the destination and registers a new libvirt domain. The new domain receives a different libvirt UUID. Its virtual NIC can receive a generated MAC, or you can provide one explicitly when your network design requires a particular address.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →For an automatically generated name and storage paths, the interface also provides --auto-clone. Automatic naming is convenient for disposable copies; explicit --name and --file values are easier to audit in a repeatable deployment.
Rank #2
3. Confirm the host-side identity
Inspect the resulting definition before booting:
virsh --connect qemu:///system dominfo CLONE
virsh --connect qemu:///system dumpxml CLONECheck the domain name, UUID, disk source and each interface’s MAC address. If the clone must use a fixed MAC, set it through the clone command’s MAC option or edit the domain definition before first boot. If the network should allocate addresses dynamically, allow a randomly generated MAC and make sure your DHCP or inventory system recognizes the new machine.
Virt-manager procedure
The graphical workflow is the same, although labels vary slightly between virt-manager releases.
- Open virt-manager using the connection that owns the source domain, commonly
qemu:///system. - Select the source VM and shut it down. Wait for the status to show that it is inactive.
- Use the VM’s Clone action. Enter a new name and select a destination storage path for every disk you intend to copy.
- Ensure the storage choice creates independent copy-on-write or full-copy disks rather than pointing the new domain at the source file. If the dialog exposes MAC-address controls, choose a new generated address or enter the fixed address assigned to the clone.
- Complete the clone and inspect the new domain’s details. Do not boot it yet if you still need to sanitize the guest filesystem.
Virt-manager is useful for one-off copies, while the explicit virt-clone command is easier to place in documented or repeatable procedures. Either path ends at the same boundary: neither one cleans guest identity by itself.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchClean the copied guest with virt-sysprep
Choose a target form
You can target the registered domain:
virt-sysprep --connect qemu:///system -d CLONEOr target the image directly:
virt-sysprep -a /var/lib/libvirt/images/CLONE.qcow2Use one form at a time and make sure the guest is shut down. Never run sysprep while another process is mounting, converting, backing up or otherwise editing the same image; concurrent disk editing can corrupt data.
Review operations before enabling them
Operation names and defaults can differ with the installed libguestfs version. List what your host supports:
virt-sysprep --list-operationsFor a one-off cleanup, you can enable the operations appropriate to the deployment. To remove the two identities most often responsible for collisions, an explicit selection can look like:
virt-sysprep -a /var/lib/libvirt/images/CLONE.qcow2
--operations machine-id,ssh-hostkeysUse the exact names reported by --list-operations on your system. Other available operations may address hostname data, network hardware-address rules, random seeds, user accounts or passwords. Select only what your provisioning policy calls for: sysprep is destructive to the selected state, and an unselected item remains as it was in the source.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When a team needs identical results on every clone, prefer an explicitly documented operation list rather than relying on an implicit default set. Save that list with the image-build or deployment procedure and review it after libguestfs upgrades.
Understand in-place behavior
Sysprep does not produce a second sanitized image. It edits the image you specify. If you accidentally point it at the template, the template’s machine ID, host keys or other selected data may be removed. Preserve the source first whenever it must remain bootable and reusable in its original state.
First boot: make the clone a real machine
After sysprep completes, start only the clone and perform deployment-specific configuration inside the guest:
- Set a unique hostname and verify that the guest’s hostname files agree.
- Choose DHCP or assign the intended static address, gateway and DNS settings. Remove any copied interface rules that bind configuration to the source NIC if your distribution created them.
- Confirm that a new machine ID is generated on boot when the machine-ID operation was selected. Do not manually copy the source machine ID back into the clone.
- Regenerate or enroll SSH host keys according to your security policy. Clients should remove the old host-key record for the address only when you have verified the replacement identity through a trusted channel.
- Create or rotate users, passwords, service credentials and application certificates that were intentionally removed or that must be unique.
- Check time synchronization, cloud-init or other first-boot agents, monitoring registration and backup enrollment before placing the VM in production.
At this stage, compare the clone’s guest identity with the host-side values you inspected earlier. A different libvirt UUID or MAC does not prove that the guest machine ID and SSH keys were changed; those checks must be made inside the running OS.
Storage and identity options that matter
| Capability | When to use it | Important consequence |
|---|---|---|
Explicit destination file (--file) |
You need a known, reviewable disk path | The path must not already belong to another active domain |
Automatic clone (--auto-clone) |
Fast, disposable copies | Names and paths are generated; record the result if it will be reused |
| Sparse or non-sparse output | Choose whether unused blocks are allocated immediately | Physical space consumption and allocation behavior differ by backend |
| Btrfs reflink cloning | Fast copy-on-write creation on supported Btrfs storage | Source and destination initially share extents; later writes diverge them |
| Preserve pre-existing destination data | The destination file already contains data you intentionally want to retain | Verify that the existing contents are suitable; this is not a normal fresh clone |
| Skip or force individual device copies | Multi-disk domains where only selected devices should be copied | A skipped device may remain shared or externally managed, so document ownership |
| Explicit or random MAC | Fixed address reservations versus ordinary DHCP | Duplicate MAC addresses can break connectivity and DHCP leases |
| Separate NVRAM path | UEFI guests with persistent firmware variables | NVRAM is separate from the main disk and must be copied or assigned deliberately |
The exact spelling and availability of these switches depends on the installed virt-clone version. Run virt-clone --help on the target host and confirm the options before automating them.
Clone methods compared
| Approach | Where identity changes | Storage behavior | Reversibility | Repeatability |
|---|---|---|---|---|
| virt-clone only | Libvirt host XML | Copies or arranges storage according to clone options | Source remains intact if you cloned to a new destination | High for host identity; no guest sanitization |
| virt-clone followed by default sysprep | Host XML and selected guest operations | Independent clone plus in-place guest edits | Requires a source snapshot or backup to undo guest cleanup | Depends on the installed default operation set |
| virt-clone followed by explicit sysprep operations | Host XML and the named guest operations | Independent, reflinked or otherwise selected storage | Restorable only from a preserved source or image backup | Best for controlled, repeatable builds |
| Manual disk reuse without cloning | Possibly neither layer | May share the same writable disk | Unsafe unless storage is read-only or separately snapshotted | Poor; identity collisions are likely |
Troubleshooting common failures
“The domain is running” or cloning refuses to start
Shut down the guest, wait for the inactive state, and check for another libvirt connection that may have restarted it. A suspended guest is not a safe source for this workflow.
The destination file already exists
Stop and identify the file’s owner before choosing a preserve or replace behavior. Do not overwrite an existing disk merely to satisfy the command; an existing file may contain another VM’s data.
The clone has network conflicts
Inspect the clone XML for a duplicate MAC, then inspect the guest for copied static IP settings, interface naming rules and stale network configuration. Changing only the MAC does not remove a static address embedded in the OS.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
SSH warns that the host key changed
That warning is expected when the source key was removed and the clone generated a new one, but verify the new fingerprint through your trusted console or provisioning system before accepting it.
The source template was altered
Sysprep is in-place. Restore the template from its snapshot or backup, or rebuild it from the untouched source disk. There is no generic undo operation for every selected guest edit.
A UEFI clone will not boot
Check that the clone has its own appropriate NVRAM path and that the firmware variables were copied or intentionally recreated. The main qcow2 file alone may not represent the complete boot state of a UEFI guest.
Quick Recap
Verification checklist
- Source domain is shut off before cloning and before sysprep.
- Clone has a distinct libvirt name and UUID.
- Every copied NIC has a unique or deliberately assigned MAC.
- Destination disks and NVRAM are independent or explicitly managed as shared resources.
- Machine ID and SSH host keys were removed only through the selected sysprep operations.
- Hostname, IP policy, users, credentials and monitoring registration were set after first boot.
- The preserved source still boots as a clean template.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
