How Sysprep Works

Applies To: Windows 7

Note
This content applies to Windows 7. For Windows 8 content, see Windows Deployment with the Windows ADK.

The System Preparation tool, Sysprep.exe, is used to prepare an installation of Windows® for imaging or delivery to a customer.
This topic includes:

Sysprep Executable

Sysprep.exe is the main program that calls other executable files that prepare the Windows installation. Sysprep.exe is located in the %WINDIR%\system32\sysprep directory on all installations. Sysprep must always be run from the %WINDIR%\system32\sysprep directory and must run on the version of Windows with which it was installed.

Sysprep Process

When Sysprep runs, it goes through the following process:

Verifies that Sysprep can run. Only an administrator can run Sysprep, and only one instance of Sysprep can run at a given time. Also, Sysprep must run on the version of Windows with which it was installed.
Initializes logging.
Parses command-line arguments.
If no command-line arguments were provided, the Sysprep window appears that enables users to specify Sysprep actions.
Processes Sysprep actions, calls appropriate .dll files and executable files, and adds actions to the log file.
Verifies that all .dll files have processed all of their tasks, and then either shuts down or restarts the system.

Using Answer Files with Sysprep

You can use an answer file with Sysprep to configure unattended Setup settings. The following sections describe some of the considerations and processes for using answer files with Sysprep.

Applying Settings in the generalize, auditSystem, and auditUser Configuration Passes

Not all configuration passes run during Windows Setup. Some configuration passes are available only when you run Sysprep. The generalize, auditSystem and auditUser configuration passes are available only by running Sysprep. If you add settings to your answer file in these configuration passes, you must run Sysprep to apply these settings:

To apply the settings in the auditSystem and auditUser configuration passes, you must boot to audit mode by using the sysprep/audit command.
To apply the settings in the generalize configuration pass, you must use the sysprep/generalize command. The generalize configuration pass removes the system-specific settings, enabling you to deploy the same image for multiple computers.

For more information, see How Configuration Passes Work. For more information about Sysprep command-line options, see Sysprep Command-Line Syntax.

Caching Answer Files to the Computer

If you install Windows by using an answer file, that answer file is cached to the system so when subsequent configuration passes run, settings in the answer file are applied to the system.
Because this answer file is cached, when you run the Sysprep command, settings in the cached answer file are applied. If you use the settings in a different answer file, you can specify a separate Unattend.xml file by using the sysprep /unattend:filename option. For more information, see Sysprep Command-Line Syntax.
For more information about using implicit answer file search, see How Windows Setup Works.

Persisting Plug and Play Device Drivers During generalize

You can persist device drivers when you run the sysprep command with the /generalize option by specifying the PersistAllDeviceInstalls setting in the Microsoft-Windows-PnPSysprep component. During the specialize configuration pass, Plug and Play scans the computer for devices and installs device drivers for the detected devices. By default, these device drivers are removed from the system when you generalize the system. If you set PersistAllDeviceInstalls to true in an answer file, Sysprep will not remove the detected device drivers. For more information, see the Unattended Windows Setup Reference (Unattend.chm).

Displaying RunSynchronous Actions in an Answer File

In audit mode, you can view the status for RunSynchronous commands that run during the auditUser configuration pass. The AuditUI window displays the status for commands and provides:

Visual progress to indicate that an installation is continuing and not suspended.
Visual indication of when and where failures occur. This provides quick diagnosis if log files are not created by the command.

If there are RunSynchronous commands in the answer file in the auditUser configuration pass, a list of the commands are displayed in the AuditUI window in the order specified by RunSynchronous/RunSynchronousCommand/Order. Each list item in the user interface is either the string from:

RunSynchronous/RunSynchronousCommand/Description (if present)

-or-
RunSynchronous/RunSynchronousCommand/Path

All RunSynchronous commands are processed in order. If the command succeeds, then its related list item is annotated with a green checkmark. If the command fails, then its related list item is annotated with a red X. If a reboot is requested, the AuditUI window is redisplayed after the boot but only unprocessed list items are displayed. Previously processed items no longer appear in the AuditUI window. If the list of items in the AuditUI window exceeds the height of the display, then the list is clipped to the display and does not scroll. As a result, some items might not be visible.
Windows Setup interprets the return codes as status values in the AuditUI window. A zero value indicates a success, while a nonzero value indicates a failure. The return value of the command might affect the behavior of the Windows Setup, depending on the value of the RunSynchronous/RunSynchronousCommand/WillReboot command.
If the RunSynchronous/RunSynchronousCommand/WillReboot command is set to Always, then:

If the command returns 0, its related list item is annotated with a green checkmark. A reboot immediately occurs.
If the command returns nonzero, its related list item is annotated with a red X. A reboot immediately occurs.

If the RunSynchronous/RunSynchronousCommand/WillReboot command is set to Never, then:

If the command returns 0, its related list item is annotated with a green checkmark.
If the command returns nonzero, its related list item is annotated with a red X. A nonzero return value is not treated as a fatal error when WillReboot is set either to Always or Never.

If the RunSynchronous/RunSynchronousCommand/WillReboot command is set to OnRequest, then:

If the command returns 0, its related list item is annotated with a green check mark.
If the command returns 1, its related list item is annotated with a green check mark. A reboot immediately occurs.
If the command returns 2, its related list item is temporarily annotated with a green checkmark. A reboot immediately occurs. Following the reboot, the related list item is displayed again in the AuditUI window without annotation because the command is still in process.
If the command returns other values, then a fatal error occurs and a blocking dialog box is displayed. If the Errorhandler.cmd file is present, no dialog box is displayed. For more information about Errorhandler.cmd, see Add a Custom Script to Windows Setup.

Resetting Windows Activation

When you install Windows with a single license product key, you have 30 days during which you must activate that installation of Windows.
There is no limit to the number of times that the Sysprep command can run on a computer. However, the clock for Windows Product Activation begins its countdown the first time Windows starts. You can use the sysprep /generalize command to reset Windows Product Activation a maximum of three times. After the third time that you run the sysprep /generalize command, the clock can no longer be reset.
When you run the sysprep /generalize command, the activation clock will automatically reset. You can bypass resetting the activation clock by using the SkipRearm setting in the Microsoft-Windows-Security-SPP component. This enables you to run the Sysprep command multiple times without resetting the activation clock. For more information about this setting, see the Unattended Windows Setup Reference (Unattend.chm).

Important
If you anticipate running the Sysprep command multiple times on a single computer, you must use the `SkipRearm` setting in the Microsoft-Windows-Security-Licensing-SPP component to postpone resetting the activation clock. Because you can reset the activation clock only three times, if you run the Sysprep command multiple times on a computer, you might run out of activation clock resets. We recommend that you use the `SkipRearm` setting if you plan on running the Sysprep command multiple times on a computer.

Important

If you anticipate running the Sysprep command multiple times on a single computer, you must use the SkipRearm setting in the Microsoft-Windows-Security-Licensing-SPP component to postpone resetting the activation clock. Because you can reset the activation clock only three times, if you run the Sysprep command multiple times on a computer, you might run out of activation clock resets. We recommend that you use the SkipRearm setting if you plan on running the Sysprep command multiple times on a computer.

Important
Before running the Sysprep command the final time before deploying the computer, rearm the computer by setting the `SkipRearm` setting to 0. This causes the activation timer to reset.

You can review the number of times you can use the SkipRearm setting by using the slmgr /dlv command. For information, see Work with Product Keys and Activation.

Volume License and OEM Activation Requirements

For volume licenses, activation clock reset behavior is different, depending on the type of license.

Activation can be reset an unlimited number of times for an activated Key Management Service (KMS) clients. For non-activated KMS clients, the activation clock can be reset only up to three times, the same as a single license.

We recommend that KMS clients use the sysprep /generalize command where the value of the SkipRearm setting is equal to 1. After capturing this image, use the sysprep /generalize command, where the value of the SkipRearm setting is equal to 0.
For Multiple Activation Keys (MAK) clients, the recommendation is to install the MAK immediately before running Sysprep the last time, prior to delivering the computer to a customer.

For OEM Activation licenses, activation is not required. OEM Activation is available only to royalty OEMs.

Detecting the number of activations remaining

You can check the activation clock to see how many times you can use the sysprep /generalize command. For information, see Prepare to Capture an Image for Deployment (Generalize).

Activating Windows Before Shipping to a Customer

Most customers can easily manage activation after receiving their computers. But if you prefer, you can activate the software on behalf of your customers, making it easier for them to start using their new computers. After activation is completed, most users will not need to activate their installation again.
To activate Windows for your customer, use the unique Product Key from the certificate of authenticity (COA) label that is affixed to the specific computer, and activate the computer on behalf of the end user. Run the sysprep /oobe command to prepare the computer for delivery to the customer.

Note
You cannot make an image of an activated Windows installation and duplicate that image to another computer. If you do, Windows fails to recognize the activation and forces the end user to reactivate the installation manually.

Booting to Audit Mode or Windows Welcome

When Windows® 7 boots, there are two modes in which the computer will start:

Windows Welcome Windows Welcome, also called Machine out-of-box experience (OOBE), is the first user experience and enables end users to customize their Windows installation. End users can create user accounts, read and accept the Microsoft® Software License Terms, and choose their language and time zones.

By default, all Windows installations boot to Windows Welcome first.

The oobeSystem configuration pass runs immediately before Windows Welcome starts. For more information about this configuration pass, see oobeSystem Configuration Pass.
Audit Mode. Audit mode enables OEMs and corporations to add customizations to their Windows images. Audit mode does not require settings in Windows Welcome to be applied. By bypassing Windows Welcome, you can access the desktop quicker and perform your customizations. You can add additional device drivers, install applications, and test the validity of the installation.

In audit mode, settings in an unattended answer file in the auditSystem and auditUser configuration passes are processed. For more information about these configuration passes, see auditSystem Configuration Pass and auditUser Configuration Pass.

If you are running a computer in audit mode to configure the installation to boot to Windows Welcome, run the sysprep /oobe command. OEMs are required to run the sysprep /oobe command before shipping a computer to an end user. In a default Windows installation, after installation completes, Windows Welcome starts. However, you can skip Windows Welcome and boot directly to audit mode by pressing Ctrl+Shift+F3 at the first Windows Welcome screen.

For unattended installation, you can configure Windows to boot to audit mode by using the Microsoft-Windows-Deployment | Reseal setting in an answer file. For more information, see the Unattended Windows Setup Reference (Unattend.chm).

For more information about audit mode, see Customize Windows in Audit Mode.

Detecting the State of a Windows Image

You can identify the state of a Windows image, whether it will boot to audit mode, Windows Welcome, or if the image is still in the process of installation. For more information, see Windows Setup Installation Process.

Sysprep Log Files

The Sysprep tool logs Windows Setup actions in different directories, depending on the configuration pass. Because the generalize configuration pass deletes certain Windows Setup log files, the Sysprep tool logs generalize actions outside the standard Windows Setup log files. The following table shows the different log file locations that are used by Sysprep.

Item	Log Path
Generalize	%WINDIR%\System32\Sysprep\Panther
Specialize	%WINDIR%\Panther\
Unattended Windows Setup actions	%WINDIR%\Panther\Unattendgc

Creating and Using Sysprep Providers

Software and hardware developers, including a company’s internal developers, Independent Software Vendors (ISVs), and Independent Hardware Vendors (IHVs), can create Sysprep providers that enable their applications to support imaging and deployment scenarios. If an application does not currently support generalize operations via the Sysprep tool, you can create a provider that will remove all software-specific and hardware-specific information from the application.
To create a Sysprep provider, you must:

Determine which configuration phase (cleanup, generalize, or specialize) your Sysprep provider addresses.
Create the appropriate entry point for your Sysprep provider, based on your choice of configuration phase.
Register the Sysprep provider for use by the Sysprep tool.
Test your Sysprep provider to validate that it functions properly, reviewing the log files for warnings and errors.

Note
For more information about Sysprep providers, see the Sysprep Provider Developer’s Guide for Windows 7

Sysprep needs a better recovery model

I can appreciate the need to test an unattended sysprep files, but Microsoft needs to build in some sort of recovery model due to a failed sysprep. Hours are continually wasted when the process fails and sysprep wants to reboot due to some mysterious failure in the process only to continue right where it left off. It would be great if it either continued the process OR rebooted in audit mode due to failure.

There is no OOB method to get to the log files and hopefully figure out where the process went wrong; currently we need some sort of boot disk to get to the log files.

I did learn something, if you are using Ghost or some other imaging product if you happen to have a good sysprep image and you also have a "failed" sysprep image (for example you're updating your image inventory) as long as the architecture is the same you can copy the system32\sysprep folder and the windows\panther folder in to the failed image and have it suddenly work. This will save you from having to sped many hours of going back over your work. Now you just need to figure out why the image failed.

Running Welcome

Clock

Saturday, August 10, 2013