Audit mode enables OEMs and corporations to install additional device drivers, applications, and other updates to a master Windows® image. Additionally, you can test the installation before shipping the computer to an end-user.
When Windows boots to audit mode, the auditSystem configuration pass and the auditUser Configuration Pass unattended Windows Setup settings are processed.
The auditSystem configuration pass processes unattended Windows Setup settings in system context in audit mode. The auditSystem configuration pass runs immediately before the auditUser Configuration Pass configuration pass, which is used to apply settings in user context.
By using audit mode, you can maintain fewer Windows images because you can create a reference image with a minimal set of drivers and applications. The image can be updated with additional drivers during audit mode. You can then test and resolve any issues related to malfunctioning or incorrectly installed devices on the Windows image.
The following diagram shows the processes of audit mode.
The auditSystem configuration pass runs only when you configure Windows Setup to boot into audit mode. You can boot to audit mode by using the sysprep command with the audit option, or the sysprep command with the generalize and audit options, or you can specify the Reseal setting in the Microsoft-Windows-Deployment component. For more information, see the Windows® Unattended Setup Reference.
Audit mode is optional.