By default, immediately after installation, Windows® starts Windows Welcome. However, you can configure a computer to boot to audit mode instead.

Audit mode enables you to customize a Windows installation without having to configure the user interface pages of Windows Welcome. During Windows Welcome, you are prompted to create user accounts and configure your location and time zone. By booting to audit mode you can ensure that the Windows image you are customizing would not have additional configurations that you would need to remove. Audit mode is ideal for making change to a Windows image before shipping a computer to a customer or capturing the image for reuse in your organization.

When Windows boots, there are two modes in which a computer can start:

In audit mode, you can:

In default installations of Windows, the built-in administrator account is disabled. However, when you boot to audit mode, the built-in administrator account is enabled automatically, enabling you to log on to the computer.

In the auditSystem configuration pass, the built-in administrator account is enabled. However, after logging on to the system, the built-in administrator account is disabled during the auditUser configuration pass. This enables you to use audit mode with administrator privileges, but the next time the computer shuts down, the built-in administrator account will continue to be disabled. For more information, see Enable and Disable the Built-in Administrator Account.

Important:
  • If you are in audit mode and a password-protected screen saver is activated, you will not be able to log back on to the system. This is because the built-in administrator account used to log on to audit mode is immediately disabled after logon.

    To disable the screensaver, either change the power plan through Control Panel or configure and deploy a custom plan. For more information see the Configure Power Plans.

  • Settings in an unattended answer file from the oobeSystem configuration pass will not appear in audit mode.

See Also