Audit mode enables OEMs and corporations to install additional device drivers, applications, and other updates. When Windows® boots to audit mode, the auditSystem Configuration Pass and auditUser settings for unattended Windows Setup are processed. The auditUser configuration pass always runs after the auditSystem configuration pass.
The auditUser configuration pass processes unattended Setup settings in user context in audit mode. The auditUser configuration pass runs after the auditSystem Configuration Pass pass, which is used to apply settings in system context.
Typically, the auditUser configuration pass is used to execute RunSynchronous or RunAsynchronous commands. These commands are used to run scripts, applications, or other executables during audit mode.
By using audit mode, you can maintain fewer Windows images because you can create a reference image with a minimal set of drivers. The image can be updated with additional drivers during audit mode. You can then test and resolve any issues related to malfunctioning or incorrectly installed devices on the Windows image.
The following diagram illustrates the audit mode process.
The auditUser configuration pass runs only when you configure Windows Setup to boot into audit mode. You can boot to audit mode by using the sysprep /audit or sysprep /generalize /audit commands, or you can specify the Reseal setting in the Microsoft-Windows-Deployment component. For more information, see the Windows® Unattended Setup Reference.
Audit mode is optional.