The System Preparation (Sysprep) tool prepares an installation of Windows® for duplication, auditing, and customer delivery. Duplication, also called imaging, enables you to capture a customized Windows image that you can reuse throughout an organization. Audit mode enables you to add additional device drivers or applications to a Windows installation. After you install the additional drivers and applications, you can test the integrity of the Windows installation. Sysprep also enables you to prepare an image to be delivered to a customer. When the customer boots Windows, Windows Welcome starts.
Sysprep must be used only to configure new installations of Windows. You can run Sysprep as many times as required to build and to configure your installation of Windows. However, you can reset Windows activation no more than three times. You must not use Sysprep to reconfigure an existing installation of Windows that has already been deployed.
This topic includes:
- Benefits of
- Technologies Related to
Benefits of Sysprep
Sysprep provides the following benefits:
- Removes system-specific data from
Windows. Sysprep can remove all system-specific information
from an installed Windows image, including the computer security
identifier (SID). The Windows installation can then be captured and
installed throughout an organization.
- Configures Windows to boot to Audit
mode. Audit mode enables you to install third-party
applications and device drivers, as well as to test the
functionality of the computer.
- Configures Windows to boot to
Windows Welcome. Configures a Windows installation to boot
to Windows Welcome the next time the computer starts. In
general, you configure a system to boot to Windows Welcome
immediately before delivering the computer to a customer.
- Resets Windows Product Activation.
Sysprep can reset Windows Product Activation up to three
Common Sysprep Scenarios
The Sysprep tool is commonly used in the following scenarios:
Creating a Build-to-Plan (BTP) Windows Image
In the build-to-plan (BTP) scenario, you create a single Windows reference image to install computers that use the same hardware configuration. You customize the single Windows reference installation by installing Windows and then adding additional drivers and applications. You then capture the Windows image and use it to install your computers. No additional modifications are made to this image.
This scenario includes the following stages:
- You install Windows on a reference computer.
- After the installation is complete, you boot the computer and
install any additional device drivers or applications.
- After you update the Windows installation, you run the
sysprep /oobe /generalize command. The /generalize
option instructs Sysprep to remove system-specific data from the
Windows installation. System-specific information includes event
logs, unique security IDs (SIDs), and other unique information.
After the unique system information is removed, the computer shuts
down. The /oobe option instructs the Windows installation to
run Windows Welcome the next time the computer boots.
- After the computer shuts down, you can boot to Windows PE
or another operating system on the computer.
- You then capture the Windows installation with ImageX, by
creating a reference image with which to install computers with the
same hardware configuration.
Creating a Build-to-Order (BTO) Windows Image
In the build-to-order (BTO) scenario, you start with a Windows reference image. After installing this reference image, you make additional updates to the Windows installations that are unique for the computer that you are installing. In general, these are customer-requested applications or updates. By booting to Audit mode, you can install additional devices and applications specific to that computer.
The difference between the build-to-plan scenario and the build-to-order scenario is that you make additional changes to the Windows reference installations that are unique to the computer.
This scenario includes the following stages:
- You start with a Windows reference image that applies to all
computers in your organization.
- Install the Windows reference image to the computer that must
be delivered to a customer.
- After installation is complete, you run the sysprep /audit
/generalize /shutdown command to configure Windows to boot the
computer to Audit mode. You can then capture the Windows image by
booting to another partition or by using Windows PE.
This image then becomes your reference image that you can save to install computers of the same configuration.
- Use the new reference image to install a new computer. The
Windows image is applied to the computer, and Windows boots to
- You can install additional applications and other updates based
on a customer's order. You can also test the computer to verify
that all components are working properly.
If you install Windows images by using the sysprep /generalize /oobe command, be aware that the user experience will not be ideal. On the next reboot after running sysprep /generalize /oobe, Windows will run the specialize configuration pass, Plug and Play, and other Setup tasks before launching Windows Welcome. This process can take additional time and can delay a customer's first logon.
- After you update the Windows installation, you run the
sysprep /oobe /shutdown command.
- Package the computer and deliver it to the customer.
- The next time the computer starts, Windows Welcome
Booting to Audit Mode
Audit mode enables OEMs and corporations to quickly customize a Windows installation. In Audit mode, you can install applications, add device drivers, run scripts, and test the validity of a Windows installation. Audit mode does not require settings in Windows Welcome to be applied.
Typically, Windows starts Windows Welcome immediately after installation. However, by booting to Audit mode, you can bypass Windows Welcome and boot the computer immediately to the desktop. This enables you to start your customization process as quickly as possible.
Also, Audit mode enables you to verify that a computer is functional before it is delivered to a customer. You can verify that the end user's first boot experience runs as expected, and OEM customizations and information about your company's support options are present.
There are several ways to boot to Audit mode:
- For an attended installation, at the Windows
Welcome screen, press CTRL+SHIFT+F3.
- In an unattended installation, add the
Microsoft-Windows-Deployment component to the oobeSystem
configuration pass. In the
Reseal\ Modesetting, specify Audit. When Windows completes installation, the computer will reboot to audit mode. For more information about this setting, see the Unattended Windows Setup Reference (Unattend.chm).
- Run the sysprep /audit command in a
Command Prompt window.
For more information about Audit mode, see Customize Windows in Audit Mode.
After you make configurations to the Windows installation, you can prepare that computer for delivery to a customer by running the sysprep /oobe command. The /oobe option instructs Windows to run Windows Welcome the next time the computer boots.
Limitations of Sysprep
Sysprep has the following limitations:
- You must use only the version of the Sysprep
tool that is installed with the Windows image that you intend to
configure. Sysprep is installed with every version of Windows and
must always be run from the %WINDIR%\system32\sysprep
- The Sysprep tool must not be used on upgrade
installation types. Run Sysprep only on clean installations.
- If you plan to use the imagex /apply
command to apply a Windows image to a computer, the partition
layout on the reference and destination computers should be
identical. For example, if you capture a customized Windows image
on drive D, you must always deploy that image onto drive D of the
destination computer. The following list describes the partition
settings that must be identical across the reference and
destination computers when you use the imagex /apply
- The partition type (primary, extended, or
logical) must match.
- If the partition is set to active on the
reference computer, the destination computer must also be set to
In some cases, customized applications that are installed before the Windows image is recaptured might require a consistent drive letter. Some applications store paths that include the system's drive letter. Uninstallation, servicing, and repair scenarios might not function appropriately if the system's drive letter does not match the drive letter specified in the application..
- The partition type (primary, extended, or logical) must match.
- Not all server roles support Sysprep. If you
run the sysprep /generalize command against a
Windows Server® 2008 or Windows Server® 2008 R2
installation with specific server roles configured, those server
roles may not continue to function after imaging and deployment.
For more information, see Sysprep Support for
- When you copy Windows images between
computers, the reference and destination computers do not need to
have compatible hardware abstraction layers (HALs). The
/detecthal option in the Boot Configuration Data (BCD) will
enable a system that has already run Sysprep to install the correct
- The Plug and Play devices on the reference
and destination computers, such as modems, sound cards, network
adapters, and video cards, do not have to be from the same
manufacturer. However, the drivers for these devices must be
included in the installation.
- You cannot automate the running of Sysprep by
RunSynchronouscommand in an auditUser configuration pass. However, you can use the generalize setting in the Microsoft-Windows-Deployment component to automatically prepare the computer for imaging after installation.
- The clock for activation begins its countdown
the first time Windows starts. You can use Sysprep for a maximum of
three times to reset the clock for Windows Product Activation.
After the third time you run Sysprep, the clock can no longer be
- ImageX, third-party disk-imaging software, or
disk-duplicating hardware devices are required for image-based
Setup. These products create binary images of a computer's hard
disk and either duplicates the image to another hard disk or stores
the image in a file on a separate disk.
- The Sysprep tool runs only if the computer is
a member of a workgroup, not a domain. If the computer is joined to
a domain, Sysprep removes the computer from the domain.
- If you run Sysprep on an NTFS file system
partition that contains encrypted files or folders, the data in
those folders becomes completely unreadable and unrecoverable.
- Sysprep converts the %COMPUTERNAME%
environment variable to uppercase characters. However, the actual
name of the computer does not change.
- Running Sysprep will cause
Windows Welcome to prompt you for a product key. You can use
an answer file with Sysprep to prevent Windows Welcome from
prompting you for a product key. If you specify a valid product key
ProductKeysetting of the Microsoft-Windows-Shell-Setup component during the specialize configuration pass, then Windows Welcome will not prompt you for a product key.
- If a computer is joined to a domain, and the
Group Policy of that domain assigns a strong-account password
policy to the computer, all user accounts will require strong
passwords. Running Sysprep or Windows Welcome does not remove
the strong-password policy.
If you do not assign a strong password to a user account before running Sysprep or Windows Welcome, you may not be able to log onto the computer. We recommend that you always use strong passwords for your user accounts.
Dependencies of Sysprep
Sysprep has the following dependencies:
- Sysprep is used after running
- You need an imaging tool, such as ImageX, to
capture an image of the installation.
Technologies Related to Sysprep
The following technologies are related to the Sysprep tool:
ImageX is a command-line tool that enables original equipment manufacturers (OEMs) and corporations to capture, modify, and apply Windows images for rapid deployment. ImageX works with Windows image (.wim) files to copy an image directly to a destination computer, or it can work with other technologies that use the .wim files. Corporations that do not require the capture functionality or the low-level features included in ImageX can still use related technologies such as unattended installation, Group Policy, and Systems Management Server (SMS).
Windows Software Protection Platform (SPP)
Windows Software Protection Platform (SPP) reduces Windows piracy by ensuring compliance with the Microsoft Software License Terms. In previous Windows versions, this was known as Windows Product Activation (WPA). During product activation, the product key is matched with the individual computer on which the software is installed. It does this by validating the product key, and checks that it has not been used with more than the licensed number of computers.
Windows Setup is the program that installs Windows or upgrades previous versions of Windows.
Unattended Windows Setup Answer File
The unattended Windows Setup answer file, typically called Unattend.xml, is the answer file for Windows Setup that is created by using Windows System Image Manager (Windows SIM). The answer file enables the configuration of default Windows settings, as well as the addition of drivers, software updates, and other applications. The answer file enables OEMs and corporations to customize Windows Setup tasks, for example, specifying disk configuration, changing the default values for Internet Explorer®, and installing additional drivers.
The single answer file replaces all the answer files that were used in previous versions of Windows (Unattend.txt, Winbom.ini, Oobeinfo.ini, and Sysprep.inf).
Windows System Image Manager
Windows System Image Manager (Windows SIM) provides you with the ability to customize Windows images. Windows SIM enables you to customize the settings in a Windows image. Based on your configurations, you can create an unattended Windows Setup answer file, typically called Unattend.xml. This answer file is used during Windows Setup to apply your configurations to Windows. In the answer file, you can specify changes to default operating system components and add additional software, such as third-party drivers or product updates.
Software and hardware developers, including a company’s internal developers, Independent Software Vendors (ISVs), and Independent Hardware Vendors (IHVs), can create Sysprep providers that enable their applications to support imaging and deployment scenarios. If an application does not currently support generalize operations via the Sysprep tool, you can create a provider that will remove all software-specific and hardware-specific information from the application.
For more information about Sysprep providers, see the Sysprep Provider Developer’s Guide for Windows 7