The System Preparation tool, Sysprep.exe, is used to prepare an installation of Windows® for imaging or delivery to a customer.
This topic includes:
Answer Files with Sysprep
- Resetting Windows Activation
- Booting to Audit Mode or
- Detecting the State of a
- Sysprep Log
Sysprep.exe is the main program that calls other executable files that prepare the Windows installation. Sysprep.exe is located in the %WINDIR%\system32\sysprep directory on all installations. Sysprep must always be run from the %WINDIR%\system32\sysprep directory and must run on the version of Windows with which it was installed.
When Sysprep runs, it goes through the following process:
- Verifies that Sysprep can run. Only an administrator can run
Sysprep, and only one instance of Sysprep can run at a given time.
Also, Sysprep must run on the version of Windows with which it was
- Initializes logging.
- Parses command-line arguments.
If no command-line arguments were provided, the Sysprep window appears that enables users to specify Sysprep actions.
- Processes Sysprep actions, calls appropriate .dll files and
executable files, and adds actions to the log file.
- Verifies that all .dll files have processed all of their tasks,
and then either shuts down or restarts the system.
Using Answer Files with Sysprep
You can use an answer file with Sysprep to configure unattended Setup settings. The following sections describe some of the considerations and processes for using answer files with Sysprep.
Applying Settings in the generalize, auditSystem, and auditUser Configuration Passes
Not all configuration passes run during Windows Setup. Some configuration passes are available only when you run Sysprep. The generalize, auditSystem and auditUser configuration passes are available only by running Sysprep. If you add settings to your answer file in these configuration passes, you must run Sysprep to apply these settings:
- To apply the settings in the
auditSystem and auditUser configuration passes, you
must boot to audit mode by using the sysprep /audit
- To apply the settings in the
generalize configuration pass, you must use the
sysprep /generalize command. The generalize
configuration pass removes the system-specific settings, enabling
you to deploy the same image for multiple computers.
Caching Answer Files to the Computer
If you install Windows by using an answer file, that answer file is cached to the system so when subsequent configuration passes run, settings in the answer file are applied to the system.
Because this answer file is cached, when you run the Sysprep command, settings in the cached answer file are applied. If you use the settings in a different answer file, you can specify a separate Unattend.xml file by using the sysprep /unattend:filename option. For more information, see Sysprep Command-Line Syntax.
For more information about using implicit answer file search, see How Windows Setup Works.
Persisting Plug and Play Device Drivers During generalize
You can persist device drivers when you run the
sysprep command with the /generalize option by
PersistAllDeviceInstalls setting in the
Microsoft-Windows-PnPSysprep component. During the
specialize configuration pass, Plug and Play scans the
computer for devices and installs device drivers for the detected
devices. By default, these device drivers are removed from the
system when you generalize the system. If you set
true in an
answer file, Sysprep will not remove the detected device drivers.
For more information, see the Unattended Windows Setup
Displaying RunSynchronous Actions in an Answer File
In audit mode, you can view the status for
RunSynchronous commands that run during the
auditUser configuration pass. The AuditUI window
displays the status for commands and provides:
- Visual progress to indicate that an
installation is continuing and not suspended.
- Visual indication of when and where failures
occur. This provides quick diagnosis if log files are not created
by the command.
If there are
RunSynchronous commands in
the answer file in the auditUser configuration pass, a list
of the commands are displayed in the AuditUI window in the
order specified by
RunSynchronous/RunSynchronousCommand/Order. Each list
item in the user interface is either the string from:
RunSynchronous commands are processed
in order. If the command succeeds, then its related list item is
annotated with a green checkmark. If the command fails, then its
related list item is annotated with a red X. If a reboot is
requested, the AuditUI window is redisplayed after the boot
but only unprocessed list items are displayed. Previously processed
items no longer appear in the AuditUI window. If the list of
items in the AuditUI window exceeds the height of the
display, then the list is clipped to the display and does not
scroll. As a result, some items might not be visible.
Windows Setup interprets the return codes as
status values in the AuditUI window. A zero value indicates
a success, while a nonzero value indicates a failure. The return
value of the command might affect the behavior of the
Windows Setup, depending on the value of the
command is set to Always, then:
- If the command returns 0, its related list
item is annotated with a green checkmark. A reboot immediately
- If the command returns nonzero, its related
list item is annotated with a red X. A reboot immediately
command is set to Never, then:
- If the command returns 0, its related list
item is annotated with a green checkmark.
- If the command returns nonzero, its related
list item is annotated with a red X. A nonzero return value is
not treated as a fatal error when WillReboot is set either to
Always or Never.
command is set to OnRequest, then:
- If the command returns 0, its related
list item is annotated with a green check mark.
- If the command returns 1, its related
list item is annotated with a green check mark. A reboot
- If the command returns 2, its related
list item is temporarily annotated with a green checkmark. A reboot
immediately occurs. Following the reboot, the related list item is
displayed again in the AuditUI window without annotation
because the command is still in process.
- If the command returns other values, then a
fatal error occurs and a blocking dialog box is displayed. If the
Errorhandler.cmd file is present, no dialog box is displayed. For
more information about Errorhandler.cmd, see Add a Custom Script to
Resetting Windows Activation
When you install Windows with a single license product key, you have 30 days during which you must activate that installation of Windows.
There is no limit to the number of times that the Sysprep command can run on a computer. However, the clock for Windows Product Activation begins its countdown the first time Windows starts. You can use the sysprep /generalize command to reset Windows Product Activation a maximum of three times. After the third time that you run the sysprep /generalize command, the clock can no longer be reset.
When you run the sysprep /generalize command,
the activation clock will automatically reset. You can bypass
resetting the activation clock by using the
setting in the Microsoft-Windows-Security-SPP component. This
enables you to run the Sysprep command multiple times
without resetting the activation clock. For more information about
this setting, see the Unattended Windows Setup
If you anticipate running the Sysprep command multiple
times on a single computer, you must use the
Before running the Sysprep command the final time before
deploying the computer, rearm the computer by setting the
You can review the number of times you can use the
SkipRearm setting by using the slmgr /dlv
command. For information, see Work with Product Keys
Volume License and OEM Activation Requirements
For volume licenses, activation clock reset behavior is different, depending on the type of license.
- Activation can be reset an unlimited number
of times for an activated Key Management Service (KMS) clients. For
non-activated KMS clients, the activation clock can be reset only
up to three times, the same as a single license.
We recommend that KMS clients use the sysprep /generalize command where the value of the SkipRearm setting is equal to 1. After capturing this image, use the sysprep /generalize command, where the value of the
SkipRearmsetting is equal to 0.
- For Multiple Activation Keys (MAK) clients,
the recommendation is to install the MAK immediately before running
Sysprep the last time, prior to delivering the computer to a
For OEM Activation licenses, activation is not required. OEM Activation is available only to royalty OEMs.
Detecting the number of activations remaining
You can check the activation clock to see how many times you can use the sysprep /generalize command. For information, see Prepare to Capture an Image for Deployment (Generalize).
Activating Windows Before Shipping to a Customer
Most customers can easily manage activation after receiving their computers. But if you prefer, you can activate the software on behalf of your customers, making it easier for them to start using their new computers. After activation is completed, most users will not need to activate their installation again.
To activate Windows for your customer, use the unique Product Key from the certificate of authenticity (COA) label that is affixed to the specific computer, and activate the computer on behalf of the end user. Run the sysprep /oobe command to prepare the computer for delivery to the customer.
You cannot make an image of an activated Windows installation and duplicate that image to another computer. If you do, Windows fails to recognize the activation and forces the end user to reactivate the installation manually.
Booting to Audit Mode or Windows Welcome
When Windows® 7 boots, there are two modes in which the computer will start:
- Windows Welcome
Windows Welcome, also called Machine out-of-box experience
(OOBE), is the first user experience and enables end users to
customize their Windows installation. End users can create user
accounts, read and accept the Microsoft® Software License Terms,
and choose their language and time zones.
By default, all Windows installations boot to Windows Welcome first.
The oobeSystem configuration pass runs immediately before Windows Welcome starts. For more information about this configuration pass, see oobeSystem Configuration Pass.
- Audit Mode. Audit mode enables OEMs
and corporations to add customizations to their Windows images.
Audit mode does not require settings in Windows Welcome to be
applied. By bypassing Windows Welcome, you can access the
desktop quicker and perform your customizations. You can add
additional device drivers, install applications, and test the
validity of the installation.
In audit mode, settings in an unattended answer file in the auditSystem and auditUser configuration passes are processed. For more information about these configuration passes, see auditSystem Configuration Pass and auditUser Configuration Pass.
If you are running a computer in audit mode to configure the installation to boot to Windows Welcome, run the sysprep /oobe command. OEMs are required to run the sysprep /oobe command before shipping a computer to an end user. In a default Windows installation, after installation completes, Windows Welcome starts. However, you can skip Windows Welcome and boot directly to audit mode by pressing Ctrl+Shift+F3 at the first Windows Welcome screen.
For unattended installation, you can configure Windows to boot to audit mode by using the Microsoft-Windows-Deployment |
Resealsetting in an answer file. For more information, see the Unattended Windows Setup Reference (Unattend.chm).
For more information about audit mode, see Customize Windows in Audit Mode.
Detecting the State of a Windows Image
You can identify the state of a Windows image, whether it will boot to audit mode, Windows Welcome, or if the image is still in the process of installation. For more information, see Windows Setup Installation Process.
Sysprep Log Files
The Sysprep tool logs Windows Setup actions in different directories, depending on the configuration pass. Because the generalize configuration pass deletes certain Windows Setup log files, the Sysprep tool logs generalize actions outside the standard Windows Setup log files. The following table shows the different log file locations that are used by Sysprep.
Unattended Windows Setup actions
Creating and Using Sysprep Providers
Software and hardware developers, including a company’s internal developers, Independent Software Vendors (ISVs), and Independent Hardware Vendors (IHVs), can create Sysprep providers that enable their applications to support imaging and deployment scenarios. If an application does not currently support generalize operations via the Sysprep tool, you can create a provider that will remove all software-specific and hardware-specific information from the application.
To create a Sysprep provider, you must:
- Determine which configuration phase (cleanup,
generalize, or specialize) your Sysprep provider
- Create the appropriate entry point for your Sysprep provider,
based on your choice of configuration phase.
- Register the Sysprep provider for use by the Sysprep tool.
- Test your Sysprep provider to validate that it functions
properly, reviewing the log files for warnings and errors.
For more information about Sysprep providers, see the Sysprep Provider Developer’s Guide for Windows 7