What is Sysprep?

The System Preparation (Sysprep) tool prepares an installation of Windows for duplication, auditing, and customer delivery. Duplication, also called imaging, enables you to capture a customized Windows image that you can reuse throughout an organization. Audit mode enables you to add additional device drivers or applications to a Windows installation. After you install the additional drivers and applications, you can test the integrity of the Windows installation. Sysprep also enables you to prepare an image to be delivered to a customer. When the customer boots Windows, Windows Welcome starts.

Sysprep must be used only to configure new installations of Windows. You can run Sysprep as many times as required to build and to configure your installation of Windows. However, you can reset Windows activation only up to three times. You must not use Sysprep to reconfigure an existing installation of Windows that has already been deployed. Use Sysprep only to configure new installations of Windows.

If you intend to transfer a Windows image to a different computer, you must run sysprep /generalize, even if the computer has the same hardware configuration. The sysprep /generalize command removes unique information from your Windows installation, which enables you to reuse that image on different computers. The next time you boot the Windows image, the specialize configuration pass runs. During this configuration pass, many components have actions that must be processed when you boot a Windows image on a new computer. Any method of moving a Windows image to a new computer, either through imaging, hard disk duplication, or other method, must be prepared with the sysprep /generalize command. Moving or copying a Windows image to a different computer without running sysprep /generalize is not supported.

This topic includes:

• Benefits of Sysprep
• Common Sysprep scenarios
• Limitations of Sysprep
• Dependencies of Sysprep
• Technologies related to Sysprep
• Related information

Benefits of Sysprep

Sysprep provides the following benefits:

• Removes system-specific data from Windows. Sysprep can remove all system-specific information from an installed Windows image, including the computer security identifier (SID). The Windows installation can then be captured and installed throughout an organization.
• Configures Windows to boot to Audit mode. Audit mode enables you to install third-party applications and device drivers, as well as to test the functionality of the computer.
• Configures Windows to boot to Windows Welcome. Configures a Windows installation to boot to Windows Welcome the next time the computer starts. In general, you configure a system to boot to Windows Welcome immediately before delivering the computer to a customer.
• Resets Windows Product Activation. Sysprep can reset Windows Product Activation up to three times.

Common Sysprep Scenarios

Sysprep is commonly used in the following scenarios:

Creating a Build-to-Plan (BTP) Windows Image

In the build-to-plan (BTP) scenario, you create a single Windows reference image to install computers that use the same hardware configuration. You customize the single Windows reference installation by installing Windows and then adding additional drivers and applications. You then capture the Windows image and use it to install your computers. No additional modifications are made to this image.

This scenario comprises the following stages:

1. You install Windows on a reference computer.
2. After the installation is complete, you boot the computer and install any additional device drivers or applications.
3. After you update the Windows installation, you run the sysprep /oobe /generalize command. The /generalize option instructs Sysprep to remove system-specific data from the Windows installation. System-specific information includes event logs, unique security IDs (SIDs), and other unique information. After the unique system information is removed, the computer shuts down. The /oobe option instructs the Windows installation to run Windows Welcome the next time the computer boots.
4. After the computer shuts down, you can boot to Windows PE or another operating system on the computer.
5. You then capture the Windows installation with ImageX, by creating a reference image with which to install computers with the same hardware configuration.

Creating a Build-to-Order (BTO) Windows Image

In the build-to-order (BTO) scenario, you start with a Windows reference image. After installing this reference image, you make additional updates to the Windows installations that are unique for the computer that you are installing. In general, these are customer-requested applications or updates. By booting to Audit mode, you can install additional devices and applications specific to that computer.

The difference between the build-to-plan scenario and the build-to-order scenario is that you make additional changes to the Windows reference installations that are unique to the computer.

This scenario includes the following stages:

1. You start with a Windows reference image that applies to all computers in your organization.
2. Install the Windows reference image to the computer that must be delivered to a customer.
3. After installation is complete, you run the sysprep /audit /generalize /shutdown command to configure Windows to boot the computer to Audit mode. You can then capture the Windows image by booting to another partition or by using Windows PE.
   This image then becomes your reference image that you can save to install computers of the same configuration.
4. Use the new reference image to install a new computer. The Windows image is applied to the computer, and Windows boots to Audit mode.
5. You can install additional applications and other updates based on a customer's order. You can also test the computer to verify that all components are working properly.

6. After you update the Windows installation, you run the sysprep /oobe /shutdown command.
7. Package the computer and deliver it to the customer.
8. The next time the computer starts, Windows Welcome runs.

Booting to Audit Mode

Audit mode enables OEMs and corporations to quickly customize a Windows installation. In Audit mode, you can install applications, add device drivers, run scripts, and test the validity of a Windows installation. Audit mode does not require settings in Windows Welcome to be applied.

Typically, Windows starts Windows Welcome immediately after installation. However, by booting to Audit mode, you can bypass Windows Welcome and boot the computer immediately to the desktop. This enables you to start your customization process as quickly as possible.

Also, Audit mode enables you to verify that a computer is functional before it is delivered to a customer. You can verify that the end user's first boot experience runs as expected, and OEM customizations and information about your company's support options are present.

There are several ways to boot to Audit mode:

• For an attended installation, at the Windows Welcome screen, press CTRL+SHIFT+F3.
• In an unattended installation, add the Microsoft-Windows-Deployment component to the oobeSystem configuration pass. In the Reseal | Mode setting, specify Audit. When Windows completes installation, the computer will reboot to audit mode. For more information about this setting, see the Unattended Windows Setup Reference.
• Run sysprep /audit in a Command Prompt window.

For more information about Audit mode, see Customize Windows in Audit Mode.

After you make configurations to the Windows installation, you can prepare that computer for delivery to a customer by running the sysprep /oobe command. The /oobe option instructs Windows to run Windows Welcome the next time the computer boots.

Limitations of Sysprep

Sysprep has the following limitations:

• You must use only the version of Sysprep that is installed with the Windows image that you intend to configure. Sysprep is installed with every version of Windows and must always be run from the %WINDIR%\system32\sysprep directory.
• Sysprep must not be used on upgrade installation types. Run Sysprep only on clean installations.
• If you plan to use the imagex /apply command to apply a Windows image to a computer, the partition layout on the reference and destination computers must be identical. For example, if you capture a customized Windows image on drive D, you must always deploy that image onto drive D of the destination computer. The following list describes the partition settings that must be identical across the reference and destination computers when you use the imagex /apply command.
  • The partition number where Windows Vista is installed must match.
  • The partition type (primary, extended, or logical) must match.
  • If the partition is set to active on the reference computer, the destination computer must also be set to active.
  • If you have another active partition for Bootmgr and BCD stores on the reference system, you must also capture this partition and apply it to the same partition on the destination computer.
    This limitation applies only to the imagex /apply command. If you run Setup and reinstall Windows, you can change the drive letters where Windows is installed.

The recommended practice is, if you are installing customized applications, to deploy your Windows image to the same drive letter.  

• When you copy Windows images between computers, the reference and destination computers do not need to have compatible hardware abstraction layers (HALs). The /detecthal option in the Boot Configuration Data (BCD) will enable a system that has already run Sysprep to install the correct HAL.
• The Plug and Play devices on the reference and destination computers, such as modems, sound cards, network adapters, and video cards, do not have to be from the same manufacturer. However, the drivers for these devices must be included in the installation.
• You cannot automate the running of Sysprep by using a RunSynchronous command in auditUser configuration pass. You can automate the running of Sysprep only by using a FirstLogonCommand in the oobeSystem pass.
• The clock for activation begins its countdown the first time Windows starts. You can use Sysprep for a maximum of three times to reset the clock for Windows Product Activation. After the third time you run Sysprep, the clock can no longer be reset.
• ImageX, third-party disk-imaging software, or disk-duplicating hardware devices are required for image-based Setup. These products create binary images of a computer's hard disk and either duplicates the image to another hard disk or stores the image in a file on a separate disk.
• Sysprep runs only if the computer is a member of a workgroup, not a domain. If the computer is joined to a domain, Sysprep removes the computer from the domain.
• If you run Sysprep on an NTFS file system partition that contains encrypted files or folders, the data in those folders becomes completely unreadable and unrecoverable.
• Sysprep converts the %COMPUTERNAME% environment variable to uppercase characters. However, the actual name of the computer does not change.
• Running Sysprep will cause Windows Welcome to prompt you for a product key. You can use an answer file with Sysprep to prevent Windows Welcome from prompting you for a product key. If you specify a valid product key in the ProductKey setting of the Microsoft-Windows-Shell-Setup component during the specialize pass, then Windows Welcome will not prompt you for a product key.

Dependencies of Sysprep

Sysprep has the following dependencies:

• Sysprep is used after running Windows Setup.
• You need an imaging tool, like ImageX, to capture an image of the installation.

Technologies Related to Sysprep

The following technologies are related to Sysprep:

ImageX

ImageX is a command-line tool that enables original equipment manufacturers (OEMs) and corporations to capture, modify, and apply Windows images for rapid deployment. ImageX works with Windows image (.wim) files to copy directly to a destination computer, or it can work with other technologies that use the .wim files. Corporations that do not require the capture functionality or the low-level features included in ImageX can still use related technologies such as unattended installation, Group Policy, and Systems Management Server (SMS).

Windows Software Protection Platform (SPP)

Windows Software Protection Platform (SPP) reduces Windows piracy by ensuring compliance with the Microsoft Software License Terms. In previous Windows versions, this was known as Windows Product Activation (WPA). During product activation, the product key is matched with the individual computer on which the software is installed. It does this by validating the product key, and checks that it has not been used with more than the licensed number of computers.

Windows Setup

Windows Setup is the program that installs Windows or upgrades previous versions of Windows.

Unattended Windows Setup Answer File

The unattended Windows Setup answer file, typically called Unattend.xml, is the answer file for Windows Setup that is created by using Windows System Image Manager (Windows SIM). The answer file enables the configuration of default Windows settings, as well as the addition of drivers, software updates, and other applications. The answer file enables OEMs and corporations to customize Windows Setup tasks, for example, specifying disk configuration, changing the default values for Internet Explorer, and installing additional drivers.

Windows System Image Manager

Windows System Image Manager (Windows SIM) provides you with the ability to customize Windows images. Windows SIM enables you to customize the settings in a Windows image. Based on your configurations, you can create an unattended Windows Setup answer file, typically called Unattend.xml. This answer file is used during Windows Setup to apply your configurations to Windows. In the answer file, you can specify changes to default operating system components and add additional software, such as out-of-box drivers or product updates.

See Also

Concepts

How Sysprep Works
Sysprep Command-Line Syntax