Windows 11 22H2 Issues in Audit Mode After Generalize

Question

Windows 11 22H2 Issues in Audit Mode After Generalize

Justin Fontenot 11

In Win 11 22H2, if we use Sysprep to reseal to Audit Mode and choose the Generalize option, after the reseal, we encounter multiple Store App related error messages. The system is not connected to the internet and no apps have been installed. These errors appear to be related to built-in apps, like Cortana and Notepad. Also, script files will not run. We have several .bat scripts that are set to run upon first boot into Audit that no longer trigger and cannot even be manually run.

If you then reseal to OOBE, the new user does not have these issues. No app errors, and scripts run fine.

Also, if you reseal to Audit without the Generalize option, the only app that has error on boot is Cortana, but it is a different error and resolves itself after a reboot. Our scripts run without issue.

This was not an issue in the previous image based on Windows 11 Version 10.0.22000 (22000.318).

It appears that Generalize is removing all appx apps from the Administrator account (which is probably intended), but it is not restoring them when returning to Audit mode, causing a ton of issues.

All of this means that we cannot Generalize our 22H2 gold image, as we have scripts that must run when booting into Audit Mode. Note that we have been using this process since Windows 7.

A workaround might be to not Generalize the gold image and instead Generalize when we reseal to OOBE with a "persist devices" setting in an unattend, but that switch-over is going to require a lot of testing to ensure it behaves correctly. I would rather not upend our entire process.

Has anyone else tried Sysprep to Audit with the Generalize option in 22H2? Is this a known issue or intended behavior?

Justin Fontenot 11 Reputation points

2022-12-16T17:13:38.367+00:00

I have confirmed this is an issue on multiple 22H2 builds.

I have also downloaded the newest 21H2 build (22000.1219), and it has a completely different issue on that build. If I Generalize to Audit in 21H2, the UI reverts to the Windows 10 taskbar! However, it is not functional, as Start will not open. File Explorer also does not work. Once again, if I reseal to OOBE, the new user has no issues. Audit Mode appears to have been broken for some time.

I was hopeful that I could at least jump to a newer version of Win 11 21H2, but that is not even an option now.

Is it that no one is using Win 11 in enterprise environments, so these issues have gone unnoticed? I would think OEMs would be screaming about this.

Or, am I missing a step that must be done before Generalizing? Some new procedure with Win 11 that I have not read about?
Justin Fontenot 11 Reputation points

2022-12-22T16:32:34.817+00:00

I found some training on Windows 11 imaging for 21H1, and while the process is essentially the same as Windows 10, I found in the example scripts a PowerShell script that re-registers "StartMenuExperienceHost". The example Sysprep script adds this PowerShell script to the RunOnce registry key right before it runs Sysprep /Audit /Generalize.
This confirms that the "Windows 10 Start Menu" issue I saw when generalizing 21H2 is a known issue.

So, good news / bad news, the Windows 10 Start Menu issue looks to have been fixed in 22H2 (StartMenuExperienceHost workaround not needed), but I have not been able to find workarounds for these new 22H2 issues.
I have noted that once I click OK on the Cortana error in 22H2, Startup scripts do actually proceed to run. So, perhaps I can disable Cortana using a similar RunOnce script. And, maybe since they did fix the StartMenuExperienceHost issue, they may eventually fix this Cortana / Notepad issue as well.
Leonardo Santana 0 Reputation points

2023-02-10T15:12:23.1433333+00:00

Did you manage to solve the problem?
Justin Fontenot 0 Reputation points

2023-02-13T22:58:59.9266667+00:00

No, unfortunately. We had to re-work the way we create our images. Previously, we would install Windows using an autounattend.xml with settings to boot into Audit. We would boot into Audit, apply updates, change settings, etc., then run sysprep /generalize /audit to create our factory image. Since that no longer works, we now capture the image before its first boot (immediately after the Windows Setup reboot) and apply updates and settings using a combination of DISM and manipulating the C:\Windows\Panther\unattend.xml in the image. It is working, but not happy that we had to rework our process with no clear answer as to why the Generalize behavior was changed.
Ann Lai 0 Reputation points

2023-05-19T08:32:48.1366667+00:00

Dear Justin,

Not sure if you met this critical error as screenshot below.

If you also met same problem as we did, would you please kindly share how you fix this problem with us.

Thank you.