Identifying unique Windows installation

Question

Hi,

I received an image and after deployment, I can see that the Operating System is in OOBE.

However, I am not sure if the images were "generalized" with "Sysprep" or not. Is it possible to check somehow? I have checked this so far:

MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
Each time I install the image (on the same hardware) I receive a different value, which is good.

Based on the above MachineGuid, can I infer that image is generalized before capturing?

Or what are other ways to determine that installation should not have SID or GUID issues etc.

Answer 1

Hello, Yes, the MachineGUID value changing with each installation is a good indicator that Sysprep was run with the /generalize option. When the /generalize option is used, Sysprep removes system-specific data from the Windows installations, which includes resetting the MachineGUID. Here are some other things you can check: Sysprep Logs: Sysprep creates a log file (setupact.log) that you can check to see if Sysprep was run and completed successfully. The log file is located in the %WINDIR%\System32\Sysprep\Panther directory. According to your description that seems not found this log. Try to enable hidden file option. Registry Key: Check the registry key HKEY_LOCAL_MACHINE\System\Setup. If Sysprep was run with /generalize, the value of the “CleanupState” should be 2, and the value of “GeneralizationState” should be 7. Best Regards, Hania Lian

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hello, you can try the following. Hope it helps.

1. Check if sysprep files are present. C:\Windows\System32\Sysprep.
2. If so, examine the Windows Setup logs, particularly the setupact.log and setuperr.log files located in C:\Windows\Panther. These logs may contain information about the Sysprep process.
3. Check for the presence of a cloned system. If you suspect that an image may not have been generalized, you can try deploying it to a new virtual machine or hardware and observe its behavior. If it's not generalized, you may encounter issues related to duplicate SIDs (Security Identifiers) or other unique system identifiers.