Sysprep (System Preparation Tool 3.14) Fatal error occurred

Question

I have cloned a Windows 2019 Standard Server (Virtual) to another Server, and attempting to run sysprep on the cloned machine returned a fatal error.

There is no antivirus installed.

No Bit locker installed.

No Windows Defender Firewall or Defender Antivirus (all Disabled).

I have ran sfc /scannow, and it returned no errors.

I have 1001 available rearm.

I do not have Windows Media Networking Server services or MDSTC running.

Below is the setupact.log output. I would really appreciate the help!!!

2024-01-31 10:59:50, Info SYSPRP ========================================================

2024-01-31 10:59:50, Info SYSPRP === Beginning of a new sysprep run ===

2024-01-31 10:59:50, Info SYSPRP ========================================================

2024-01-31 10:59:50, Info [0x0f004d] SYSPRP The time is now 2024-01-31 10:59:50

2024-01-31 10:59:50, Info [0x0f004e] SYSPRP Initialized SysPrep log at C:\Windows\system32\Sysprep\Panther

2024-01-31 10:59:50, Info [0x0f0054] SYSPRP ValidatePrivileges:User has required privileges to sysprep machine

2024-01-31 10:59:50, Info [0x0f007e] SYSPRP FCreateTagFile:Tag file C:\Windows\system32\Sysprep\Sysprep_succeeded.tag does not already exist, no need to delete anything

2024-01-31 10:59:50, Info [0x0f005f] SYSPRP ParseCommands:Found supported command line option 'RESPECIALIZE'

2024-01-31 10:59:50, Info [0x0f005f] SYSPRP ParseCommands:Found supported command line option 'QUIET'

2024-01-31 10:59:50, Info SYSPRP WinMain:Processing 're-specialize' internal provider request.

2024-01-31 10:59:50, Info SYSPRP RunExternalDlls:Running platform actions specified in action file for phase 6

2024-01-31 10:59:50, Info SYSPRP SysprepSession::CreateSession: Successfully created instance with action file C:\Windows\System32\Sysprep\ActionFiles\ReSpecialize.xml, and mode <null>

2024-01-31 10:59:50, Info SYSPRP SysprepSession::Execute: Beginning action execution from C:\Windows\System32\Sysprep\ActionFiles\ReSpecialize.xml

2024-01-31 10:59:50, Info SYSPRP SysprepSession::CreateXPathForSelection: Sysprep mode in registry is <null>

2024-01-31 10:59:50, Info SYSPRP SysprepSession::CreateXPathForSelection: Processor architecture in registry is AMD64

2024-01-31 10:59:50, Info SYSPRP After sorting, components will be excuted in the following order:

2024-01-31 10:59:50, Info SYSPRP Name: Microsoft-Windows-PnpSysprep, Order: 256

2024-01-31 10:59:50, Info SYSPRP ActionPlatform::LaunchModule: Executing method 'Sysprep_Respecialize_Pnp' from C:\Windows\System32\sppnp.dll

2024-01-31 10:59:50, Info SYSPRP SPPNP: Sysprep_Respecialize_Pnp: Enter

2024-01-31 10:59:50, Info SYSPRP SPPNP: Created progress thread.

2024-01-31 10:59:50, Info SYSPRP SPPNP: Creating device install status thread.

2024-01-31 10:59:50, Info SYSPRP SPPNP: Waiting for device install status thread to exit.

2024-01-31 10:59:50, Info SYSPRP SPPNP: Status: Starting...

2024-01-31 11:01:09, Info SYSPRP SPPNP: Status: Total = 0, Complete = 0, Progress = 0% (0%)

2024-01-31 11:01:09, Info SYSPRP SPPNP: Status worker: Waiting for device installation to start...

2024-01-31 11:01:10, Info SYSPRP SPPNP: Status: Idle

2024-01-31 11:01:10, Info SYSPRP SPPNP: Finished waiting for device install status.

2024-01-31 11:01:10, Info SYSPRP SPPNP: Progress thread exited.

2024-01-31 11:01:10, Info SYSPRP SPPNP: Sysprep_Respecialize_Pnp: Exit

2024-01-31 11:01:10, Info SYSPRP ActionPlatform::LaunchModule: Successfully executed 'Sysprep_Respecialize_Pnp' from C:\Windows\System32\sppnp.dll without error

2024-01-31 11:01:10, Info SYSPRP SysprepSession::Execute: Sysprep mode was not specified, deleting it from registry

2024-01-31 11:01:10, Info [0x0f0052] SYSPRP Shutting down SysPrep log

2024-01-31 11:01:10, Info [0x0f004d] SYSPRP The time is now 2024-01-31 11:01:10

2024-01-31 11:03:15, Info SYSPRP ========================================================

2024-01-31 11:03:15, Info SYSPRP === Beginning of a new sysprep run ===

2024-01-31 11:03:15, Info SYSPRP ========================================================

2024-01-31 11:03:15, Info [0x0f004d] SYSPRP The time is now 2024-01-31 11:03:15

2024-01-31 11:03:15, Info [0x0f004e] SYSPRP Initialized SysPrep log at C:\Windows\System32\Sysprep\Panther

2024-01-31 11:03:15, Info [0x0f0054] SYSPRP ValidatePrivileges:User has required privileges to sysprep machine

2024-01-31 11:03:15, Info [0x0f007e] SYSPRP FCreateTagFile:Tag file C:\Windows\System32\Sysprep\Sysprep_succeeded.tag does not already exist, no need to delete anything

2024-01-31 11:03:15, Info [0x0f003d] SYSPRP WinMain:Displaying dialog box for user to choose sysprep mode...

2024-01-31 11:03:18, Info [0x0f00d7] SYSPRP WinMain:Pre-validing 'cleanup' internal providers.

2024-01-31 11:03:18, Info SYSPRP RunExternalDlls:Running platform actions specified in action file for phase 3

2024-01-31 11:03:18, Info SYSPRP SysprepSession::CreateSession: Successfully created instance with action file C:\Windows\System32\Sysprep\ActionFiles\Cleanup.xml, and mode <null>

2024-01-31 11:03:18, Info SYSPRP SysprepSession::Validate: Beginning action execution from C:\Windows\System32\Sysprep\ActionFiles\Cleanup.xml

2024-01-31 11:03:18, Info SYSPRP SysprepSession::CreateXPathForSelection: Sysprep mode in registry is <null>

2024-01-31 11:03:18, Info SYSPRP SysprepSession::CreateXPathForSelection: Processor architecture in registry is AMD64

2024-01-31 11:03:18, Info SYSPRP ActionPlatform::LaunchModule: Executing method 'Sysprep_Clean_Validate_Opk' from C:\Windows\System32\spopk.dll

2024-01-31 11:03:18, Info SYSPRP ActionPlatform::LaunchModule: Successfully executed 'Sysprep_Clean_Validate_Opk' from C:\Windows\System32\spopk.dll without error

2024-01-31 11:03:18, Info [0x0f00d7] SYSPRP WinMain:Pre-validing 'generalize' internal providers.

2024-01-31 11:03:18, Info SYSPRP RunExternalDlls:Running platform actions specified in action file for phase 1

2024-01-31 11:03:18, Info SYSPRP SysprepSession::CreateSession: Successfully created instance with action file C:\Windows\System32\Sysprep\ActionFiles\Generalize.xml, and mode <null>

2024-01-31 11:03:18, Info SYSPRP SysprepSession::Validate: Beginning action execution from C:\Windows\System32\Sysprep\ActionFiles\Generalize.xml

2024-01-31 11:03:18, Info SYSPRP SysprepSession::CreateXPathForSelection: Sysprep mode in registry is <null>

2024-01-31 11:03:18, Info SYSPRP SysprepSession::CreateXPathForSelection: Processor architecture in registry is AMD64

2024-01-31 11:03:18, Info SYSPRP ActionPlatform::LaunchModule: Executing method 'SysprepGeneralizeValidate' from C:\Windows\System32\AppxSysprep.dll

2024-01-31 11:03:18, Info SYSPRP Entering SysprepGeneralizeValidate (Appx) - validating whether all apps are also provisioned.

2024-01-31 11:03:18, Info SYSPRP All appx packages were verified to be inbox or alluser installed.

2024-01-31 11:03:18, Info SYSPRP ActionPlatform::LaunchModule: Successfully executed 'SysprepGeneralizeValidate' from C:\Windows\System32\AppxSysprep.dll without error

2024-01-31 11:03:18, Info [0x0f004a] SYSPRP WaitThread:Entering spawned waiting thread

2024-01-31 11:03:18, Info SYSPRP SysprepSearchForUnattend: No unattend file was specified or located; skipping unattend generalize pass.

2024-01-31 11:03:18, Info [0x0f00ac] SYSPRP WinMain:Processing 'cleanup' external provider request.

2024-01-31 11:03:18, Info [0x0f006c] SYSPRP RunExternalDlls:Running DLLs listed in registry for phase 3

2024-01-31 11:03:18, Info [0x0f008a] SYSPRP RunRegistryDlls:Retrieved section name for this phase as Cleanup

2024-01-31 11:03:18, Warning [0x0f008f] SYSPRP RunRegistryDlls:Registry key is either empty or malformed: SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrepExternal\Cleanup

2024-01-31 11:03:18, Info [0x0f00ad] SYSPRP WinMain:Processing 'generalize' extrenal provider request.

2024-01-31 11:03:18, Info [0x0f006c] SYSPRP RunExternalDlls:Running DLLs listed in registry for phase 1

2024-01-31 11:03:18, Info [0x0f008a] SYSPRP RunRegistryDlls:Retrieved section name for this phase as Generalize

2024-01-31 11:03:18, Warning [0x0f008f] SYSPRP RunRegistryDlls:Registry key is either empty or malformed: SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrepExternal\Generalize

2024-01-31 11:03:18, Info [0x0f003f] SYSPRP WinMain:Processing 'cleanup' internal provider request.

2024-01-31 11:03:18, Info SYSPRP RunExternalDlls:Running platform actions specified in action file for phase 3

2024-01-31 11:03:18, Info SYSPRP SysprepSession::CreateSession: Successfully created instance with action file C:\Windows\System32\Sysprep\ActionFiles\Cleanup.xml, and mode <null>

2024-01-31 11:03:18, Info SYSPRP SysprepSession::Execute: Beginning action execution from C:\Windows\System32\Sysprep\ActionFiles\Cleanup.xml

2024-01-31 11:03:18, Info SYSPRP SysprepSession::CreateXPathForSelection: Sysprep mode in registry is <null>

2024-01-31 11:03:18, Info SYSPRP SysprepSession::CreateXPathForSelection: Processor architecture in registry is AMD64

2024-01-31 11:03:18, Info SYSPRP After sorting, components will be excuted in the following order:

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-Sysprep-SpOpk, Order: 256

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-SQMApi, Order: 768

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-EventLog, Order: 1024

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-LpkSetup, Order: 1280

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-SystemMaintenanceService-Core, Order: 1536

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-Shell-Setup, Order: 2304

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-ErrorReportingCore, Order: 2560

2024-01-31 11:03:18, Info SYSPRP Name: WindowsSearchEngine, Order: 2816

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-IE-Sysprep, Order: 3072

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-Sysprep-SpNet, Order: 3328

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-TaskScheduler-Service, Order: 3584

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-Cryptography, Order: 3840

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-UXInit, Order: 4096

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-COM-DTC-Runtime, Order: 4352

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-TapiSetup, Order: 4608

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-TabletPC-InputPersonalization, Order: 4864

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-UAL-Task, Order: 5120

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-Compat-GeneralTel, Order: 5376

2024-01-31 11:03:18, Info SYSPRP Name: Microsoft-Windows-DeviceCensus-Schedule-ClientServer, Order: 5632

2024-01-31 11:03:18, Info SYSPRP ActionPlatform::LaunchModule: Executing method 'Sysprep_Clean_Opk' from C:\Windows\System32\spopk.dll

2024-01-31 11:03:18, Info SYSPRP ActionPlatform::LaunchModule: Successfully executed 'Sysprep_Clean_Opk' from C:\Windows\System32\spopk.dll without error

2024-01-31 11:03:18, Info SYSPRP ActionPlatform::LaunchModule: Executing method 'SqmSysprepCleanup' from sqmapi.dll

2024-01-31 11:03:18, Info SYSPRP ActionPlatform::LaunchModule: Successfully executed 'SqmSysprepCleanup' from sqmapi.dll without error

2024-01-31 11:03:18, Info SYSPRP ActionPlatform::LaunchModule: Executing method 'EvtIntSysprepCleanup' from C:\Windows\System32\wevtapi.dll

2024-01-31 11:03:18, Error SYSPRP ActionPlatform::LaunchModule: Failure occurred while executing 'EvtIntSysprepCleanup' from C:\Windows\System32\wevtapi.dll; dwRet = 0x3[gle=0x00000003]

2024-01-31 11:03:18, Error SYSPRP SysprepSession::ExecuteAction: Failed during sysprepModule operation; dwRet = 0x3[gle=0x00000003]

2024-01-31 11:03:18, Error SYSPRP SysprepSession::ExecuteInternal: Error in executing action for Microsoft-Windows-EventLog; dwRet = 0x3[gle=0x00000003]

2024-01-31 11:03:18, Error SYSPRP SysprepSession::Execute: Error in executing actions from C:\Windows\System32\Sysprep\ActionFiles\Cleanup.xml; dwRet = 0x3

2024-01-31 11:03:18, Error SYSPRP RunPlatformActions:Failed while executing Sysprep session actions; dwRet = 0x3

2024-01-31 11:03:18, Error [0x0f0070] SYSPRP RunExternalDlls:An error occurred while running registry sysprep DLLs, halting sysprep execution. dwRet = 0x3

2024-01-31 11:03:18, Error [0x0f00a8] SYSPRP WinMain:Hit failure while processing sysprep cleanup providers; hr = 0x80070003

2024-01-31 11:03:20, Info [0x0f004c] SYSPRP WaitThread:Exiting spawned waiting thread

2024-01-31 11:03:20, Info [0x0f0052] SYSPRP Shutting down SysPrep log

2024-01-31 11:03:20, Info [0x0f004d] SYSPRP The time is now 2024-01-31 11:03:20

Answer 1

Hi Dale 76118,

based on the error message in the setupact.log file, it seems that the sysprep process failed due to an issue with the Microsoft-Windows-EventLog component. You can try the following steps to resolve the issue:

1. Open the Registry Editor by typing "regedit" in the Start menu search bar and pressing Enter.
2. Navigate to the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus
3. Change the value of the CleanupState DWORD from 2 to 7.
4. Save the changes and close the Registry Editor.
5. Try running the sysprep process again.

If the issue persists, you can try disabling the EventLog service before running sysprep. To do this, follow these steps:

1. Open the Services console by typing "services.msc" in the Start menu search bar and pressing Enter.
2. Locate the EventLog service and double-click on it.
3. Change the Startup type to "Disabled" and click on the "Stop" button to stop the service.
4. Save the changes and close the Services console.
5. Try running the sysprep process again.

Note that disabling the EventLog service may cause some applications to stop working properly, so it is recommended to re-enable the service after running sysprep.

Hope it helps.

Best regards,

Lei

Answer 2

Hello Lei,

Your response was very helpful. Thank you very much getting back with me.

Changing the registry CleanupState value didn’t help, and there is not an EventLog Service for Win2019…However, I found that I can disable it in the registry by following this article.... https://www.thewindowsclub.com/how-to-disable-windows-event-log

I disabled the EventLog via the registry and rebooted the server.  After the server booted up, I ran sysprep and got the same errors.  Sysprep still failed, but your comments about the EventLogs got me thinking… We are redirecting the Event Logs via GPO to a persistent drive because the clones would be non-persistent.  So, I moved the Server into another OU that puts the EventLogs back from D:\ to %SystemPoot%.  Sysprep ran successfully.

That was it. We were redirecting the Event Logs and that was the cause. Thank you very much for the hint that the error was caused by the Microsoft-Windows-EventLog component.