sysprep /generalize fails due to appx package Microsoft.SecHealthUI, but it cannot be removed (24H2).

Question

sysprep /generalize fails due to appx package Microsoft.SecHealthUI, but it cannot be removed (24H2).

Keith Blackwell 16

I'm nearing final steps in updating a customized (OEM) production Windows 11 Pro image (for a Lenovo V14g4), upgrading from 22H2 to 24H2, and have had to work through many, many issues (more than ever before for past versions of Windows). But I've gotten through them all, up to this one. I'm in Audit mode with default Administrator user, trying to generalize (after which I plan to update the USMT.ppkg with scanstate and then switch to WinPE to make a few last-second edits on the offline image before capturing it with DISM). I've already done this earlier, made a few updates and appended to the image (up to index 4 now), so I was certainly able to generalize then; but recently I had to go back into Audit mode to install newer versions of device drivers (National Instruments). Almost there! But this problem has me stuck.

Normally, when sysprep /generalize fails for an app package, complaining that it "was installed for a user, but not provisioned for all users", all you have to do is Remove-AppxPackage (in powershell) for that package -- several iterations of that, and then you're good to go. I even have a script to speed up that process. But this is a package that cannot be removed, period. So it seems that maybe the left hand doesn't know what the right hand is doing, or something. I mean, what in the world is sysprep even trying to do here, and why? It says "Failed to remove apps for the current user", but, uh, generally speaking, it doesn't remove any apps, anyway, does it?

I've sought answers online, and found nothing for this specific issue. Here is a console summary:

C:\Windows\System32\Sysprep>sysprep /oobe /generalize /quit /unattend:E:\AnswerFiles\unattendGeneralizeOnly.xml 
C:\Windows\System32\Sysprep>type Panther\setuperr.log 
2025-05-09 14:21:49, Error                 SYSPRP Package Microsoft.SecHealthUI_1000.27777.1008.0_x64__8wekyb3d8bbwe was installed for a user, but not provisioned for all users. This package will not function properly in the sysprep image.
2025-05-09 14:21:49, Error                 SYSPRP Failed to remove apps for the current user: 0x80073cf2.                
2025-05-09 14:21:49, Error                 SYSPRP Exit code of RemoveAllApps thread was 0x3cf2.
2025-05-09 14:21:49, Error                 SYSPRP ActionPlatform::LaunchModule: Failure occurred while executing 'SysprepGeneralizeValidate' from C:\Windows\System32\AppxSysprep.dll; dwRet = 0x3cf2 
2025-05-09 14:21:49, Error                 SYSPRP SysprepSession::Validate: Error in validating actions from C:\Windows\System32\Sysprep\ActionFiles\Generalize.xml; dwRet = 0x3cf2 
2025-05-09 14:21:49, Error                 SYSPRP RunPlatformActions:Failed while validating Sysprep session actions; dwRet = 0x3cf2 
2025-05-09 14:21:49, Error      [0x0f0070] SYSPRP RunDlls:An error occurred while running registry sysprep DLLs, halting sysprep execution. dwRet = 0x3cf2 
2025-05-09 14:21:49, Error      [0x0f00d8] SYSPRP WinMain:Hit failure while pre-validate sysprep generalize internal providers; hr = 0x80073cf2   
C:\Windows\System32\Sysprep>powershell 
Windows PowerShell 
Copyright (C) Microsoft Corporation. All rights reserved. 
Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows 
PS C:\Windows\System32\Sysprep> Remove-AppxPackage -Package 'Microsoft.SecHealthUI_1000.27777.1008.0_x64__8wekyb3d8bbwe' 
Remove-AppxPackage : Deployment failed with HRESULT: 0x80073CFA, Removal failed. Please contact your software vendor. 
(Exception from HRESULT: 0x80073CFA) 
error 0x80070032: AppX Deployment Remove operation on package Microsoft.SecHealthUI_1000.27777.1008.0_x64__8wekyb3d8bbwe from: C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.27777.1008.0_x64__8wekyb3d8bbwe failed. This app is part of Windows and cannot be uninstalled on a per-user basis. An administrator can attempt to remove the app from the computer using Turn Windows Features on or off. However, it may not be possible to uninstall the app. 
NOTE: For additional information, look for [ActivityId] c1198cb3-c10c-0000-4588-1ac10cc1db01 in the Event Log or use the command line Get-AppPackageLog -ActivityID c1198cb3-c10c-0000-4588-1ac10cc1db01 
At line:1 char:1  
+ Remove-AppxPackage -Package 'Microsoft.SecHealthUI_1000.27777.1008.0_ ...  
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~       
    + CategoryInfo          : WriteError: (Microsoft.SecHe...__8wekyb3d8bbwe:String) [Remove-AppxPackage], IOException      
    + FullyQualifiedErrorId : DeploymentError,Microsoft.Windows.Appx.PackageManager.Commands.RemoveAppxPackageCommand

In case you're wondering, the E:\AnswerFiles\unattendGeneralizeOnly.xml just basically turns on PersistAllDeviceInstalls and DoNotCleanUpNonPresentDevices (in the 'Microsoft-Windows-PnpSysprep' component), and addresses only the 'generalize' pass.

So how do I proceed to generalizing?

Mike OConnor 31 Reputation points

2025-05-14T10:04:13.1633333+00:00

I have this exact same issue at the minute chief. I am interested to see what Microsoft have to say on the matter and what the resolution is.

2 answers

Your answer

Mike OConnor 31 Reputation points

2025-05-14T10:04:13.1633333+00:00

I have this exact same issue at the minute chief. I am interested to see what Microsoft have to say on the matter and what the resolution is.

Answer 1

Giuseppe Pacetti 0 Microsoft Employee

PS C:\temp> Remove-AppxProvisionedPackage -online -allusers -PackageName Microsoft.SecHealthUI_1000.27777.1008.0_x64__8wekyb3d8bbwe

Remove-AppxProvisionedPackage : Removal failed. Please contact your software vendor.

At line:1 char:1

Remove-AppxProvisionedPackage -online -allusers -PackageName Microsof ...


    + CategoryInfo          : NotSpecified: (:) [Remove-AppxProvisionedPackage], COMException

    + FullyQualifiedErrorId : Microsoft.Dism.Commands.RemoveAppxProvisionedPackageCommand

0 comments

Answer 2

Beatrix 2,290 Independent Advisor

Hi Keith,

I've reviewed the sysprep logs, in this scenario, please use this command instead, because it's a provisioned package:

Remove-AppxProvisionedPackage -online -allusers -PackageName Microsoft.SecHealthUI_1000.27777.1008.0_x64__8wekyb3d8bbwe

Just a side note, you will probably have to do this several times before sysprep will run, give it a go and let me know how it went.

Keith Blackwell 16 Reputation points

2025-05-20T21:00:21.5466667+00:00

Thanks for trying to help out! As it turns out, I had already run scripts that attempt to remove various things, which I had developed for Windows 10. One goes through to remove user appx packages, and another walks through a limited set of provisioned appx packages to remove them also. I couldn't readily figure out the exact invocation needed to remove that one appx provisioned package since that command does not take the same arguments as the other one. Eventually I just ran through all provisioned packages and removed them. Well, now, that was probably, almost certainly, a mistake. Some of that stuff is probably pretty important to have, right?

So once I realized that, I decided I had to go back to my previous image, re-install it, and re-perform all the same customizations I had previously performed, installing a NI DAQmx driver, making various additional mods to the File Explorer options and settings, making a few more tweaks to the user settings (Administrator, which would get copied to DEFAULT user during a later specialization step on each future install), etc. That took pretty much most of my day today. But then, when I finally came to the point of being all ready to run sysprep /generalize, I decided to do it without removing any appx packages at all, to begin with. I wanted to see exactly what errors I might run into.

To my surprise, the generalize worked.

No errors. No need to remove any user appx packages. No need to mess with any provisioned appx packages. I am a bit flummoxed. I have no idea why it worked. Theoretically, I should be at basically the same place I had been previously, when the sysprep failed. But maybe I pre-emptively ran the script to remove appx packages last time, and this time I didn't. Perhaps that was the difference. Perhaps Windows 11 has gotten smarter about this, and now you don't have to play these silly games with removing appx packages just to get generalization to work? I don't know.

Unfortunately, it may now be impossible to figure out how I could have gotten around the problem I faced. Perhaps someone else can learn something from this, however. I am highly suspicious that I might have ended up getting this error after trying to remove some provisioned appx packages, perhaps ones that really should not be removed.
Keith Blackwell 16 Reputation points

2025-05-20T21:14:23.8166667+00:00

Oh, and another thing that was different here on this round versus before, was that previously, I had the setup process (after install, first boot) use a "run once" script that was really built for OOBE, and I mistakenly thought it would not run in Audit mode. But you set up the command in the answer file for the oobeSystem stage, which actually happens first before the "resealMode" being set to "Audit" is noticed in order to switch over to Audit mode. Consequently, some things that the script did, which were intended for first boot in OOBE but not desirable in Audit, had happened anyway in Audit mode.

Some of what it did: create a different user (which will get shipped with the product) and then de-activate the Administrator user, and arrange for the same script to run again when that new user logs in (also makes sure the default login choice will be that new user). But when the script runs, it looks to see who it is running as. When it runs as that second, non-Administrator user, it also removes the Administrator profile, which by that time has already been copied over to the DEFAULT user (well, the parts that get copied, anyway).

Well, on my previous round, this caused me quite a few headaches. In the end, I was back in Audit mode as Administrator with the ultimate target user removed again. And that's where I tried to run sysprep. But who knows what that might have done that might have inadvertently caused me to run into this error? This time around, I fixed the script to notice the registry entry for Audit mode (reg query HKLM\SYSTEM\Setup\Status /v AuditBoot | findstr 0x1 && goto AuditMode), and in that case, it simply echoes a helpful message and does "EXIT /B 0" and ends up being a no-op now. Thus, the environment had never gotten that temporary user added.

I don't know if that has any bearing, but just in case, I figure it might be helpful to someone else who runs into this.
Jérôme Godbout 0 Reputation points

2025-06-30T20:31:25.1166667+00:00

The command failed to remove the package and say to contact software vendor... How can one capture an image of Windows 11-IoT-Enterprise with generalize sysprep? The LTSC seems to get ride of all the UWP non sense but It doesn't suite everyone. Anybody manage to do it? I really did download the Windows from the microsoft website and install it without any modification except install notepad++ for a test. It cannot sysprep inot the audit mode (OOBE was never completed). That sysprep generalize is such a huge pain.