Boot Windows to Audit mode or OOBE

Article
10/20/2021

You can use Audit mode to customize your computer, add applications and device drivers, and test your computer in a Windows environment.

Booting to audit mode starts the computer in the built-in administrator account, which is then automatically removed during the generalize configuration pass.
After you configure a computer to boot to audit mode, the computer will continue to boot to audit mode by default until you configure the computer to boot to Out-Of-Box Experience (OOBE).

Note

If a password-protected screen saver starts when you are in audit mode, you cannot log back on to the system. The built-in administrator account that is used to log on to audit mode is immediately disabled after logon. To disable the screen saver, either change the power plan through Windows Control Panel or configure and deploy a custom plan. For more information, see Create a Custom Power Plan.

Boot to audit mode automatically on a new installation

To configure Windows to boot to audit mode, add the Microsoft-Windows-Deployment | Reseal | Mode = audit answer file setting.

When Windows completes the installation process, the computer boots into audit mode automatically, and the System Preparation (Sysprep) Tool appears. For more information about using the Sysprep tool in audit mode, see Sysprep (Generalize) a Windows installation.

Note

Settings in an answer file from the oobeSystem configuration pass do not appear in audit mode. For more information about which answer file settings are processed when you boot to audit mode or OOBE, see How Configuration Passes Work.

Boot manually into audit mode (on a new or existing installation)

At the OOBE screen, press CTRL+SHIFT+F3.

Windows reboots the computer into audit mode, and the System Preparation (Sysprep) Tool appears.

Note

The CTRL+SHIFT+F3 keyboard shortcut doesn't bypass all parts of the OOBE process, such as running scripts and applying answer file settings in the oobeSystem configuration pass.

Boot to OOBE automatically on a new installation

To configure Windows to boot to OOBE, add the Microsoft-Windows-Deployment | Reseal | Mode = oobe answer file setting.

If you have configured your Windows image to boot to OOBE, but then you need to make further configurations to your image in audit mode, see Modify an existing image that is configured to boot to OOBE.

Enter Audit mode on an image that's configured to boot to OOBE

If you've configured your Windows image to boot to OOBE, but then need to make further configurations to your image in audit mode, you can do one of the following:

Use the CTRL+SHIFT+F3 keyboard shortcut. The computer will reboot into audit mode.

This option may trigger any scripts that you have configured to launch in OOBE.

-or-
Mount the image, add an answer file with the audit setting, and save it as C:\test\offline\Windows\Panther\Unattend\Unattend.xml. This may require overwriting an existing answer file at this location.

On the next boot, Windows will boot directly into audit mode.

Boot to audit mode automatically from an existing image

Create a new answer file, and then add the [Microsoft-Windows-Deployment | Reseal | Mode = audit]](/windows-hardware/customize/desktop/unattend/microsoft-windows-deployment-reseal-mode) setting. Save the answer file as Unattend.xml.
At an elevated command prompt, mount the Windows image. For example:
```
Dism /Mount-Image /ImageFile:C:\test\images\MyImage.wim /index:<image_index> /MountDir:C:\test\offline
```
where <image_index> is the number of the selected image on the .wim file.
Copy the new answer file to the C:\test\offline\Windows\Panther\Unattend folder.
Commit the changes, and then unmount the image. For example:
```
Dism /Unmount-Image /MountDir:C:\test\offline /commit
```
When the image is applied to the destination computer and Windows is booted, the computer boots into audit mode automatically, and the Sysprep tool appears. For sample procedures, see Step 1: Transfer an image to a different computer and Step 2: Prepare the computer for a customer in Deployment examples.

Options for applying an image also include using answer file settings, such as specifying the image to install and the disk configurations to make on the destination computer. For more information, see the Unattended Windows Setup Reference Guide.

Deployment examples

To transfer an image to a different computer, you must first remove the computer-specific information from the configured computer by generalizing the image with the Sysprep tool. To prepare a computer for the customer, you must generalize the computer, and then set it to boot to OOBE when a customer starts the computer for the first time. In the following examples we create and transfer a reference image to a different computer, and then create a model-specific image that ships to a customer.

Step 1: Transfer an image to a different computer

Install Windows on a reference computer.
After the installation is complete, boot the computer and install any additional device drivers or applications.
After you update the Windows installation, run Sysprep:
- At the command line, run the Sysprep /generalize /shutdown command.
  
  -or-
- In the System Preparation Tool window, select the Generalize check box under the System Cleanup Action box on the Shutdown Options box, select Shutdown, and then click OK.
Sysprep removes system-specific data from the Windows installation. System-specific information includes event logs, unique security IDs (SIDs), and other unique information. After Sysprep removes the unique system information, the computer shuts down.
After the computer shuts down, insert the Windows PE USB flash drive or other bootable media, and reboot into Windows PE.
In the Windows PE session, capture the reference image by using the Dism /capture-image command.
Proceed to the next step to create a model-specific reference image.

Step 2: Prepare the computer for a customer

Install the reference image you created in Step 1 that is destined for your customer.
After you update the Windows installation, at the command line run the Sysprep /audit /generalize /shutdown command to configure Windows to boot the computer to audit mode. You can then capture the Windows image by booting to another partition or by using Windows PE.
Use the new model-specific reference image to install Windows on a new computer. The Windows image is applied to the computer, and Windows boots to audit mode.
(Optional) You can install additional applications and other updates based on a customer's order. You can also test the computer to verify that all components are working correctly.
After you update the Windows installation, run the Sysprep /oobe /shutdown command.

Note

If you install Windows images by using the Sysprep /generalize /oobe command, the user experience will not be ideal. On the next reboot after you run the Sysprep /generalize /oobe command, Windows runs the specialize configuration pass, Plug and Play, and other Setup tasks before Windows starts OOBE. This process can take additional time and can delay a customer's first logon.
Package and deliver the computer to your customer.

When the customer starts the computer, OOBE runs.