Sysprep process overview

Article
10/12/2021

The System Preparation (Sysprep) tool is used to change Windows images from a generalized state to a specialized state, and then back to a generalized state. A generalized image can be deployed on any computer. A specialized image is targeted to a specific computer. You must reseal, or generalize, a Windows image before you capture and deploy the image. For example, when you use the Sysprep tool to generalize an image, Sysprep removes all system-specific information and resets the computer. The next time that the computer restarts, your customers can add user-specific information through Out-Of-Box Experience (OOBE) and accept the Microsoft Software License Terms.

If you transfer a Windows image to a different computer, you must run the Sysprep command together with the /generalize option, even if the other computer has the same hardware configuration. The Sysprep /generalize command removes unique information from your Windows installation so that you can reuse that image on a different computer. For more information, see Sysprep (Generalize) a Windows installation.

Sysprep executable

Sysprep.exe is the main program that calls other executable files that prepare the Windows installation. Sysprep.exe is located in the %WINDIR%\system32\sysprep directory on all Windows installations.

To use the command line instead of the System Preparation Tool GUI, you must first close the GUI and then run %WINDIR\System32\Sysprep\Sysprep.exe.

Important

The Sysprep user interface is deprecated. The Sysprep UI will continue to be supported, but it may be removed in a future release. Update your Windows deployment workflow to use the Sysprep command line. For more information about the Sysprep Command line tool, see Sysprep Command-Line Options.

Sysprep process overview

When Sysprep runs, it goes through the following process:

Sysprep verification. Verifies that Sysprep can run. Only an administrator can run Sysprep. Only one instance of Sysprep can run at a time. Also, Sysprep must run on the version of Windows that you used to install Sysprep.
Logging initialization. Initializes logging. For more information, see Sysprep Log Files.
Parsing command-line arguments. Parses command-line arguments. If a user does not provide command-line arguments, a System Preparation Tool window appears and enables users to specify Sysprep actions.
Processing Sysprep actions. Processes Sysprep actions, calls appropriate .dll files and executable files, and adds actions to the log file.
Verifying Sysprep processing actions. Verifies that all .dll files have processed all their tasks, and then either shuts down or restarts the system.

Persisting the hardware configuration

If you create an image of an installation for deployment to a different computer, you must run the Sysprep command together with the /generalize option, even if the other computer has the identical hardware configuration. The Sysprep /generalize command removes unique information from a Windows installation so that you can reuse that image on different computers. The next time that you boot the Windows image, the specialize configuration pass runs.

If you want to install a Windows image to computers that have the same hardware configuration, you can preserve the device-drivers installation in a Windows image by using and Unattend file that with the Microsoft-Windows-PnPSysprep PersistAllDeviceInstalls setting. The default value is false. If you set the setting to true, the Plug and Play devices remain on the computer during the generalize configuration pass and you don't have to reinstall these devices during the specialize configuration pass. For more information, see Use Answer Files with Sysprep and Unattended Windows Setup Reference Guide.

Adding device drivers

Plug and Play devices include modems, sound cards, network adapters, and video cards. The Plug and Play devices on the reference and destination computers do not have to come from the same manufacturer. However, you must include the drivers for these devices in the installation. For more information, see Add and Remove Drivers to an Offline Windows Image and Add Device Drivers to Windows During Windows Setup.

Booting to Audit mode or OOBE

When Windows boots, the computer can start in one of two modes:

OOBE

OOBE, also named the out-of-box experience (OOBE), is the first user experience that guides users through customizing their Windows installation. By default, all Windows installations boot to OOBE first. The oobeSystem configuration pass runs immediately before OOBE starts.

If you don't automatically activate Windows by using a product key, OOBE prompts the user for a product key. If the user skips this step during OOBE, Windows reminds the user to enter a valid product key later. To automatically activate Windows by using a product key, specify a valid product key in the Microsoft-Windows-Shell-Setup ProductKey unattend setting during the specialize configuration pass. For more information, see Work with Product Keys and Activation.
Audit mode

Audit mode enables you to add customizations to Windows images. Audit mode does not require that you apply settings in OOBE. By bypassing OOBE, you can access the desktop more quickly and perform your customizations. You can add more device drivers, install applications, and test the validity of the installation.

You can configure Windows to boot directly to audit mode by using the Microsoft-Windows-Deployment Reseal Mode setting in an answer file. In audit mode, the computer processes settings in an unattended answer file in the auditSystem and auditUser configuration passes.

If you are running a computer in audit mode to configure the installation to boot to OOBE, either use the Sysprep GUI or run the Sysprep /oobe command. To prepare a computer for an end user, you must configure the computer to boot to OOBE when an end user starts the computer for the first time. In a default Windows installation, OOBE starts after installation is completed, but you can skip OOBE and boot directly to audit mode to customize images.

For more information, see:

Detecting the State of a Windows Image

You can use Sysprep to identify the state of a Windows image. That is, you can determine whether the image will boot to audit mode or OOBE, or if the image is still in the process of installation. For more information, see Windows Setup Installation Process.

Sysprep Log Files

The Sysprep tool logs Windows Setup actions in different directories, depending on the configuration pass. Because the generalize configuration pass deletes certain Windows Setup log files, the Sysprep tool logs generalize actions outside the standard Windows Setup log files. The following table shows the different log file locations that Sysprep uses.

Item	Log Path
Generalize	%WINDIR%\System32\Sysprep\Panther
Specialize	%WINDIR%\Panther
Unattended Windows Setup actions (OOBE)	%WINDIR%\Panther\Unattendgc

The setupact.log file is the main log file.

For more information, see Deployment Troubleshooting and Log Files.

Creating and Using Sysprep Providers

Independent software vendors (ISVs) and independent hardware vendors (IHVs) can create Sysprep providers that enable their applications to support imaging and deployment scenarios. If an application does not currently support generalize operations by using the Sysprep tool, you can create a provider that removes all software-specific and hardware-specific information from the application.

To create a Sysprep provider, you must do the following:

Determine which configuration pass (cleanup, generalize, or specialize) your Sysprep provider addresses.
Create the appropriate entry point for your Sysprep provider, based on your choice of configuration pass.
Register the Sysprep provider for use by the Sysprep tool.
Test your Sysprep provider to validate that the provider functions correctly. Make sure that you review the log files for warnings and errors.