Tripredacus

In the Properties of (My) Computer, at the bottom, do you have a link that says Change Product Key?

You can find it in the registry, there is a value that gets changed. But! I have seen a failed sysprep not change that value but actually sysprep the OS. In this case, Windows doesn't work properly. Anyways, if you are in Audit Mode, sysprep.exe should open and appear on the desktop when the OS loads. Also Aero will be disabled, and the UAC will be disabled also. You can also access the Administrator account in C:\Users. And the Panther logs would be able to tell you what state the machine is in, but that could be a difficult read.

I know they aren't typical install cds, but shouldn't be some refference of the pk on one of those two discs? Or on th hp_recovery partition??!? The stored factory image isn't an install. It is image based recovery similar to Vista and Windows 7 RE.

I'd also be "caveat emptor" when blaming HP for what their recovery partition/CDs do. They did not write that software, they are using another company's product that has been branded for HP.

There's Windows Home OEM media floating around on the net. Get on one of the torrent sites and download it. As long as it's a OEM version of Home it should accept the key off the computer. Quoting for reference.

It also sounds like you could make use of EWF (Enhanced Write Filter) or Ram overlay, which will make it so any changes to the system are lost when the PC reboots. It appears that Vista supports this option, but I've only had first hand experience with it on XP Embedded.

Ok here's the deal. I do not know how the older pack-in Recovery disks work. That is, you just got them with the computer. If these discs were created by the user, they are going to work similar to what goes on in this thread: So that is why I asked about formatting the hard drive. If these are the created media, they read info from the MBR to verify that they are allowed to install the OS there. If the info it is looking for is missing or wrong, the CD will not install.

Presuming you actually removed the product key, I would expect the file you uploaded to look like this: <ProductKey> <Key></Key> <WillShowUI>OnError</WillShowUI> </ProductKey> but this XML you uploaded, if you actually have your real file looking like this: <ProductKey> <Key /> <WillShowUI>OnError</WillShowUI> </ProductKey> It will install Business because you have not told Setup what to install.

Which OS and architecture are you using? Do you get any errors? What programs are you trying to install? We can't help if you do not provide some information.

So did you format the entire hard drive or just the OS volume? If you formatted the entire hard drive (thus recovery partition goes bye bye) then the recovery CDs aren't likely to work IF they are based on the same software as the partition. They aren't typical install CDs. Did you create these recovery discs with the Media Creator?

I would double check the PID in your autounattend file, as it is these items which ultimately determines which OS version is installed. But then again, if Enterprise is the only image in the WIM (it appears that you exported it from the original) I wouldn't know why Business would get installed. Also, modify your answer file (remove the product key) and attach it to a reply. Do not paste the file into the post or copypasta from it in IE. This was we can look directly at the file itself.

But doesn't the logs make record of it working with different languages? The setupact.log in Panther (not UnattendGC) has these at the start and stop of the delay: 2010-07-30 23:18:42, Info SYSPRP SPPNP: Making sure system services have been started... 2010-07-30 23:19:29, Info SYSPRP SPPNP: Reinstalling devices on the system... 2010-07-30 23:19:29, Info SYSPRP Status: Active 2010-07-30 23:19:29, Info SYSPRP Status: Total = 6, Complete = 0, Progress = 0% (0%) // snip // 2010-07-30 23:34:46, Info SYSPRP Status: Active 2010-07-30 23:34:46, Info SYSPRP Status: Total = 208, Complete = 207, Progress = 99% (99%) 2010-07-30 23:34:46, Info SYSPRP Status: Active 2010-07-30 23:34:46, Info SYSPRP Status: Total = 208, Complete = 208, Progress = 100% (100%) 2010-07-30 23:34:46, Info SYSPRP Callback canceled operation, Err = 1223! 2010-07-30 23:34:46, Info SYSPRP DeviceInstallStatusThreadProc failed, Err = 1223 2010-07-30 23:34:48, Info SYSPRP SPPNP: Devices reinstallation completed.

The first thing I want to say is that we can't gauge the 32bit image based on how the 64bit behaves. They aren't the same thing. Now if you were to say a different version (say Home Premium) of 32bit worked fine, that would be a different story. So let's keep 64bit out of the discussion all-together for now. Checking the new setupact.log, it looks like starting around 23:18 and ending around 23:34 it is installing drivers. Definately appears to be the slowest part of the setup. Comparing to my log (I'm at work now, and my install was done with a master image instead of a DVD) only takes 4 minutes to install drivers. You can see this is the period of time that Cluberti may be refering to, which you can find in the UnattendGC\setupact.log: 2010-07-30 23:18:23, Info [windeploy.exe] Launching [C:\Windows\system32\oobe\setup.exe]... 2010-07-30 23:34:59, Info [Shell Unattend] Running 'specialize' pass Presumably, this isn't caused by the total amount of drivers you had installed into the master image.

Basically, as all the other responses have pointed to so far, you need to make your own Boot.wim. The tools recommended can make this task easier for you. It is illegal to redist a custom boot.wim online.

The missing timestamps is not rare. It always does this, or at least mine is like that too. Here is a process comparison: Your setupact (last 5 lines) dispci.dll: ============BEGIN DisplayClassInstaller============ dispci.dll: DisplayClassInstaller: Returning 0xe000020e for DIF 0xc dispci.dll: ============END DisplayClassInstaller============== montr_ci.dll: DIF_DESTROYPRIVATEDATA montr_ci.dll: Returning 0xe000020e for function 0xc. And mine (relative last five + next few) dispci.dll: ============BEGIN DisplayClassInstaller============ dispci.dll: DisplayClassInstaller: Returning 0xe000020e for DIF 0xc dispci.dll: ============END DisplayClassInstaller============== montr_ci.dll: DIF_DESTROYPRIVATEDATA montr_ci.dll: Returning 0xe000020e for function 0xc. AudMig: No audio endpoint migration settings found 0x2 AudMig: No audio endpoint migration settings found 0x2 2010-02-27 19:59:17, Info CBS Starting TrustedInstaller initialization. So you can see mine does not stop where yours does, and it does start doing time stamps. But later on, it does go back to logging more display entries without timestamps on them. Let's take a look at some more files... C:\windows\TSSysprep.log C:\Windows\Panther\setupact.log C:\Windows\Panther\UnattendGC\setupact.log However since there appears to be a LOT of driver activity with the display, I am wondering, did you (clive) inject any drivers to your install?

I merged your posts. Typically you should wait 24 hours before replying to your own topic if there has been no replies yet. This is especially key on the weekends because a lot of people seem to post from work and the traffic on the site is generally lower on Saturday or Sunday. Now the first thing you need to do is look up what this service is... It could very well be a CPU temperature monitoring program, as is on this site: http://www.stvsoft.com/ So in order to stop that program from running, as you probably don't need it if you don't know what it is, you need to find what is launching it. Services can be disabled in a few places, notably Services.msc OR you can get to that in Computer Management. One problem with that screen is that it lists services by their description and not their actual service name. You would need to look at the properties of the service to see the service name. And this is key because that name is what is posted by SCM in Event Viewer. You may also find this service in MSCONFIG. On the Services tab, you get a checkbox to hide all Microsoft Services, to make it easier to track down the one you are trying to find. Lastly, the service can also be loading from the registry. Combating viruses have shown this to be possible, but I have no specific info on how to find it there. You might just be able to search for 'sensorsview' in Regedit and be able to find it. Make sure you back up any registry keys before you modify or delete them, just in case. You may also want to create a restore point if you are not sure.

5556?

No need to upload files to MSFN that are already available online. http://www.angusj.com/resourcehacker/ We have a forum for customizing Windows, you can see it here: http://www.msfn.org/board/forum/40-customizing-windows/ Make sure to read the forum rules, especially about unnecessary formating of posts.

Your topic title is misleading really. I originally thought you were up to no good... Anyways, I am going to guess that your friend uses an email client and its (another "wild" guess) Outlook or Outlook Express. There are many trojans (part of Botnets mostly nowadays) that can access these email programs and send emails from them. I suppose it is possible with other clients like Thunderbird (from Mozilla) but Outlook is definately *known* for these type things. Now if your friend uses web-based email like Gmail or Yahoo or Live/Hotmail, this is definately a question for that service provider. An unfortunate "option" you can actually do in Outlook (and Thunderbird) is to specify the account you are sending from. So for example, I could send an email from Outlook but it would appear to come from somewhere else. And this can be used further if you specify another SMTP server, but this is a major reason why most ISPs do not allow relaying emails. Anyways, full email headers usually reveal this type of scam. EDIT: I wanted to add that some people will research email addresses that are posted online and fake those by changing the "Sent From" name in their email programs. I had similar things happen to me when I had used email accounts on my own website, I would get spam emails from my own contact address. It was pretty weird.

Egads... Welcome to the MSFN Make sure to read our forum rules and try not to make posts like that one again.

Well we probably listen to different kinds of music, but The Chasm and definately Opeth do! KMFDM - Ultra

Well it is possible that there is a program on the OS that scans the drives when it opens. You can try a msconfig and turn all your startup items off (except maybe battery monitor and your touchpad wares) and see if it does it that way too.

Actually that is also the reason I can read (some) German...

Ah OK, so we're not talking about "sysprep" as much as the OOBE process on the reboot. I think there is a different setupact.log that is in C:\Windows that we need to see and not the one in the Panther folder.

What's wrong with QBasic? It comes with DOS 5 at least.