making registry changes post-sysprep (guiRunOnce)

[VoodooV]

Greetings all.

I've recently made a WinXPSP3 sysprep image with WinPE and imagex. I've discovered a couple minor things that need registry changes. For example. When I was building my sysprep image. I copied the CD i386 folder to the C drive and modified the registry so that system file checker uses that local folder to do it's checking. For whatever reason though, after sysprep, those registry entries got changed to directories that definitely do not contain the source files. So I wanted to be able to lay down that sysprep image onto a new computer, and make some reg edits to correct those entries prior to the first boot up.

After some researching, I discovered the reg command after some initial confusion about loading hives and etc, I've eventually figured out how to change those entries back to what they should be and i've tested it and it works.

Here's where I'm stuck. I'd like to also add additional commands to the GuiRunOnce section. Currently, I've got two commands in there right now that install the recovery console, I'd like to add more commands after the fact if possible. Problem is, I can't seem to find the registry key that houses those settings.

The help file that comes with sysprep says that it puts GuiRunOnce commands in "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" after sysprep is run. Since I configured sysprep to have the target machine auto-login as Administrator a few times, that means that I need to load in the administrator's NTUSER.DAT hive right? Well I've done that, but I can't find the RunOnce section at all. I've also looked in the same place under HKLM, but also no luck. So what am I missing here? where are those commands stored at?

Thanks in advance!

[Mordac85]

Problem is, I can't seem to find the registry key that houses GuiRunOnce section [sic] settings.

That's because they are stored in the sysprep.inf, not the registry.

Since I configured sysprep to have the target machine auto-login as Administrator a few times, that means that I need to load in the administrator's NTUSER.DAT hive right?

Wrong, the local admin hive will be loaded once the login process is completed and accessible as HKCU. However, the hive will be locked and you will not be able to load it a second time.

I can't find the RunOnce section at all

By default, there is no RunOnce under HKCU. There is, however, one located under HKLM\Software\Microsoft\Windows\CurrentVersion.

If you are making changes to the user's hive (HKCU) then I would recommend using a single script to:

1. Enumerate the valid local users
   
2. Load each user hive under HKLM
   
3. Make the change to that user's hive
   
4. Unmount the user's hive and move to the next one