How to distingush audit mode from oobe mode by program?

[gittywang]

Does anyone know how to distinguish audit mode from oobe mode by program?

Edited August 5, 2010 by gittywang

[Tripredacus]

You can find it in the registry, there is a value that gets changed. But! I have seen a failed sysprep not change that value but actually sysprep the OS. In this case, Windows doesn't work properly.

Anyways, if you are in Audit Mode, sysprep.exe should open and appear on the desktop when the OS loads. Also Aero will be disabled, and the UAC will be disabled also. You can also access the Administrator account in C:\Users. And the Panther logs would be able to tell you what state the machine is in, but that could be a difficult read.

[maxXPsoft]

like Tripredacus said but heres the reg key

Windows Setup States http://technet.microsoft.com/en-us/library/dd744535%28WS.10%29.aspx

[gittywang]

like Tripredacus said but heres the reg key

Windows Setup States http://technet.microsoft.com/en-us/library/dd744535%28WS.10%29.aspx

Thank you.

Read Windows Setup States is quite simple way for me.