help understanding sysprep passes

[dandirk]

I am using guides on the internet to setup a unattended.xml for use with sysrep. These are great but I really like understanding the process a bit better then just following steps blindly...

Currently we install XP, add drivers, apps, config etc then sysprep with mini setup option. Would sort of like to mimic this procedure. We do not have an imaging server etc, we image with ghost, and let mini-setup install drivers, name etc for a fresh PC/config.

Been reading up on the AIK and XML passes. Microsoft's description here is what I am basing this process on...

This is how I understand my use of sysprep and the unattended.xml process. Please let me know if I an wrong or off base.

1. Install Win7 on reference PC or VM. (install unattended.xml in sysprep folder if needed for audit modes)

2. Run "sysprep.exe /audit" to reboot to audit mode (this will activate the admin account, and run the 2 audit sections of the AIK IF I need them).

3 In audit mode (administrator account), add software, copy drivers folder to %windows%\inf, windows updates, GUI changes etc

4. Run sysprep.exe \generalize \oobe \shutdown \unattend:XXX.xml

5. Take ghost image.

6. Reboot and the mini-setup like will run and go through Generalize, Specialize, and OOBE passes at next boot, NOT running offline and PE?????

I will have to tackle the joindomain issue, but I figure I will do that later, when I have everythings else working. I know there are bugs and issues with joindomain. I just want to understand which passes are being used so I can edit/test accordingly.

Thank you for your time.

Edited December 10, 2010 by dandirk

[Tripredacus]

If you are going to be using audit mode, you should install using the autounattend.xml. There wouldn't be a situation that I would recommend running sysprep /audit from any other mode besides audit mode.

[dandirk]

I thought /audit put windows in audit mode at next boot? Also assume this is when the 2 audit passes are run...

From: http://technet.microsoft.com/en-us/library/cc766514(WS.10).aspx

"To apply the settings in auditSystem and auditUser, you must boot to Audit mode by using the sysprep/audit command.".

I highly doubt I need to automate anything in the audit passes, just read that audit mode is required to do profile edits and add apps. Is this not the case? Could I just enable to admin account, login, install apps, updates etc then run sysprep /generalize /oobe and have my xml copy profile set?

I also found a similar process HERE, where they run audit mode right away after install by using ctrl+shift+f3 in step 9.

As of right now I don't want to boot to audit when I image PC, just when configuring the image (before image is taken). Am I off base here?

[Tripredacus]

AFAIK, there are only 2 supported methods of getting into Audit Mode... Using an answer file during install or the Ctrl+Shift+F3 method. That being said, you CAN get into audit mode by running sysprep from a system that has already completed OOBE, but that could involve some issues. Careful doing anything with the Administrator account. Sysprep expects that the Administrator account is disabled when you have it boot into Audit Mode. I've seen Windows become corrupted this way!