Sysprep with a new unattend from audit user pass doesn't work

[cortex]

Hi,

What I'm trying to do is a full install from original disk + install apps in audit user while the VM is in a dmz with dhcp/pxe booting capability, generalize, then reboot and specialize with a customizable fixed ip and oobe preconfigured.

I managed to create two unattend files :

1. One that goes from PE to Audit user (i.e. oobe pass reseal to Audit), with a synchronous command in audit user that ultimately call sysprep /oobe /generalize /reboot /unattend:\\fileserver\share\custom.xml

2. The custom.xml contains generalize, specialize (which is different from the first one) and oobe.

But the second file is not used correctly.

After calling sysprep, it logged in the sysprep\panther an error:

[sysprep.exe] UnattendFindAnswerFile: Looking at explicitly provided unattend file [\\fileserver\share\custom.xml]...
[sysprep.exe] UnattendFindAnswerFile: [\\fileserver\share\custom.xml] meets criteria for an explicitly provided unattend file.
SYSPRP SysprepSearchForUnattend: Using unattend file at [\\fileserver\share\custom.xml].
SYSPRP SysprepSearchForUnattend: [generalize] pass in unattend file [\\fileserver\share\custom.xml] either doesn't exist or passed validation
SYSPRP WinMain:Found unattend file at [\\fileserver\share\custom.xml]; caching...
SYSPRP WinMain:Processing unattend file's 'generalize' pass...
SYSPRP Sysprep is running a generalize pass with the following unattend file: [%windir%\panther\unattend.xml]

My custom.xml seems not to have generalize pass or doesn't validate.

I have tried to copy the custom.xml directly in the %windir%\panther folder as unattend.xml. Same message appears, but as it fallback on the same one, it does the generalize pass with my custom step. So it's not so invalid as it appears first, weird.

But, at reboot, the file in %windir%\panther is no more the second file, but it has been overwrite with the first one, which leads me to oobe welcome screen (wasPassProcessed="true" attribute may prevent the loop to audit)

I don't know why it overwrites the new unattendfile and how to force him to use a new unattend file from audit user pass.

I should mention that in audit mode, everything happens before desktop appears and that the sysprep gui windows appears (the second one, surely from the first file that has not the reseal defined on audit pass).

Any idea ?

Someone had got the same issues but with no answer, a long time ago.

[Tripredacus]

Sysprep makes a copy of your answer file and names it "unattend.xml" which it uses as a log file. This is why you see "wasProcessed" and "Sensitive Data Deleted" values in it.

What is in your Generalize pass? Did you try an XML without a generalize pass in it?

[cortex]

Here are the two files,

and the content of config.bat file called at the end of audit user in unattend.xml is like

@rmdir /S /Q c:\vmware
@set unattendfile=\\fileserver\config\custom.xml
@copy %unattendfile% c:\windows\Panther\unattend.xml
@start "" /wait %WINDIR%\system32\sysprep\sysprep.exe /unattend:c:\windows\Panther\unattend.xml  /generalize /oobe /reboot

I have tried with both copying to panther and directly using it.

Directly using it, it is not read by sysprep and nothing is done in setupact.log

Copying it to panther, i can see that it do the Microsoft-Windows-PnpSysprep and Microsoft-Windows-Security-SPP component defined in it, but the file is not used anymore after reboot as it gets overwrite in the panther folder by the first one. Is it from this place, the file is read ?

I just tried without the generalize pass. It did generalize, specialize (with setup devices) and i'm back at welcome oobe page and the content of unattend.xml in the panther folder.

Same error log in sysprep\panther, it found the given file, and says the generalize is missing or not valid (which is right this time), it cache the file, and do generalize with the panther\unattend.xml file.

I know the specialize of the custom.xml didn't pass because the ip configuration is still on dhcp.

custom.xml

unattend.xml

[Tripredacus]

Well I see you are booting into Audit Mode, then running a command that syspreps the system... but I have some questions regarding this process.

1. Are you manually doing anything with the system?

2. Your batch file doesn't kill the existing sysprep.exe that would be already running in Audit Mode.

I'd recommend using naming your unattend.xml as autounattend.xml. Also you have some extra info you don't need to have in there, such as the Specialize pass, those settings would be better off in your custom.xml. And you don't need to specify AutoLogon for the built-in Administrator for Audit Mode.

Based on your custom.xml, I can't see why you'd expect to NOT get the Windows Welcome pages. OOBE wants to create an account and you aren't creating one with the XML.

[cortex]

No, it only ask me for locale and adminstratror password as it's a server edition.

Everything is done automatically, it's part of an auto-provision mechanism. I don't want to capture image because I would need to do this foreach arch and edition.

All the synchronous command in audit user are called before arriving at desktop and sysprep is not starts.

I can see that it seems to appears but the reboot process of mine closes the session very quickly. Is there a way to prevent from launching at all. Maybe a timing issue may open a window for the second sysprep to replace my file.

In the sysprep\panther\setupact.log, I can see that a second instance has started. The only things noticeable is that it deletes tag file sysprep\Sysprep_succeeded.tag that has just been created at the end my sysprep call, found reboot command line args and display dialog box for user to choose sysprep mode.

autounattend.xml for the first one ?

Setup is called from PE windows\system32\startnet.cmd with the /unattend params.

I think that what makes me have the welcome pages is that is not the good files that is processed when rebooting.

I'm giving a try without specialize in unattend.xml, i'll edit when I get the results.

Edited August 24, 2011 by cortex

[Tripredacus]

In your .cmd that launches in Audit Mode to run sysprep, just have it kill sysprep.exe process first before doing anything else.

[cortex]

The default one is started after the synchronous command runs.

Anyway, I manage to have something working.

I copy the custom.xml as windir\system32\sysprep\unattend.xml and run sysprep /generalize /reboot /oobe against it.

As it doesn't want to process generalize pass from it, I simply move this section to the first unattend.xml file.

I guess that it works because wasProcessed="true" is written in the Panther cached unattend.xml (my first one) and setup try to find another one and find the one I copied.

At the end, when I finally can logged in with the correclty passworded administrator account, I see my untouched custom.xml copy in sysprep and a cached one copy with wasProcessed="true" in it.

I have now to try do the same things with 2008 and x86 flavour. Hope it's no big deal. And not too much things as changed.

Thanks for helping me

For completeness, I have found a similar post where it works with an autounattend.xml at first.