Best method of closing Sysprep?

[Tripredacus]

It comes down from the top that it would be preferrable for Windows 8 in Audit Mode to not have the Sysprep box on the screen. This is because I use a program that ends up sysprepping the machine instead and the techs have been using the sysprep box for years and might just forget to run the program.

I was able to accomplish this by mounting NTUSER.DAT from the Administrator account and add:

taskkill /im sysprep.exe

To the RUN key. But I am wondering if this is the best way to do this? Is it possible to find out what makes sysprep.exe run automatically in Audit Mode? Has anyone figured it out?