Audit mode and sysprep back to audit mode

HerrDarzen · Nov 5, 2021

Hi! So let´s make long story short: I usually install Windows to customers PC:s via WinPE. So I create one "base" WIM image that´s booting back to audit mode. And why? Because I build custom PC:s and hardware changes a lot. In audit mode I install drivers, run tests etc. . There´s of cource lot of another things I do with WIM image like customizing winre, adding languages, updates etc. But my main question is that have anybody noticed that if you´re using sysprep in audit mode like: Sysprep /generalize /reboot /audit then in the next boot, taskbar is looking like Windows 10 taskbar and file explorer is lagging alot? This happends with totally clean installation. I figured out that if I reregister APPX packages and after reboot everything works normally. Is it a bug or am I doing something wrong? Tried this with Hyper-v and VMware. I created answerfile that runs PS script that reregister APPX packages in audituser step so taskbar and everything else it´s working now as intended. But anyway, bug or user error?

ChadL · Nov 11, 2021

Not able to provide a solution but I can confirm I am also seeing this behavior. Similar situation to yours, I build images which must first be deployed in audit mode.
My steps to recreate are,
1. Start with OEM Media
2. Deploy WIM to PC with Unattend file forcing Audit mode on first boot.
3. First boot ever is Audit mode. Here is where I apply my reference image changes.
4. Run Sysprep.exe /Audit /Generalize /shutdown
5. Capture Image for redeployment.
6. Deploy image. Boots directly into Audit mode. Team performs quality assurance tests on hardware.
7. After completion of testing script is ran to sysprep into OOBE for end customer.

Step 6 I am seeing the same behavior you described. One thing I've noticed is if on step 4 I sysprep to OOBE and then during OOBE access Audit via CTRL + SHIFT + F3, then Audit mode will behave properly.

Were you able to find a solution / cause?

HerrDarzen · Nov 12, 2021

I created answer file that runs powershell script in AuditUser pass (RunSynchronousCommand). Powershell script reregisters all APPX packages and after reboot taskbar and everything else is working correctly. I placed answer file in %windir%\Panther folder so everytime image is deployed in to a new computer it uses that answer file. PS script is placed in root of C: . I haven´t investigate what APPX package causes the problem so I just reregister them all.

Answer file (unattend.xml):

Code:

<?xml version='1.0' encoding='utf-8'?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="auditUser">
        <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <RunSynchronous>
                <RunSynchronousCommand wcm:action="add">
                    <Description>APPX</Description>
                    <Order>1</Order>
                    <WillReboot>Always</WillReboot>
                    <Path>powershell.exe -executionpolicy bypass "C:\PSscript.ps1"</Path>
                </RunSynchronousCommand>
            </RunSynchronous>
        </component>
    </settings>
</unattend>

PSscript.ps1:

Code:

Get-AppxPackage -allusers | foreach {Add-AppxPackage -register "$($_.InstallLocation)\appxmanifest.xml" -DisableDevelopmentMode}

cereberus · Nov 12, 2021

Frankly it is years since I used sysprep as Windows 10 driver handling with hardware changes is far better than satisfactory versions.

I just image backup Windows using Macrium Reflect and restore to new device and most of time, it just works. I sometimes use the redeploy (paid version) to different harwdware if new device needs special driver.

Another approach is to create a custom wim of refrence installation using dism, and inject drivers then create bootable installation iso.

HerrDarzen · Nov 12, 2021

Yeah, there´s many different ways how to install/deploy Windows. I´ve deployed Windows to end customers by using WinPE and WIM images so many years that it just feels like right and easy way for me :) . But sometimes there´s these weird problems... usually those have been just "user errors"

. But this problem was different and it have been harder to find where the issue eventually lies on. That´s why I came here and started this topic because I wasn´t sure if this is just my problem or are there more folks that have noticed the same problem as me.

ps. sorry for my english

ChadL · Nov 16, 2021

Quick update - I ran through in a VM one by one to find the packages causing the issue. In my case it required reloading three packages.
"MicrosoftWindows.Client.CBS," "MicrosoftWindows.UndockedDevKit," and "Microsoft.Windows.ShellExperienceHost"

Thanks for sending me in the right direction originally!