Vernalex.com
 
 M  E  N  U
 - Guides
 - Links
 - Tools
 - Themes
 




 
 

Guides: SysPrep Guide for Windows 7 (Vista and 8)

As a sequel to my Windows XP SysPrep Guide I now have published a Windows 7 SysPrep Guide. This guide has been a long time coming and I am sorry it took me so long to create this. Please note that this is a work in progress. Also, in the interim while I don't have a Windows 8 or Windows 8.1 SysPrep Guide you can use this as a stand-in because they're mostly the same.

The purpose of SysPrep is to create a custom image that includes your own choice of programs and settings and works on multiple hardware platforms. This allows a system administrator to create an installation of Windows for the computers the admin supports so that multiple computers can be quickly set up with the same exact configuration. In the end SysPrep decreases deployment time and increases consistency. In a perfect world you can create a single image for all of your computers where you work, although for technical, security or other reasons you may need to create and maintain multiple images.

If you are familiar with SysPrep from Windows XP then you should forget everything you know since most of the process is dramatically different, and most of the changes are sadly for the worst.


Table of Contents

Background Information
Sadly when Microsoft designed SysPrep they created an incredible amount of confusion by forming their own terminology to describe the features of SysPrep. Many of the features of SysPrep seem to have been created in the most obtuse way and the names of features only further complicate what should be a fairly easy system to use. For example, they could have named it the "configuration file" instead of the "answer file" and saved people a lot of time from tracking down their definition. What this means is that to fully understand SysPrep it is useful to know read various background descriptions and definitions before jumping into the trial-and-error world that is SysPrep.

Terminology

Image A copy of a customized Windows installation. Images can be created by imaging software that take a snapshot of drive partitions such as Symantec's Ghost, take a snapshot of drive contents like Microsoft's ImageX or completely copy sector-by-sector (not recommended).
Ghost A product sold by Symantec that allows creating a copy of a disk's contents so that it can be deployed to other computers.
ImageX A product freely included as part of Windows that allows a drive to be imaged file-by-file.
SysPrep The tool by Windows to prepare an installation so that it can be duplicated on other computers.
Audit Mode The mode of Windows that allows profile customization.
Generalize The mode of Windows that makes the installation of Windows generic.
Pre-installation Environment (PE) The mode of Windows that can be effectively viewed as Windows setup.
Specialize The mode of Windows that makes the installation of Windows specific to the hardware it is deployed onto.
Out-of-Box Experience (OOBE) The mode of Windows that is designed to run on first boot of Windows so that it can be custom tailored to the user of the computer.
Answer File The text configuration file used by SysPrep to customize the Windows installation.

SysPrep Tools

sysprep.exe The SysPrep files are now included and installed in every Windows installation. They're located at "%windir%\System32\sysprep", which for the vast majority of people will be "C:\Windows\System32\sysprep"
unattend.xml
(answer file)
The answer file should be named unattend.xml and placed in the system32\sysprep folder so that Windows will find it. When SysPrep is executed this file is moved to the Windows panther folder at "%windir%\Panther". If you do not name it unattend.xml then Windows will look for it in other locations. You can also specify it on the command-line of SysPrep, but I recommend just naming it the unattend.xml. For those familar with the old SysPrep from 2000 and XP then this is the replacement for the sysprep.inf.
imagex.exe Included within the Windows Automated Installation Kit (AIK) for Windows. It is available from Microsoft at their website. You can also find various pages on the Internet where you can download it, but of course they're not verified sources.
Windows Automated Installation Kit (AIK)
& Windows System Image Manager (SIM)
The AIK and SIM for Windows 7 are available from Microsoft at their website. The ADK is a collection of deployment tools for Windows and it includes the SIM. It is best to use the 32bit version of the SIM since it supports both 32bit and 64bit versions of Windows, whereas the 64bit version creates answer files only for 64bit versions.

SysPrep Command Line Options
The official command line options (arguments / switches) are described when using /? on sysprep.exe and is described as "USAGE: sysprep.exe [/quiet] [/generalize] [/audit | /oobe] [/reboot | /shutdown / /quit] [/unattend:<filename>]".

Examples:
sysprep.exe /audit /reboot
sysprep.exe /generalize /oobe /shutdown

/quiet Supresses visual prompts. I recommend not using the quiet option since if you provide the other necessary switches then SysPrep will operate automatically, but when quiet is used you will not see any error messages if you operated it incorrectly.
/generalize Causes Windows to process the unattend.xml for the generalize phase and makes the installation generic. This is option is executed right before SysPrep quits.
/audit Causes Windows to enter audit mode following the next restart. When the computer next starts up the audit settings within the answer file are processed. Normally I recommend accessing audit mode from Windows Welcome (see the section on Windows & SysPrep Modes). This option will result in
/oobe Enables the OOBE mode during the Windows mini-setup so that options from the answer file applicable to the OOBE will applied at the end of the SysPrep process.
/reboot This overrides the default option of SysPrep to shutdown the computer when it successfully exists, and instead restarts the computer. This is useful for testing since it will save you the effort of turning the computer back on.
/shutdown The default option when SysPrep successfully exits is to shutdown the computer so this switch is unnecessary except for extra clarity in any scripts you use. Most people will want to use the default option because when the computer turns off you know SysPrep completed successfully and then you can turn it on and take a snapshot of the drive using whatever drive imaging software you prefer.
/quit This overrides the default option of SysPrep to shutdown the computer when it successfully exists, and instead simply quits out of SysPrep. I personally use this option because I start SysPrep with a script and before the computer shuts down I run additional scripts.
/unattend:<filename> You can use this option to specify the answer file, but I recommend naming the answer file "unattend.xml" and placing it in the system32\sysprep folder so this option becomes unnecessary.
/? Shows the command-line help for SysPrep.

Windows & SysPrep Modes
Windows operates in two different modes. The default mode is Welcome mode, but for image customization you should use Audit mode. Please refer to the SysPrep Scenarios section for more information on how to use the modes.

Windows Welcome Mode (Machine OOBE Mode)
The Windows Welcome mode is the normal mode for Windows. When Windows is first installed it boots in this mode, which asks you to enter a logon name, set a password, configure automatic updates, set a timezone, configure wireless and so on.

Windows Audit Mode
The Windows Audit mode differs greatly from the Welcome mode in it that it doesn't require setting logon names. This mode can either be started from within SysPrep or preferably on the first boot of Windows after an installation. When the Windows Welcome Mode starts press and hold CTRL and Shift and then press F3 (CTRL+SHIFT+F3). The computer will boot into an admin account (named Administrator). It can be started also by running SysPrep and selecting the option for Audit mode.

SysPrep Phases
Microsoft made SysPrep incredibly confusing by implementing phases into SysPrep for Windows Vista. Effectively the steps are:

auditSystem (optional, if audit) -> auditUser (optional, if audit) -> generalize (optional) -> SHUTDOWN AND TAKE IMAGE -> windowsPE -> offlineServicing -> specialize -> REBOOT -> oobeSystem (optional)

auditSystem
The auditSystem mode is processed when audit mode is started and refers to settings that modify the HKLM section of the registry. Since this applies local machine settings they are processed before the user (Administrator) logs on. Normally you don't need to worry about these settings because you ordinarily will not need to configure settings automatically from a script when audit mode begins since you can do them manually.

auditUser
The auditUser mode is processed when audit mode is started and refers to settings that modify the HKCU section of the registry. Since this applies current user settings they are processed after the user (Administrator) logs on. Normally you don't need to worry about these settings because you ordinarily will not need to configure settings automatically from a script when audit mode begins since you can do them manually.

offlineServicing
This is used by the PE to modify the computer before it is started.

generalize
The generalize phase is make the installation generic before taking an image. This mode is called manually by the user when sysprep.exe is run.

specialize
The specialize settings are the reflection of the generalize phase since it molds the settings to the specific hardware.

oobeSystem
The OOBE is run at the end of SysPrep. This mode is run if the user asked the OOBE to run at the point of executing the sysprep.exe.

windowsPE
Settings used to create the installation environment.


Creating the Answer File (sysprep.xml)
SysPrep follows a text file script called the "answer file". This is ordinarily named sysprep.xml and is best kept in the SysPrep folder. In theory you could create it with a text editor, but I recommend you create your own in the Windows System Image Manager (SIM). The SIM is a component of the Windows Automated Installation Kit (AIK) for Windows 7 (dated August 6, 2009). The manager is very bulky and hard to understand so I explain below on how to use it, but the format of the srcipt is so poorly designed that using anything but the SIM to create the answer file will only result in frustrating you. I have also included generic scripts you can use to deploy Windows, but you should still edit them with a text editor or with the SIM to tailor them for your needs.

Using the Windows System Image Manager (SIM)
The SIM is very difficult to understand since the panes are named odd things and the features are mostly incomprehensible. If you follow the steps below though you will work through the most necessary features of it. The largest issue with the SIM is not how but rather why though since you the steps needed to complete the job can be determined through trial-and-error, but I am still perplexed as to why those steps are necessary. In older versions of Windows the SIM was unnecessary because the sysprep.inf was as easy to understand as you would expect from a text file. There was a Setup Manager utility that could generate the sysprep.inf, but for the most part it wasn't necessary. I have thought of creating my own replacement for the SIM to reduce the amount of tears I expect people out there are experiencing with it.

Download the Windows Automated Installation Kit (AIK)
You will need to download the AIK from Microsoft's website. You will want the version dated 8/6/2009 since it is the latest version for Windows 7 and any previous verisons of the AIK will not work on Windows 7. Sometimes the AIK will be called the Windows Automated Deployment Tools (ADK) instead.

Install the Windows Automated Installation Kit (AIK)
The AIK is downloaded as an ISO so you will need to either burn it with CD burning software such as InfraRecorder (free) and then install it from the burned CD, or more easily extract the ISO using a decompression program that supports the ISO format such as 7-Zip (free). However, it should be noted that Microsoft

Run the Windows System Image Manager (SIM)
The "Windows System Image Manager" is installed in the Start Menu and is normally listed under "Microsoft Windows AIK" so it should be easy to find and start.

Initialize the Answer File
Either create a new answer file (File - New Answer File) or open an existing answer file (File - Open Answer File).

Set the Operating System
Under the Windows Image section right click and use the option labeled as "Select Windows Image". Navigate to an extracted Windows installation disk and select either the .wim (Windows Image) or the .clg (Windows catalog) file under the "sources" folder of the disk.

Add Desired Components to the Correct Phase
This is the most confusing part of using SysPrep because Microsoft made the component names incomprehensible and it's not always clear which phase the components need to be added into.

You need to look through the list of components listed under Windows Image or use the Microsoft help to figure out which settings you can alter. I have added a section below for common components, but they're only a rough guideline and you may have special needs that I never had so make sure you explore the components.

You need to right click the component and select the phase to add it to the answer file.

Components are named by the processor architecture (amd64, wow64, x86), the component name, the operating system version and the attached language (typically neutral). Realistically the XML file does not save the OS version so I do not know why it is shown in the SIM. I personally do not understand why Microsoft associated certain features to a specific architecture so please write to me and explain it if you understand the logic behind it.

Modify Properties of Components
When you add a component it is propigated into the tree list under "Answer File". It is added directly to the phase that you specified.

Save Answer File
Save the answer file (File - Save Answer File) to the SysPrep folder.

Common Components
The components are listed by architecture_name_osversion_language but I only listed the architecture and names below since the others may vary for your use. The architectures are available as x86, wow64 and amd64 - where x86 is for 32 bit operating systems, amd64 is for 64 bit operating systems and wow64 is also for 64 bit operating systems (wow64 acts as a 32 bit converter for 64 bit Windows).

Microsoft-Windows-Shell-Setup
Product key, copyprofile, computername, etc.


Generic Scripts
I will upload some scripts soon that show the general structure.


SysPrep Scenarios
There are several possible scenarios.

Simple Scenario
The simple scenario uses no answer file so the image is very vanilla. In most situations using SysPrep in this way isn't very useful.

Install Windows
Install Windows as normally would. There is so special steps required during the installation process.

Enter SysPrep folder
Find the SysPrep executables within %windir%\system32\sysprep.

Run sysprep.exe
Start the process by running the sysprep.exe within the folder.

Select OOBE
Select "Enter into System Out-of-Box Experience (OOBE)" from the dropdown.

Generalize?
Optionally select the option for "generalize". Normally you will want to do this.

Shutdown?
When selected SysPrep will shut down the computer when finished.

Image
Use whatever tools you would like to create an image of the computer. I personally use Symantec's Ghost, but for example you could use Microsoft's free ImageX utility as well.

Deploy
Use whatever tools you would like to deploy the image to other computers. Obviously the tool you used to create the image will have a counterpart you should use to deploy the image.


Advanced Preplanned Audit Scenario
When you are designing an image from a fresh install then this scenario you should follow. This is also the best possible scenario. The difference between this scenarion and the "unplanned audit" scenario is that this one enters audit mode from Windows Welcome, whereas the other uses sysprep.exe to restart into audit mode.

Install Windows
Install Windows as normally would. There is so special steps required during the installation process.

Enter Audit mode
When first booting the freshly installed Windows installation enter Audit mode from the logon screen by holding CTRL and SHIFT and then pressing F3 (CTRL+SHIFT+F3). This will reboot and then log you in as "Administrator".

Modify Profile
Customize the profile so that it will behave the way you want it to for all future accounts that will be created on it following deployment.

Enter SysPrep folder
Find the SysPrep executables within %windir%\system32\sysprep.

Install Answer File
Copy into the SysPrep folder the answer file named sysprep.xml you have created on another computer.

Run sysprep.exe
Start the process by running the sysprep.exe within the folder.

Select OOBE
Select "Enter into System Out-of-Box Experience (OOBE)" from the dropdown.

Generalize?
Optionally select the option for "generalize". Normally you will want to do this.

Shutdown?
When selected SysPrep will shut down the computer when finished.

Image
Use whatever tools you would like to create an image of the computer. I personally use Symantec's Ghost, but for example you could use Microsoft's free ImageX utility as well.

Deploy
Use whatever tools you would like to deploy the image to other computers. Obviously the tool you used to create the image will have a counterpart you should use to deploy the image.

 


Advanced Unplanned Audit Scenario
When you are designing an image from an existing install of Windows then this method will work the best for you. The difference between this scenarion and the "planned audit" scenario is that this one enters audit mode using sysprep.exe to restart into audit mode while, whereas the other enters into audit mode from the Windows Welcome screen following an installation.

Use Windows
This assumes Windows is already been installed and is being used.

Enter SysPrep folder
Find the SysPrep executables within %windir%\system32\sysprep.

Enter Audit mode
Enter into audit mode by running sysprep.exe and selecting "Enter System Audit Mode" from the "System Cleanup Action" dropdown. Normally you will want to select the "Reboot" option from the "Shutdown Options" dropdown so Windows will automatically reboot and then start into audit mode.

Modify Profile
Customize the profile so that it will behave the way you want it to for all future accounts that will be created on it following deployment.

Enter SysPrep folder
Find the SysPrep executables within %windir%\system32\sysprep.

Install Answer File
Copy into the SysPrep folder the answer file named sysprep.xml you have created on another computer.

Run sysprep.exe
Start the process by running the sysprep.exe within the folder.

Select OOBE
Select "Enter into System Out-of-Box Experience (OOBE)" from the dropdown.

Generalize?
Optionally select the option for "generalize". Normally you will want to do this.

Shutdown?
When selected SysPrep will shut down the computer when finished.

Image
Use whatever tools you would like to create an image of the computer. I personally use Symantec's Ghost, but for example you could use Microsoft's free ImageX utility as well.

Deploy
Use whatever tools you would like to deploy the image to other computers. Obviously the tool you used to create the image will have a counterpart you should use to deploy the image.


Related Tips
This section contains tips, tricks, gotchas, recommendations, etc. for SysPrep.

Clean-up Image
Before taking an image I recommend that you delete unneeded files such as temp files, temporary internet files, the pagefile.sys and other files that will take up space and reduce deployment speeds when they're not needed. You may need to experiment a bit to see which files are needed and which are not.


SysPrep Driver Scanner
I wrote a tool, originally for Windows 2000, that scans for Windows drivers and generates a list of directories containing those directories so they can be used by Windows to detect hardware during SysPrep. It works on 2000, XP, Windows Vista, Windows 7, Windows 8 and Windows 8.1. Please visit here to download it.


Pinned Items
When customizing a Windows installation the Start Menu pinned items can be saved into the default profile, but the Taskbar pinned items are reset during the SysPrep mini-setup. There is no way to turn this "feature" off, but there are workarounds. I wrote a program that can delete and create pinned items but it is not ready to be published. If you want to test it then write me and I can provide you a pre-release version of it. You can find Visual Basic scripts though on the Internet that do a similar job though.


Image Host
I personally recommend using VMWare Workstation when creating images. This allows you to create point-in-time snapshots of your image workstation so you can perform tests and recover from mistakes a lot quicker.


Saving the Image
I personally use Symantec's Ghost to save my images. Since I create my images in VMWare I use a Windows PE bootdisk as a virtual CD-ROM device on VMWare so that when I need to take the image I simply boot from the CD-ROM and then use Ghost to save to a Windows File Server. You could also very well use an external hard-drive to save the image or if you create the image on a physical machine you could remove the hard-drive and save the image with an external enclosure such as a Thermaltake BlacX.


Deploying the Image
In my situation I remove the hard-drives from computers and use a Thermaltake BlacX to deploy the image to the new computer. At work we also almost exclusively use Dell computers and we sometimes have them use their Custom Factory Integration (CFI) to deploy our Ghost image onto our new computers at the factory. You could also carry around an already imaged secondary hard-drive and use hard-drive to hard-drive image, which would be very fast, or many other techniques. Like with saving the image you will need to create a boot disk in many of these situations. For example I carry around an Apricorn Aegis Padlock drive that serves both as a bootdisk for me and a drive that can deploy images. I use encrypted hard-drives because I often have to deal with confidential data.