SysPrep Guide: Execution - [6/8] +

When you have properly prepared then you are ready to execute the SysPrep executable (sysprep.exe). Typically you will want the sysprep.exe located in C:\sysprep. The reason for this is that after the mini-setup for SysPrep completes following the first boot of the computer, SysPrep attempts to delete the directory C:\sysprep and that includes all subfolders of c:\sysprep. This is important because typically there are settings in the sysprep.inf file that you do not want endusers to see, such as a password (or a password hash even). Some users even place their drivers as a subdirectory of c:\sysprep (such as c:\sysprep\drivers) so they are removed automatically when SysPrep completes.

If you are confused about where to place files for SysPrep then you may want to watch the video guide as it provides a fairly linear methodoloy on where to place files and how to modify them to meet your needs.

Please be certain that in the same folder as SysPrep you have your sysprep.inf file. Please make sure the file name is exactly "sysprep.inf". Make sure you have file extensions turned on so you don't have a hidden file extension because "sysprep.inf.inf" will not work, and likewise neither will "sysprep" or "sysprep.ini". This is a very common mistake and it often leads to a lot of frustration.

Also, make certain that the folder you're running SysPrep from contains the setupcl.exe file as that is a required component of SysPrep. I personally leave all of the files in that directory that came along with sysprep.exe and setupcl.exe, such as the instruction manual and the Microsoft Setup Manager Wizard (setupmgr.exe) as they're all fairly small and they'll be removed automatically if they're in c:\sysprep following the completion of the mini-setup.

When you run SysPrep you will be presented with a warning box that explains the it will alter your computer's security settings. This is just to warn you that SysPrep is a powerful program that could seriously screw up your computer if you're not careful. As always, I highly suggest that you take an image of a computer before you apply SysPrep as well as after. When you click okay you will have several options.

The most important option here is to select "use mini-setup". The other is to make sure the "shutdown mode" is set to "shut down". Remember that after the computer shuts down the Windows installation will launch the mini-setup on first boot. So, if you set the "shutdown mode" to reboot then you may mistakenly allow the computer to boot and you'll have to do it over again (or worse, you have to reimage it back to before you imaged it). If you are using the Ghost console to image the computer then you may want to set it to "quit" because then it will be in a state that you can have Ghost image it automatically. I personally have it shutdown and then I use a bootdisk to image it to a Ghost server or to a mapped drive. You will most likely want to use the button "reseal" as "factory" is a mode used by computer companies so they can distribute Windows to their customers.

You can also execute SysPrep from the command-line and this is personally how I do it. For a complete list of commands that you can use on the command-line see the deployment instruction manual for SysPrep or execute it as "sysprep /?" to list them all. However, I usually execute SysPrep as "sysprep.exe -reseal -mini -quiet". In fact I usually place a batch (.BAT) file in the SysPrep directory (c:\sysprep) and I have it do some preliminary tasks and then it executes SysPrep. You can download a sample of the batch file here, but make sure you download it and then edit it from your own computer. So, if you placed it in your SysPrep folder you run it instead of running sysprep.exe.

That particular sample batch file starts out by giving a warning. It states that you should read any steps you have documented before continuing. I personally have a worksheet I follow that reminds me to do such things as clear the event log and to delete temporary files before I SysPrep a computer, and I highly recommend that you make up a list as well. Once you're ready it allows you to continue by pressing any key, or you can quit by closing the window.

Once you have pressed a key it will continue on to running sync.exe. This is a program that you could download from SysInternals. Windows typically keeps data in memory for a bit before it writes (flushes) it to the hard-drive. This works as a buffer and it decreases thrashing of the hard-drive which increases throughput speed. The sync.exe program will force Windows to write any data in memory to the disk.

That batch file will then delete all of the driver caches from the directory containing the drivers (in this case it is set to c:\drivers but you could change that to whatever). The driver caches are precompiled entries that allows Windows to much more quickly parse drivers. That is a good thing, but I don't know if the caches are stale because I may have updated the drivers and I'm not sure if Windows would figure it out so to be safe I clear them. If you have a better idea for this, such as how to create new caches, then let me know.

Next I have it execute my SysPrep Driver Scanner in order to generate the proper driver cache. Simplistically this program will scan a directory, either through a GUI or the command-line, for files you specify, in this case INF driver files, and it will populate the registry with those paths so that you don't have to manually enter them into the OemPnPDriverPath field in the sysprep.inf. In this example I have it executing from the command-line so that it scans c:\drivers for all .INF files and appends c:\windows\inf, which is the default Windows driver store, and then saves it into the registry.

The next step terminates all Windows file sharing (SMB) connections with any file servers. I try to minimize the amount of things that SysPrep will trip over when it runs.

Next it terminates several typically processes using the kill.exe command. This is a tool that is available through Microsoft's resource kit. You could also use the taskkill.exe command or SysInternal's pskill.exe command.

Then I have the batch file stop a lot of running services. I don't want SysPrep to be disturbed by executing processes so I have them stop.

Once again I flush the buffers with sync.exe.

And then I have the batch file execute sysprep.exe. I start it with the "start" command because typically batch files are sequential. So, a command has to complete before the next command can run. But, using the start command it tells Windows to run the sysprep.exe in parallel. What this accomplishes is that the batch file continues on and quits, but SysPrep starts to run. This helps reduce the chances of the running batch file from interferring with the operation of SysPrep.

I use the command switches of "-reseal -mini -quiet" so that it performs a reseal operation, runs the mini-setup on first boot and that it runs quietly so that it requires no interaction from the user.

When you execute this batch file with sysprep.exe, sysprep.inf and setupcl.exe in the same directory it would run through all of these procedures and then it would shut down the computer. At this point you are supposed to take an image, without starting up Windows. The next time you let Windows start on this computer though it will execute SysPrep in the mini-setup phase. After taking an image I suggest that you always reboot the computer and let it finish the SysPrep process as a test, because if it doesn't work on the computer you prepared the image on then there's very little chance it will work properly on other computers.