Sysprep Overview

Disk-cloning is the fastest way to deploy large numbers of computers but disk-cloning software presents four major problems:

1. Identical hardware configuration
   The target computer(s)—the computer(s) that receives the image—and the reference computer—the computer from which you create the image—must virtually have an identical hardware configuration. If there is a mismatch of hardware, the target computer(s) will likely go to blue screen when booted.
2. Identical security identifiers
   When disk-cloning, the target computer(s) and the reference computer will have identical security identifiers (SIDs). A SID is a value that uniquely identifies a user, group, computer account, and logon session on a network. This poses a significant security problem since each computer requires a unique SID. In a network environment two machines that have the same SID would result in all users’ accounts being the same regardless of any differences in the usernames.
3. Quality control
   Disk-cloning doesn’t really test the target computer for quality. It simply lays down the OS on the hard disk. When you load a system from the CD you are putting a load on the system insuring a consistent and quality computer.
4. Microsoft support
   Microsoft does not provide support for computers that were set up with SID duplicating tools other than the System Preparation tool.

Once Sysprep is executed on a computer, the computer will return to the last stage of the Windows setup process. This is the point where a unique SID is generated. Sysprep also removes critical configuration information and effectively rolls the system back to a state prior to setup completion.

NOTE Don’t run Sysprep on a customer’s existing operating system! If you do it will remove all critical configuration information. Run Sysprep only on reference systems that you've intentionally set up.

When you preinstall the computer using the OPK tools and Windows PE, the Master computer will automatically start up in Sysprep Factory Mode which is also an audit mode.

By running Sysprep in Factory mode, Factory.exe will:

• Process its answer file, Winbom.ini
• Copy drivers from a network source to the computer (if configured)
• Start Plug and Play enumeration
• Stage, install, and uninstall applications on the computer from source files located on either the computer or a network source
• Add customer data

During factory mode you can install additional drivers and applications at the stage after the reboot that follows Sysprep.

Note: To check the actions of Sysprep -Factory as defined in winbom.ini, you can analyze the log file c:\sysprep\winbom.log.

Return to top

Auditing
Auditing is the manual testing of new computers and should be done on the computers you manufacture to verify a computer is functional before shipment. During auditing, you should:

• Verify the operating system loads and applications start properly
• Run a disk defragmenter program
• Check for corrupted hard disk files, by running Chkdsk
• Verify all installed devices in Device Manager are properly recognized
• Run other auditing or test tools

You can test the computer or install applications without destroying the pages displayed for the end user's first-run experience. You can restart as many times as necessary while auditing the computer. Normally you audit the Master computer before resealing and imaging.

Return to top

Sysprep -reseal
Running Sysprep -reseal is normally the last thing you do when preparing a computer for delivery.

When you run sysprep -reseal, Sysprep does the following:

1. Clears any registry keys and settings that need to be unique, such as Internet connection settings, Microsoft Media Player IDs, or any items on the Start menu.
2. Uses Setupcl.exe to reset the security IDs (SIDs) the next time the operating system restarts, before Windows Welcome or Mini-Setup runs.
3. Sysprep populates the [SysprepMassStorage] section in Sysprep.inf, if the value of BuildMassStorageSection in the [Sysprep] section of Sysprep.inf is Yes and Sysprep.inf has the [SysprepMassStorage] section.
4. Installs the mass-storage drivers from [SysprepMassStorage] in Sysprep.inf.
5. Closes network connections.
6. Configures Windows Welcome or Mini-Setup to run on next boot.
7. Copies Sysprep.inf to %WINDIR%\System32\$winnt$.inf.
8. Writes the registry keys in HKEY_LOCAL_MACHINE\SYSTEM\Setup\CloneTag.
9. Clears any system restore points.
10. Resets the time clock for Windows Product Activation, if the time clock has not already been reset three times.

The Sysprep files must be in %SYSTEMDRIVE%\Sysprep folder. When you run Sysprep.exe, Sysprep removes the %SYSTEMDRIVE%\Sysprep folder and its contents after it finishes running.

Once a system has been sealed it will boot up to the Windows Welcome screen. You can skip Windows Welcome pressing the key combination CTRL+SHIFT+F3 when Windows Welcome starts. You may then audit the computer, or if you are a value-added reseller, make additional configurations on the computer before sending it to the customer. After completing your testing, you must run Sysprep -reseal to prepare the computer for the end user.

Note: You can reseal the same computer only three times to reset the time clock for Windows Product Activation.

Return to top

Sysprep Limitations
You cannot run Sysprep on a computer that has been configured as a Cluster services server, a Certificate services server, or a domain controller. Small Business Server 2003 has a special installation method which makes it possible to run Sysprep on a domain controller. This feature gives System Builders the possibility to image a complete installed Small Business Server.

• If you run Sysprep on an NTFS file system partition that contains encrypted files or folders, the data in those folders will become unreadable and unrecoverable.
• Sysprep images requires relatively similar hardware (HAL) on the target computers.