|Home │ Unattended installation │|
The System Preparation Tool (Sysprep) in Windows XP: an Overview
This article is aimed at power users and not corporate administrators or OEM system builders.
Knowledge of this topic is required in the current MCSA/MCSE Exam 70-270.
 Running Sysprep
1.1. Description of Sysprep
The System Preparation Tool (Sysprep) in Windows XP (an updated version of that in Windows NT and 2000) enables administrators and OEM manufacturers to prepare a Windows installation suitable for making an image for automated deployment to many computers in a corporate environment or the factory. It can also be used for auditing Windows and programme installations before delivery to customers. Occasionally on a single computer it can be used to re-configure Windows Welcome or Mini-Setup.
This tool can be used in Windows XP Home edition, Windows XP Professional and Windows XP Tablet PC Edition. Windows does not have a built-in imaging utility: you need to use a 3rd party tool such as Symantec Ghost.
1.2. Advantages of Sysprep
The main advantage of using Sysprep is speed when deploying Windows in a large number of computers. Restoring an image is much faster than a fresh installation. The Mini-Setup Wizard (which prompts the user for inputs the first time the installation is booted) takes much less time to run than a full installation and Windows Welcome. it can be fully automated with an answer file thus eliminating any user input altogether.
From the outset it is vital to note that Sysprep removes the computer's Security Identifiers (SIDs) (unless you use the -nosidgen switch). SIDs are unique on each computer and cloned computers with the same SIDs would not function correctly in a workgroup or domain.
The means of deploying the image by network share or physical CD-ROM would depend on your needs.
1.3. What Sysprep is not meant for
For a simple backup of the computer it is not necessary at all to use Sysprep. It is not meant for cloning Windows at home or for distribution without licence.
Some websites offer tutorials on Sysprep and Ghost for backups and it is simply misleading. In fact it has implications which can be potentially detrimental to the cloned Windows installations (in particular but not confined to changed SIDs with its consequences, see below).
It is also not designed for cloning Windows installation to computers with different hardware or with multiple partitions (see below for other limitations).
1.4. Sysprep in Windows XP
The Windows XP version of Sysprep (version 2) has added features compared to those in Windows 2000: Audit Boot, Factory and Reseal buttons in the GUI (fig. 1) and the Clean command switch (refer to ref.chm and MS KB 282190 for details). Pre-SP2 version of Deploy Tools can be found in the Support\Tools folder the Windows XP Gold or SP1 CD. The PnP option is only available if you select the MiniSetup option and Audit Boot is only available in Factory mode.
Fig. 1. Sysprep GUI, pre-SP2
1.5. Windows XP SP2 version of Sysprep
The Windows XP SP2 version of Sysprep (the same version in Windows Server 2003) has further enhancements and fixed some bugs in previous versions (KB 838080). It has a new GUI (fig. 2). It can be found in the Deployment Tools (Deploy.cab) file in Support\Tools folder in the Windows XP SP2 CD or downloaded from Microsoft website (details in KB 838080, 812599, 317606). You can use this version to deploy Windows XP Gold and SP1.
The SP2 version of Mini-Setup uses the Administrator account profile rather than Default User profile to apply customisations to the new user (KB 887816). The ref.chm documents what is new in SP2 Sysprep answer file, sysprep.inf.
Fig. 2. Sysprep v.2 SP2 version
Sysprep is a rather complicated subject intended for advanced users and has many issues which may or may not affect your particular circumstances.
To fully understand it you need to know about other concepts such as HAL and unattended Windows installation. This article is only a brief overview for the power or advanced users; rather than reiterating everything here, please refer to the references. It is not meant to be a guide for corporate administrators or system manufacturers who should consult the Windows Preinstallation Reference instead.
The six articles from Microsoft TechNet is a good introduction although at the time of writing it has not updated to include the changes in Windows XP SP2. Don't forget the documentation included in the Deploy Tools.
Here is a quick glance of what Sysprep can do:
Refer to MS KB 307543 and 838080 for details.
3.1. Requirements for running the Sysprep tool
To quote from MS KB302577 (with modifications):Before you can use the Sysprep tool, your computer hardware and related devices must meet the following requirements:
The master installation (reference) and destination computers must have compatible Hardware Abstraction Layers (HALs). For example, Advanced Programmable Interrupt Controller (APIC)–based MPS (multiprocessor systems) must use the same APIC HAL. A standard HAL Programmable Interrupt Controller (PIC)–based system is not compatible with either the APIC HAL or the MPS HAL. The reference and destination computers must have the same Advanced Configuration and Power Interface (ACPI) support. (Although not supported, Microsoft says sometimes it might work with incompatible HALs, see KB 838856.)
The mass-storage (hard disc) controllers (IDE or SCSI) must be identical on the reference and destination computers. This is the official position, but it is possible to prime the registry on the reference computer beforehand, populating it with entries of other mass storage devices (see KB 314082) or using sysprep.inf to do similar (see ref.chm and Microsoft Windows XP Registry Guide).
The Plug-and-Play devices on the reference and destination computers, such as modems, sound cards, network adapters, and video cards, do not have to be from the same manufacturer. However, the drivers for these devices must be available.
Third-party disk-imaging software or disk-duplicating hardware devices are required. These products create binary images of a computer's hard disk and either duplicate the image to another hard disk or store the image in a file on a separate disk.
The size of the hard disk on the destination computer must be at least the same size as the hard disk on the reference computer. If the destination computer has a larger hard disk, the difference is not included in the primary partition. However, you can use the ExtendOemPartition key in the Sysprep.inf file to extend the primary partition on the NTFS (see below).The BIOS versions should ideally be the same on the reference and destination computers. Different versions may not be compatible.
3.2. Space-saving measures
You can also delete the following three files from the sysprep image to save space (but not directly from the installation on the hard disc) if your imaging programme has an image editor to do it:
These files will be re-created by the mini-Setup wizard.
Alternately, you can delete the page file first manually or using a script and run Sysprep; refer to KB 892104 for details.
Hyberfil.sys is used for computer hibernation; you can manually disable this before running Sysprep.
You should manually clear all the temp files, Recycle Bin and event logs before running Sysprep. The -reseal command clears the Event Viewer logs and should be run after the -factory command as a last step before delivery to the end-user.
3.3. Limitations of Sysprep
There are significant limitations of Sysprep which you should be aware of. Microsoft calls these limitations but they are just more requirements to be satisfied.
The Windows installation must reside in the C:\ partition folder. Sysprep does not work on multiple partitions.
The computer must not be joined to a domain controller or has started the Certificate Services service or the Cluster service.
Do not use an Original Equipment Manufacturer (OEM) installation to install a corporate Sysprep image on different hardware - except for OEMs themselves. OEM installations are designed specifically for that hardware. Also there might be issues with activation or with licensing when you deploy the image. When you create a corporate image, use volume-licensed versions.
Do not use Sysprep on computers with different processor vendors, such as from Intel to AMD.
Create Sysprep images only from new or from clean installations. Do not run Sysprep on an upgraded computer.
Do not use Sysprep on a production computer that is being used or has been used.
For more details refer to MS KB 288348, 830958 and 828287.
3.4. To apply customised settings
It is possible to make some customised changes in the Windows installation for cloning. Before running sysprep, make the desired changes with an administrative account and copy the user profile to the default user folder. This only applies to settings stored inside a user profile (which in turn is stored in the HKCU registry key; (KB 291586)).
Note however, that this has been changed in the SP2 version of Sysprep's Mini-Setup and the changes made to the Administrator account will be copied to the default user account (KB 887816).
4.1. Final checklist
First, make sure the above criteria have been satisfied. With the above limitations outlined in section (3) in mind, check also that:
Sysprep can be run from the command or GUI mode. The sysprep.exe command has additional parameters not available in the GUI version; refer to MS KB 302577 for details.
4.2. How to install Sysprep tools
Create a folder named Sysprep in the root of C on the reference computer where Windows XP is already installed.
The Sysprep.exe, Setupcl.exe and Sysprep.inf files must be located in the Sysprep folder which must be in the root of C. If you run Sysprep in factory mode the factory.exe file must also be present in the same folder. If you wish to use Setup Manager then include the setupmgr.exe file when copying.
For testing purposes, the reference computer should not be a production computer, not joined to a domain and isolated from the rest of the LAN. It is advisable to practise running Sysprep in a test computer or virtual guest installation using VMWare or Virtual PC to familiarise yourself first.
Installation of Sysprep files and folder and running Sysprep can be automated at the end of an unattended installation.
4.3. The main buttons in Sysprep GUI
Factory (command: -factory) - for configurating and repeated restarting in a factory . It restarts in a network-enabled mode without running Windows Welcome or Mini-Setup and enables drivers, devices and programmes to be installed.
Audit (Audit Boot in pre-SP2; command: -audit)- only available in Factory mode and it restarts the computer again in Factory mode without generating new SIDs.
Reseal (command: -reseal) - it clears the Event Viewer logs and should be used after running the Factory mode and just before delivery to the end-user. When Windows next reboots it will run the Windows Welcome or Mini-Setup.
Don't reset grace period for activation (Pre-activated in pre-SP2; command: -activated) - not applicable for VLK media and for other versions the grace period is three times.
Use Mini-Setup (MiniSetup in pre-SP2; command: -mini) - not applicable to Windows XP Home Edition which always runs the Windows Welcome when the user first logs on. In Windows XP Professional the Mini-Setup Wizard can run instead of Windows Welcome using this switch. This can be made fully automated in sysprep.inf.
Don't regenerate security identifiers (NoSIDGen in pre-SP2; command: -nosidgen) - runs Sysprep while preserving the SIDs; useful for testing on a single computer.
Detect non Plug and Play hardware (PnP in pre-SP2, command: -pnp) - runs the full PnP device enumeration and installation of previous non-PnP devices; not needed if the computers that only use PnP devices.
For other commands only available in the command-line, please refer to MS KB 302577. To run Sysprep in command-line, in the command prompt type the following substituing optional parameterN for the specific parameter.
sysprep -optional parameter1 -optional parameterN
4.4. Running Sysprep
When you first run sysprep.exe (SP2 version) you'll see this warning (fig. 3); the message is slightly different (without mentioning the licence) in pre-SP2 version.
Fig. 3. System Preparation Tool 2.0
When you run Sysprep you'll see this message briefly indicating Sysprep is working (fig. 4). Normally it should not take long.
Fig. 4. Sysprep is working
Next, Windows will shutdown or reboot (depending on your choice) on an ACPI-enabled computer. On next reboot, there might be a slight delay (during PnP device detection) and this message may come up (fig. 5).
Fig. 5. Please wait while windows prepares to start....
In Factory mode, on booting to the desktop, this message comes up briefly before disappearing and Sysprep GUI dialogue box re-appears (fig. 6).
Fig. 6. Factory Preinstallation message
After using the Factory mode for the last time, remember to use the Reseal mode to prepare the installation ready for cloning. Do not restart Windows on the hard disk until after delivery to the end-user.
4.5. Automation of Mini-Setup in Sysprep
The Mini-Setup Wizard of Sysprep can be automated when provided with an answer text file, which is similar to the unattend.txt or winnt.sif for unattended Windows installations (see my separate tutorial) and must be named sysprep.inf.
The sysprep.inf file must be located in the same folder as Sysprep. Sysprep.inf can be made using a text editor or modified from an existing one or created using Setup Manager, found in the Deploy.cab, similar to creating unattended.txt, but select the Sysprep Answer file option (see my article on Unattended installation). For details of the sysprep.inf file, refer to MS KB 298491 and the Ref.chm documentation.
When Mini-Setup Wizard starts, it looks for sysprep.inf; if it does not find it or the file is named incorrectly, the wizard starts in interactive mode. Microsoft now recommends that sysprep.inf is put in the sysprep folder rather than a floppy disc as sometimes a different PnP ID generated makes the floppy not readable (KB 288326).
Sysprep.inf has two unique sections in addition compared to unattend.txt or winnt.sif: [Sysprep] and [SysprepMassStorage]. They enable disk cloning on computers with dissimilar disc controllers. The ability to automatically build a list of mass storage controllers is new to Sysprep in Windows XP. The correct syntax is:
The [SysprepMassStorage] section must be left empty for Sysprep to populate its entries. But if you have a disc which is not natively supported by Windows XP, you need to manually enter the inf details.
4.5.2. Automating additional commands at the end of Mini-Setup
You can also run additional commands at the end of Mini-Setup by including an [Unattended] section in sysprep.inf which points to the location of the cmdlines.txt in the distribution folder.
4.5.3. Registry key changes in Sysprep
Sysprep makes many changes to the registry before shutting down the computer: refer to MS KB 216680, 287506 and 298491 and Microsoft Windows XP Registry Guide.
If you have run Sysprep but now want to disable the Mini-Setup Wizard from running when the computer restarts, you need to reverse the changes made to the registry using the Recovery Console (KB 287506 outlines the method in Windows 2000; in Windows XP the principle is similar but there is no registry size limit).
4.5.4. Extending partition on destination computers
This applies to NTFS partitions only. Use the ExtendOemPartition entry in the [Unattended] section of sysprep.inf. Refer to MS KB 240126 for details.
4.5.5. Product activation in non Volume Licence versions
Windows Product Activation is required for retail versions of Windows XP and there is a limit of three times in which the Autoactivate parameter of sysprep.inf in Sysprep can be used (KB 299840). Otherwise you may see the "Error 0x80040605 Re-arming" error message (KB 308554).
WPA is not required for Volume Licence installations and therefore VLK versions are preferable.
4.5.6. Removing desktop icons and shortcuts
By default these are removed by Sysprep; to stop this happening refer to KB 307543.
4.6. After Sysprep: Windows Welcome and Mini-Setup
If you use sysprep.inf for a fully automated operation the user will not be prompted for any input the first time Windows is started. The following describes what happens when sysprep.inf is not used or when some of the entries are not entered.
By default when Windows XP is started the first time by the end-user on a new computer, the Windows Welcome guides the user for specific user information in a series of dialogues. The following shows the first screen (fig. 7).
Fig. 7. Windows Welcome
Alternatively, in Windows XP Professional (but not in Windows XP Home Edition) you can specify Mini-Setup to run instead by using the -mini switch. After the boot screen you will first see this (fig. 8).
Fig. 8. Mini-Setup starts
Next, the Wizard starts (fig. 9).
Fig. 9. Mini-Setup Wizard dialogue starts
You are prompted to accept the End User Licence Agreement (EULA) (fig. 10). You must accept the EULA to continue.
Fig. 10. Accept the EULA.
Next you will be asked to do the following (in this order).
The last window indicating the progress appears before rebooting (fig. 11). The Sysprep folder is deleted at the end. When the computer next reboots, the user logs on normally and will be able to use Windows XP straight away. If the end-user wishes to create other accounts he/she can do so now but not before in Mini-Setup.
Fig. 11. Performing Final Tasks
5. Possible problems after using Sysprep
These are published Microsoft KB articles on possible problems.
For convenience these are arranged starting with MS KB articles in numerical order (which does not necessarily reflect their chronological order of publication, revision or version of Windows discussed), followed by Microsoft Resource Kit, TechNet and books from Microsoft Press. Some references refer to older versions of Windows and Sysprep and are included for added information. Unavoidably some references contain duplicated information or are revised from time to time after writing this article.
KB 196667 System Preparation Tool (Sysprep) Script File Keys (Windows NT)
KB 216680 How to Identify an Installation Created with the Sysprep Tool (Windows 2000)
KB 216937 System Preparation Tool and Answer File Usage (Windows 2000; KB314460 for Windows XP)
KB248257 Program Installation Problems on Sysprep or Riprep Installed Systems (Windows 2000, fixed in SP1)
KB 251241 PRB: How to Use the System Preparation Tool to Prepare Computers for Shipping (Windows 2000)
KB 253942 FIX: Task Scheduler Task Only Runs in the Background After You Use Sysprep to Create Master Image (Windows 2000)
KB 259144 Computer May Hang After Using Sysprep on ACPI-Enabled Computer (in Windows 2000, version 1 of Sysprep; fixed in Windows 2000 SP2)
KB 287506 How to Disable Mini-Setup Wizard on a Computer on Which You Used Sysprep (Windows 2000)
KB 288977 The Computer May Stop Responding During the Shutdown Process When You Use the Sysprep Tool (Windows 2000, resolved by using Sysprep v. 1.1)
KB 298491 How To Use the System Preparation Tool (Sysprep.exe) to Perform Disk Duplication (Windows 2000)
KB 307316 Volume License product ID is revealed during the Sysprep.exe Mini-Setup wizard (fixed in SP1)
KB 314660 System Preparation Tool and Answer File Usage (Windows XP)
KB 317606 Duplicate Computer Names Are Created When Sysprep.exe Generates Random Computer Names (fixed in SP2)
KB 319928 Microsoft Links Do Not Appear in the MFU List After You Run Sysprep on a Windows XP Multilingual User Interface Pack Build (probably fixed in SP2)
KB 322936 Joining a Sysprep.exe Image of Windows XP Creates Duplicate Computer Accounts in Active Directory (fixed in SP1)
KB 812599 Opportunistic Locking May Not Be Granted If Windows Is Installed by Using Sysprep (fixed in SP2)
KB 812812 Not Prompted to Obtain a Digital Rights Management License for Installations Created by Using Sysprep (applies to WMP9 installed)
KB 814616 Known issues that affect program deployment when you use Sysprep (Windows Server 2003)
KB 815229 When using sysprep.exe, passwords cannot be saved (not sure if fixed in SP2)
KB 815496 The Sysprep Tool Does Not Correctly Clean Information in the "Protected Storage System Provider" Key (fixed in SP2)
KB 820885 Default Desktop Icons Are Removed When You Use the DoDesktopCleanUp Entry with Sysprep (behaviour was changed in SP1)
KB 827385 IIS settings are missing after you run Sysprep with the -nosidgen command-line switch (fixed in SP2)
KB 828287 Unsupported Sysprep scenarios
KB 828730 The Organization Name in Sysprep.inf Is Not Used to Randomly Generate a New Computer Name (changes in Windows 2000 SP3)
KB 831783 Security policies are not applied to a RIS or Sysprep deployed image of Windows XP on first start (fixed in SP2)
KB 887816 Changes in behaviour of the SysPrep and RIPREP tools after you install Windows XP Service Pack 2 (change in applying custom user profile in SP2)
Online documentation: Support\Deploy.cab\Deploy.chm (Microsoft Windows Corporate Deployment Tools User's Guide) and Ref.chm (Microsoft Windows Preinstallation Reference) files in the Windows XP Professional CD-ROM or their updated SP2 versions
Automating and Customizing Installations Microsoft Windows XP Resource Kit (also published separately as a book from Microsoft Press)
How to Use Sysprep: An Introduction (Microsoft TechNet)
How to Prepare Images for Disk Duplication with Sysprep (Microsoft TechNet)
How to Use Sysprep for Auditing Installations (Microsoft TechNet)
How to Use Sysprep to Automate Mini-Setup (Microsoft TechNet)
How to Use Sysprep to Restore the Computer to an End-User-Ready State (Microsoft TechNet)
How to Use Sysprep in Factory Mode (Microsoft TechNet)
Installing Windows XP - Building and Deploying an Image (Microsoft TechNet Community Chat 5 May 2003)
Windows XP Professional - Deploy (Microsoft TechNet page with links to various articles)
Microsoft Corporation, MCSE Exam 70-270 Microsoft Windows XP Professional Training Kit, (Redmond: Microsoft Press, 2002)
Honeycutt, Jerry, Microsoft Windows XP Registry Guide (Redmond: Microsoft Press, 2003)
Glenn, Walter and Northrup, Tony, MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing, Configuring, and Administering Microsoft® Windows® XP Professional, Second Edition (Redmond: Microsoft Press, 2005)
Go to TOP
Copyright © 2005 by Kilian. All my articles including graphics are provided "as is" without warranties of any kind. I hereby disclaim all warranties with regard to the information provided. In no event shall I be liable for any damage of any kind whatsoever resulting from the information. The articles are provided in good faith and after some degree of verification but they may contain technical or typographical errors. Links to other web resources may be changed at any time and are beyond the control of the author. Articles may be added, removed, edited or improved at any time. No support is provided by the author. All the products mentioned are trademarks of their respective companies.
This is not an official support page for any products mentioned. All the products mentioned are trademarks of their companies.
Created 15 Feb 2005, last updated 28 Feb 2005