Sysprep Windows 10 and 11 Machine: Step by Step Guide

You can alter Windows 10 or 11 reference images with the Windows System Preparation Tool (Sysprep). A Windows installation image can be used to install programmes, drivers, and slipstream updates. After that, you can deploy the Windows image to your company’s machines.

We’ll teach you how to utilise Sysprep to produce the reference image for Windows 10 21H1 (19043.1320) and Windows 11 21H2 (22000.258) builds in this article. Use this guide to produce a ready-to-use Windows image that you can install on a physical or virtual system (VDI solutions).

What exactly is SysPrep?
You must configure a reference image before delivering a Windows image to users’ machines. Install required drivers and apps, as well as other Windows settings. By removing computer-specific information, the resulting image must be generic (SID, GUID, etc.). The Sysprep programme can be used to generalise the Windows image.

You can use Sysprep to remove all information associated with a given operating system instance. Unique identifiers (SID, GUID, etc. ), the Windows activation reset, and installing software and drivers in Audit mode are all examples of this.

All of the operating system’s settings are preserved before you execute Sysprep. Installed software, personalization and network settings, installed and pinned Metro apps on the start screen, File Explorer, and other characteristics are all included in this list.

The Sysprep.exe application is found in the C:WindowsSystem32sysprep folder in Windows 10/11 and Windows Server 2019/2022.

You can deploy a prepared reference Windows 10 image to all corporate PCs using MDT, WDS, SCCM, or manually after installing it and configuring it correctly (with certain installed software, operating system settings, and defined permissions and limits) (take a look at Deploying Windows 10 with MDT and WDS).

How can I make a reference image for Windows 10 or 11?
You can make a reference WIM image of Windows 11 or 10 by following the procedures below:

1. Install Windows 10/11 from the ISO image cleanly, then activate Audit Mode.
2. Install applications, drivers, and system settings;
3. Using the Sysprep utility, prepare the operating system environment;
4. Using the DISM tool, boot into Windows PE and capture an image.

The image WIM created can then be added to the installation disc or distributed using tools like MDT, WDS, DISM, or ImageX.

Using Sysprep to customise Windows 11 and 10 in Audit Mode

In Audit Mode, you must customise your reference Windows Image. By hitting Shift + Ctrl + F3 on the OOBE (out-of-box experience user experience) or the Windows Welcome screen on the installed Windows 10/11 OS, you can boot Windows to Audit Mode or OOBE. Sysprep can also be used to enter Audit Mode. To do so, open the Sysprep folder in File Explorer, press Shift, right-click on an empty area, and choose Open PowerShell windows here or Open in Windows Terminal from the context menu.

Then run the following command:

C:\windows\system32\sysprep\sysprep.exe

In the System Preparation Tool window, select the options:

• System Cleanup Action: Enter System Audit mode;
• Shutdown Options: Reboot;
• Press the OK button.

In our case, Sysprep is returning the following error:

System Preparation Tool 3.14

Sysprep was not able to validate your Windows installation. Review the log file at %WINDIR%\System32\Sysprep\Panther\setupact.log for details. After resolving the issue, use Sysprep to validate your installation again.

To find out the reason why Sysprep cannot start on your computer, press Win + R and run the command:

%WINDIR%\System32\Sysprep\Panther\setupact.log

Look for the Error lines in the setupact.log file. In our case, the error looks like this:

2021-11-19 06:12:56, Error SYSPRP Sysprep_Clean_Validate_Opk: Audit mode cannot be turned on if reserved storage is in use. An update or servicing operation may be using reserved storage.; hr = 0x800F0975

2021-11-19 06:12:56, Error SYSPRP ActionPlatform::LaunchModule: Failure occurred while executing ‘Sysprep_Clean_Validate_Opk’ from C:\Windows\System32\spopk.dll; dwRet = 0x975

2021-11-19 06:12:56, Error SYSPRP SysprepSession::Validate: Error in validating actions from C:\Windows\System32\Sysprep\ActionFiles\Cleanup.xml; dwRet = 0x975

2021-11-19 06:12:56, Error SYSPRP RunPlatformActions:Failed while validating Sysprep session actions; dwRet = 0x975

2021-11-19 06:12:56, Error [0x0f0070] SYSPRP RunDlls:An error occurred while running registry sysprep DLLs, halting sysprep execution. dwRet = 0x975

2021-11-19 06:12:56, Error [0x0f00d8] SYSPRP WinMain:Hit failure while pre-validate sysprep cleanup internal providers; hr = 0x80070975

The cause of the Sysprep error in our instance is as follows: “An update or service activity may be consuming reserved storage.” This indicates you can’t use Sysprep right now because some changes have locked your Windows image. Updates, Windows features, system programmes, antiviruses, and other software can all be installed.

To access Windows Updates, go to Settings > Windows Updates. There are various Pending Updates as you can see. Complete the security update installation, restart your machine, and run Sysprep once again.

The computer will restart and boot into Audit Mode automatically. When Windows is in Audit Mode, it automatically boots and logs in with the built-in administrator account. This account will also be disabled.

Windows 11/10 will boot in this mode no matter how many times you reboot your computer until the Sysprep is running.

The Sysprep dialogue in the centre of the screen is the sole apparent indication that you’ve reached the Windows Audit Mode desktop. You’ll need the Sysprep utility window at the end of the configuration process, so don’t close it. Reduce it to a bare minimum.

You can configure your Windows reference image in Audit Mode. We’ll look at a few of the most common processes that sysops include in their reference picture.

Step 1: Install OEM Information and Logo

In the computer properties windows, you can customise your company’s branding. We’ll set up OEMLogo, Company name, tech support website, and working hours in this example. The registry is the simplest approach to change these values. Create an oem.reg text file and paste the following code into it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation]

“Logo”=”C:\\WINDOWS\\oem\\OEMlogo.bmp”

“Manufacturer”=”solutionviews, LLC”

“Model”=”Windows 10 Pro 21H1”

“SupportHours”=”9am to 5pm ET M-F”

“SupportURL”=”https://solutionviews.com”

Note. First, create the graphic file C:\WINDOWS\oem\OEMlogo.bmp with your company logo.

To apply the reg file, double-click on it, and accept registry changes. As a result, these settings will be imported into the registry.

After rebooting in the System Properties, you can see the following branded info:

Step 2: Install the Drivers and Apps

You can install drivers and third-party programs you would like to see in your Windows 10/11 image.
You can install programs manually, or using the Windows 10 package manager — Chocolatey.

Now install the Chocolatey. To do this, run the PowerShell console with administrator privileges. Enter the following commands:

Set-ExecutionPolicy Bypass -Scope Process -Force; `

iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))

Restart the PowerShell console. Now you can install more programs with a single command.

Let’s say, we want to install Opera, Google Chrome, VLC media player, Adobe Acrobat Reader DC, 7Zip, K-Lite Codec Pack Full, and Zoomit using choco. Run the command:

choco install 7zip, Opera, googlechrome, vlc, adobereader, k-litecodecpackfull,zoom

On Windows 11, you can use the new built-in WinGet Package Manager to install the required software (about 3000 programs available in WinGet repo). To install the same set of programs, run the command:

winget install --id=7zip.7zip -e && winget install --id=Opera.Opera -e && winget install --id=Google.Chrome -e && winget install --id=VideoLAN.VLC -e && winget install --id=Adobe.Acrobat.Reader.32-bit -e && winget install --id=CodecGuide.K-LiteCodecPack.Full -e && winget install --id=Zoom.Zoom –e

You can also install drivers for all PC and laptop models on which this reference Windows 10/11 image will be installed. Download the driver packages and extract them to a particular directory. Then, using the command: *.inf, look for all *.inf files and inject all the drivers mentioned there into the Windows image.

for /f %i in ('dir /b /s *.inf') do pnputil.exe -i -a %i

Step 3: Disable Telemetry and Data Collection in Windows 10/11

Windows 10 and 11 capture data on how users interact with their computers. Handwriting and voice samples, location data, error reports, and calendar entries are all examples of data that can be transferred to Microsoft servers.

You can disable the Telemetry and Data Collection services if you don’t want the OS to submit data to Microsoft’s telemetry servers. Run the following commands from the elevated Command prompt:

sc delete DiagTrack

sc delete dmwappushservice

echo ““ > C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-DiagTrack-Listener.etl

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f

Also, you can disable tracking in Windows 10 and 11 using the DisableWinTracking tool from GitHub.

Step 4: Install Windows Security Update in Audit Mode

Starting with Windows 8.1, you can’t use the Windows Update Center in the Settings panel in auditing mode to install updates. The Windows Update Center checks to see if the OOBE stage has been completed. The update will not be carried out if this is not the case.

You can download the PSWindowsUpdate Module from the TechNet Gallery to update the system from the console.

Save the PSWindowsUpdate.zip archive to a USB stick and right-click it > Properties > Unblock (this is critical!).

PSWindowsUpdate.zip should be extracted to both folders:

• %USERPROFILE%\Documents\Windows\PowerShell\Modules;
• %WINDIR%\System32\Windows\PowerShell\v1.0\Modules.

To download and install all available Windows updates, run the commands:

PowerShell -ExecutionPolicy RemoteSigned -Command Import-Module PSWindowsUpdate;

Get-WUInstall -AcceptAll -IgnoreReboot

That concludes our discussion. Updates will be downloaded and installed automatically from the Windows Update servers.

Step 5: Uninstall Built-in Microsoft Store Apps

You can also uninstall the built-in UWM programmes, but that is entirely up to you. If you don’t want to remove built-in apps, simply skip this step.

The pre-installed Microsoft programmes in Windows 10 21H1 are listed below.

Get-AppxPackage *3dbuilder* | Remove-AppxPackage

Get-AppxPackage *windowsalarms* | Remove-AppxPackage

Get-AppxPackage *windowscalculator* | Remove-AppxPackage

Get-AppxPackage *windowscommunicationsapps* | Remove-AppxPackage

Get-AppxPackage *windowscamera* | Remove-AppxPackage

Get-AppxPackage *officehub* | Remove-AppxPackage

Get-AppxPackage *skypeapp* | Remove-AppxPackage

Get-AppxPackage *getstarted* | Remove-AppxPackage

Get-AppxPackage *zunemusic* | Remove-AppxPackage

Get-AppxPackage *windowsmaps* | Remove-AppxPackage

Get-AppxPackage *solitairecollection* | Remove-AppxPackage

Get-AppxPackage *bingfinance* | Remove-AppxPackage

Get-AppxPackage *zunevideo* | Remove-AppxPackage

Get-AppxPackage *bingnews* | Remove-AppxPackage

Get-AppxPackage *onenote* | Remove-AppxPackage

Get-AppxPackage *people* | Remove-AppxPackage

Get-AppxPackage *windowsphone* | Remove-AppxPackage

Get-AppxPackage *photos* | Remove-AppxPackage

Get-AppxPackage *bingsports* | Remove-AppxPackage

Get-AppxPackage *soundrecorder* | Remove-AppxPackage

Get-AppxPackage *bingweather* | Remove-AppxPackage

Get-AppxPackage *xboxapp* | Remove-AppxPackage

The list of built-in MS Store Apps on Windows 11 21H2 has changed. Use the following PowerShell script to remove the preinstalled Windows 11 apps:

Remove built-in MS Store Apps on Windows 11 21H2:

#AV1 Codec

Get-AppxPackage *AV1VideoExtension* | Remove-AppxPackage

#News app

Get-AppxPackage *BingNews* | Remove-AppxPackage

#Weather

Get-AppxPackage *BingWeather* | Remove-AppxPackage

#PowerShell

Get-AppxPackage *PowerShell* | Remove-AppxPackage

#WebP image support

Get-AppxPackage *WebpImageExtension* | Remove-AppxPackage

#HEIF image support

Get-AppxPackage *HEIFImageExtension* | Remove-AppxPackage

#Windows Terminal

Get-AppxPackage *WindowsTerminal* | Remove-AppxPackage

#Music app

Get-AppxPackage *ZuneMusic* | Remove-AppxPackage

#Movies and TV

Get-AppxPackage *ZuneVideo* | Remove-AppxPackage

#MS Office

Get-AppxPackage *MicrosoftOfficeHub* | Remove-AppxPackage

#People app

Get-AppxPackage *People* | Remove-AppxPackage

#Maps

Get-AppxPackage *WindowsMaps* | Remove-AppxPackage

#Help and tips

Get-AppxPackage *GetHelp* | Remove-AppxPackage

#Voice Recorder

Get-AppxPackage *WindowsSoundRecorder* | Remove-AppxPackage

#Notepad

Get-AppxPackage *WindowsNotepad* | Remove-AppxPackage

#MS Paint

Get-AppxPackage *Paint* | Remove-AppxPackage

#Sticky Notes

Get-AppxPackage *MicrosoftStickyNotes* | Remove-AppxPackage

#PowerAutomate

Get-AppxPackage *PowerAutomateDesktop* | Remove-AppxPackage

#Xbox and related apps

Get-AppxPackage *Xbox* | Remove-AppxPackage

#Feedback Hub

Get-AppxPackage *WindowsFeedbackHub* | Remove-AppxPackage

#Microsoft To-Do

Get-AppxPackage *Todos* | Remove-AppxPackage

#Calculator

Get-AppxPackage *WindowsCalculator* | Remove-AppxPackage

#Alarms and Clocks

Get-AppxPackage *WindowsAlarms* | Remove-AppxPackage

#Teams/Chat

Get-AppxPackage *Teams* | Remove-AppxPackage

#Microsoft Edge

Get-AppxPackage *MicrosoftEdge* | Remove-AppxPackage

#Your Phone

Get-AppxPackage *YourPhone* | Remove-AppxPackage

#Spotify

Get-AppxPackage *SpotifyAB.SpotifyMusic* | Remove-AppxPackage

#Screen & Sketch/Snipping tool

Get-AppxPackage *ScreenSketch* | Remove-AppxPackage

#Solitaire Collection

Get-AppxPackage *MicrosoftSolitaireCollection* | Remove-AppxPackage

#Photos

Get-AppxPackage *Windows.Photos* | Remove-AppxPackage

#OneDrive

Get-AppxPackage *OneDriveSync* | Remove-AppxPackage

#Skype

Get-AppxPackage *SkypeApp* | Remove-AppxPackage

#Xbox Console Companion

Get-AppxPackage *GamingApp* | Remove-AppxPackage

Generalizing Windows 10/11 Image Using Sysprep

If your computer has a static IP address configured, specify that the address should be obtained automatically (from a DHCP server). You can do that in the network adapter settings.

Or, you can use the following PowerShell script to automatically get an IP address from a DHCP server:

$IPType = "IPv4"
$adapter = Get-NetAdapter | ? {$_.Status -eq "up"}
$interface = $adapter | Get-NetIPInterface -AddressFamily $IPType
If ($interface.Dhcp -eq "Disabled") {
If (($interface | Get-NetIPConfiguration).Ipv4DefaultGateway) {
$interface | Remove-NetRoute -Confirm:$false
}
$interface | Set-NetIPInterface -DHCP Enabled
$interface | Set-DnsClientServerAddress -ResetServerAddresses
}

After everything is configured, you can run the Sysprep and select the options:

• System Cleanup Action: Enter System Out-of-Box Experience (OOBE);
• Shutdown Options: Shutdown;
• Check the Generalize option.

It will start from Out-of-Box Experience (OOBE) mode after generalising the Windows image and reassign unique SIDs at the initial boot.

Using Sysprep and Answer Files for an Unattended Windows 10/11 Installation

With the System Preparation (Sysprep) programme, you can use an answer file. It allows you to configure Windows Setup settings without having to be present. This is an optional step (used to automatically specify various parameters that must be configured when the image is at first run). You can go ahead to the phase of capturing a Windows image by skipping this step.

How to Create Windows 10 Answer File Using Windows System Image Manager?

You can manually construct a response file (this is simple XML). However, utilising the Windows System Image Manager (SIM) application to generate the proper answer file is more convenient. It’s possible to do so using the Windows Assessment and Deployment Kit (ADK).

Download the Windows Assessment and Deployment Kit (ADK) for Windows 10 or the Windows Assessment and Deployment Kit (ADK) for Windows 11. For the Windows version you want to deploy, use the ADK version.

With administrator credentials, run the adksetup.exe file. Then, to install, choose Deployment Tools (it includes the latest version of DISM and Windows System Image Manager).

You will need install.wim file with the Windows 10 or image you want to deploy. You can copy the install.wim file from the sources directory on the installation Windows 10 ISO image. If only the install.esd file is available in the sources directory, you can convert it to the install.wim.

Let’s create an answer unattended file for Windows 10 21H1.

Run the Windows System Image Manager with administrator privileges (C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\WSIM\imgmgr.exe). Select File > New Answer File.

SIM will ask you to select a Windows picture file for which an answer file should be created. Set the path to the install.wim file that was previously installed.

Wait for the SIM to produce the catalogue file and mount the Windows installation image (.clg). The install Windows 10 Pro.clg file will appear in the same location as the install.wim file after some time.

To resolve this issue, make sure you have the most recent versions of ADK and WSIM for your Windows build.

Choose a Windows 10 edition. If your install.wim file contains only one Windows edition, it will be selected automatically.

You can configure numerous parameters for the answer file using WSIM. You can customize the Windows product key (if you’re using KMS or MAK keys), the time zone, organization and owner information, default language and region settings, input locales, and so on.

First and foremost, we must instruct Sysprep to replicate all of our customized user profiles to the default user profile.

To do this, in the Windows Image section, find the amd64_Microsoft-Windows-Shell-Setup__neutral section. Right-click on it and select Add Setting to Pass 4 specialize.

Then, in the Answer File panel, expand section 4 Specialize > amd64_Microsoft-Windows-Shell-Setup__neutral. Set the CopyProfile value to TRUE.

Additionally, you can configure the following options in the Answer file.

Pass 1 Windows PE

Choosing an installation language in WinPE:

Microsoft-Windows-International-Core-WinPE

InputLocale: en-US;

SystemLocale: en-US

UILanguage: en-US

UserLocale: en-US

The Windows 10 Product key:

Microsoft-Windows-Setup -> UserData -> ProductKey -> Key = {specify your MAK or GVLK key}

To automatically accept user agreement:

Microsoft-Windows-Setup -> UserData -> AccepptEula = True

Pass 7 oobeSystem

Skip Microsoft account creation screen (MSA):

Microsoft-Windows-Shell-Setup –> OOBE -> HideOnlineAccountScreens = True

Do not ask 3 security questions for your local account:

Microsoft-Windows-Shell-Setup –> OOBE -> ProtectYourPC= 3

Create a local administrator account and set a password for it:

Microsoft-Windows-Shell-Setup –> UserAccounts –> LocalAccounts -> Insert New Local Account

Name: admin

Group: Administrators

All empty (blank) answer file parameters must be removed.

To check the settings in answer files, select in Tools > Validate Answer File option. If you configured everything correctly, a message should appear in the Messages console: No warning or errors.

Save the answer file by choosing File > Save Answer File As > autounattend.xml.

Now you can close WSIM.

Generalize Windows Image Using Answer File

Now you can use your autounattend file to Sysprep your Windows 10 image. Run the elevated command prompt, and execute the following command (replace the path to autounattend.xml with yours):

c:\windows\System32\Sysprep\sysprep.exe /generalize /oobe /generalize /shutdown /unattend:C:\ps\autounattend.xml

With the /generalize option the Sysprep will remove unique computer data. This allows you to safely deploy this reference Windows 10 image on another workstation or laptop. After executing the command, the computer will shut down.

Capture Reference Windows 10/11 Using DISM after Generalize

After shutting down your computer, you can capture a customized Windows 10 image using MDT. You can also use other special tools for capturing a Windows image or using DISM. Below we will consider the DISM option.

Note that the ImageX tool may be used to capture and deliver an image in previous versions of Windows. All of this is possible with DISM in the current Windows 10 and 11 releases.

Boot the PC into Windows PE using the Windows reference image. This can be accomplished by booting the computer from the Windows 10/11 installation or recovery DVD.

Press Shift + F10 on the language selection screen.

Type Diskpart command in the command window that appears. To identify the drive letters, use the list vol command. The installed Windows image is on disc D in our case.

Run the following command to capture the image:

/imagefile — the wim image file that we need to create;
/Capturedir — the reference Windows installation folder.

Copy the wim Image file from a local disk. Import it into your deployment software (MDT, SCCM), or put it on the installation drive (rename the file to install.wim).