Customize Windows in Audit Mode

Published: October 22, 2009

Updated: October 22, 2009

Applies To: Windows 7, Windows Server 2008 R2

This section describes how to boot to audit mode, customize your computer, and then prepare your computer for end users.

To boot to audit mode

Boot to audit mode in one of the following ways:

For attended installations, from the Windows® Welcome screen, press SHIFT+CTRL+F3.
Run the Sysprep command with the /audit option to configure the computer to start in audit mode the next time it boots.
In unattended installations, configure the Microsoft-Windows-Deployment\Reseal\Mode setting to audit. For more information on this setting, see the Windows® Unattended Setup Reference.

When you configure a computer to boot to audit mode, it will boot to audit mode by default until you configure it to boot to Windows Welcome.

Working in Audit Mode

From audit mode, you can add additional device drivers, install applications, and test the validity of the installation. OEMs and corporations should use audit mode to complete their manual customizations before shipping the computer to an end user.

Caution
If you are in audit mode and a password-protected screen saver is activated, you will not be able to log back on to the system. This is because the built-in administrator account used to log on to audit mode is immediately disabled after log on. To disable the screensaver, either change the power plan through Windows Control Panel or configure and deploy a custom plan. For more information see the Configure Power Plans¹. Settings in an unattended answer file from the oobeSystem configuration pass will not appear in audit mode.

Caution

If you are in audit mode and a password-protected screen saver is activated, you will not be able to log back on to the system. This is because the built-in administrator account used to log on to audit mode is immediately disabled after log on.

To disable the screensaver, either change the power plan through Windows Control Panel or configure and deploy a custom plan. For more information see the Configure Power Plans¹.
Settings in an unattended answer file from the oobeSystem configuration pass will not appear in audit mode.

To change unattend settings while in audit mode

While in audit mode, you can create a new unattend file to modify system settings.

On your technician computer, in Windows System Image Manager (Windows SIM), create a new Unattend file. For more information, see Create a New Answer File².
In the unattend file, add with only the settings you want to change.
Save the file onto a portable storage device, such as a USB drive. Example: F:\Unattend-NewSettings.xml, where F: is the drive letter of the portable storage device.
Remove the portable storage device, and plug it into the reference or destination computer.

From a command line, run Sysprep using the /unattend setting referencing the file.

Example: sysprep.exe /audit /reboot /unattend:F:\Unattend-NewSettings.xml, where F: is the drive letter of the portable storage device.

This shuts down the computer, applies the new unattend settings, and reboots the computer back into audit mode.

Note
If your computer is joined to a network domain, and you run the sysprep command with the /audit option, the computer will be removed from the domain. You can rejoin the domain after the computer has booted back into audit mode.

Exiting Audit Mode and Preparing Computers for End Users

After you have completed your customizations and have verified that the computer is ready to ship to a customer, you can configure the system for end users.

To preconfigure Windows Welcome, see Automate Windows Welcome³.

Note
OEM and system builders must configure the computer to boot to Windows Welcome when an end user starts the computer. The end user must agree to the Microsoft License Terms.

You can pre-configure custom options in Windows Welcome by using the Oobe.xml content file. For more information, see Oobe.xml Technical Reference⁴.

To transfer an image to a different computer, you must first remove the computer-specific information from the configured computer. For information, see Prepare to Capture an Image for Deployment (Generalize)⁵.

To prepare the computer for deployment

To configure the computer to boot to Windows Welcome:

From audit mode, run the Sysprep command with the /oobe option.

-or-
In unattended installations, configure the Microsoft-Windows-Deployment\Reseal\Mode setting to oobe. For more information on this setting, see the Windows® Unattended Setup Reference.

The computer will restart and boot to Windows Welcome.