Export (0) Print
Expand All
9 out of 14 rated this helpful - Rate this topic

Boot Windows to Audit Mode or OOBE

Updated: October 20, 2013

Applies To: Windows 8, Windows 8.1, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2

You can use audit mode to customize your computer, add applications and device drivers, and test your computer in a Windows environment. Booting to audit mode starts the computer in the built-in administrator account. Windows® removes this account automatically during the generalize configuration pass. After you configure a computer to boot to audit mode, the computer will continue to boot to audit mode by default until you configure the computer to boot to Out-Of-Box Experience (OOBE) when the computer ships to the user.

If a password-protected screen saver starts when you are in audit mode, you cannot log back on to the system. The built-in administrator account that is used to log on to audit mode is immediately disabled after logon. To disable the screen saver, either change the power plan through Windows Control Panel or configure and deploy a custom plan. For more information, see Create a Custom Power Plan.

In this topic:

  • To configure Windows to boot to audit mode, add the Microsoft-Windows-Deployment | Reseal | Mode = audit answer file setting.

    When Windows completes the installation process, the computer boots into audit mode automatically, and the System Preparation (Sysprep) Tool appears. For more information about using the Sysprep tool in audit mode, see Sysprep (Generalize) a Windows installation.

    noteNote
    Settings in an answer file from the oobeSystem configuration pass do not appear in audit mode. For more information about which answer file settings are processed when you boot to audit mode or OOBE, see How Configuration Passes Work.

  • At the OOBE screen, press CTRL+SHIFT+F3.

    Windows reboots the computer into audit mode, and the System Preparation (Sysprep) Tool appears.

    noteNote
    The CTRL+SHIFT+F3 keyboard shortcut does not bypass all parts of the OOBE process, such as running scripts and applying answer file settings in the oobeSystem configuration pass.

  • To configure Windows to boot to OOBE, add the Microsoft-Windows-Deployment | Reseal |Mode= oobe answer file setting.

    If you have configured your Windows image to boot to OOBE, but then you need to make further configurations to your image in audit mode, see Modify an existing image that is configured to boot to OOBE.

  • If you have configured your Windows image to boot to OOBE, but then need to make further configurations to your image in audit mode, you can do one of the following:

    • Use the CTRL+SHIFT+F3 keyboard shortcut. The computer will reboot into audit mode.

      This option may trigger any scripts that you have configured to launch in OOBE.

      -or-

    • Mount the image, add an answer file with the audit setting, and save it as C:\test\offline\Windows\Panther\Unattend\Unattend.xml. This may require overwriting an existing answer file at this location.

      On the next boot, Windows will boot directly into audit mode.

  1. Create a new answer file, and then add the Microsoft-Windows-Deployment | Reseal | Mode = audit setting. Save the answer file as Unattend.xml.

  2. At an elevated command prompt, mount the Windows image. For example:

    Dism /Mount-Image /ImageFile:C:\test\images\MyImage.wim /index:<image_index> /MountDir:C:\test\offline
    

    where <image_index> is the number of the selected image on the .wim file.

  3. Copy the new answer file to the C:\test\offline\Windows\Panther\Unattend folder.

  4. Commit the changes, and then unmount the image. For example:

    Dism /Unmount-Image /MountDir:C:\test\offline /commit
    

    When the image is applied to the destination computer and Windows is booted, the computer boots into audit mode automatically, and the Sysprep tool appears. For sample procedures, see Step 1: Transfer an image to a different computer and Step 2: Prepare the computer for a customer in Deployment examples.

Options for applying an image also include using answer file settings, such as specifying the image to install and the disk configurations to make on the destination computer. For more information, see the Unattended Windows Setup Reference Guide.

To transfer an image to a different computer, you must first remove the computer-specific information from the configured computer by generalizing the image with the Sysprep tool. To prepare a computer for the customer, you must generalize the computer, and then set it to boot to OOBE when a customer starts the computer for the first time. In the following examples we create and transfer a reference image to a different computer, and then create a model-specific image that ships to a customer.

  1. Install Windows on a reference computer.

  2. After the installation is complete, boot the computer and install any additional device drivers or applications.

  3. After you update the Windows installation, run Sysprep:

    • At the command line, run the Sysprep /generalize /shutdown command.

      -or-

    • In the System Preparation Tool window, select the Generalize check box under the System Cleanup Action box on the Shutdown Options box, select Shutdown, and then click OK.

    Sysprep removes system-specific data from the Windows installation. System-specific information includes event logs, unique security IDs (SIDs), and other unique information. After Sysprep removes the unique system information, the computer shuts down.

  4. After the computer shuts down, insert the Windows PE USB flash drive or other bootable media, and reboot into Windows PE.

  5. In the Windows PE session, capture the reference image by using the Dism /capture-image command.

  6. Proceed to the next step to create a model-specific reference image.

  1. Install the reference image you created in Step 1: Transfer an image to a different computer on a computer that that is destined for your customer.

  2. After you update the Windows installation, at the command line run the Sysprep /audit /generalize /shutdown command to configure Windows to boot the computer to audit mode. You can then capture the Windows image by booting to another partition or by using Windows PE.

  3. Use the new model-specific reference image to install Windows on a new computer. The Windows image is applied to the computer, and Windows boots to audit mode.

  4. (Optional) You can install additional applications and other updates based on a customer's order. You can also test the computer to verify that all components are working correctly.

  5. After you update the Windows installation, run the Sysprep /oobe /shutdown command.

    noteNote
    If you install Windows images by using the Sysprep /generalize /oobe command, the user experience will not be ideal. On the next reboot after you run the Sysprep /generalize /oobe command, Windows runs the specialize configuration pass, Plug and Play, and other Setup tasks before Windows starts OOBE. This process can take additional time and can delay a customer's first logon.

  6. Package and deliver the computer to your customer.

    When the customer starts the computer, OOBE runs.

See Also

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.