Sysprep is one of those things that seems to have a certain mystique that surrounds it. My experience is that administrators either don't run it because they don't understand it or because they don't know how. Urban legend is also that it’s just not necessary to run Sysprep in some scenarios. The bottom line is that when making an image for duplicating Windows installs Sysprep is absolutely necessary as part of the imaging process. I'm not going to cover what Sysprep does here since that's not the focus, but the summary version is that Sysprep removes all identifying information about the source machine when it's executed (e.g. Computer name, SID, Product key, etc.). The rest of this post is geared primarily towards desktop imaging, but everything still applies for building server images.
Sysprep is on the Windows CD and the service pack CDs in the support folder in a file called deploy.cab. It's also available online:
If you need a version that isn't linked above either grab it from the CD or just search www.microsoft.com/downloads for Sysprep. There's a utility called setupmgr.exe in the archive which is what we can use to build the majority of the answer file for us. Most of it is self explanatory, I've included screenshots and explanations of steps that require some planning/thought.
The first question of note is what type of answer file to build. For this procedure we want a Sysprep setup:
The next important question is when we're asked about the license agreement and if we want to fully automate the installation (we do):
After telling the wizard you wish to fully automate the installation you'll get a screen with a tree view on the left and a set of Back/Next buttons. Most of this stuff is very self explanatory. The product key is an important one. You need to have a volume license key or you'll be activating each machine (and you'll run out of activations). Imaging without volume license keys is a recipe for disaster; I've seen it happen:
Computer name is another step that depends on a few factors. If you're doing mass imaging with a product like Ghost or Altiris, set it to Automatically Generate. If you're going to be doing one off imaging without something to automate the naming for you, leave it to Automatically Generate and we'll come back later to set Sysprep to prompt for this information.
Unfortunately, the wizard doesn't seem to support setting the Administrator Password by default, so just put something temporary in for now and we'll get rid of it later. You also get the option to automatically log on as the administrator some N number times. This is useful for running post imaging scripts. A word of caution is that the username and password for the administrator account is stored in the registry in plain text when this option is used, and it is not cleaned up at the end, so make sure your script does this cleanup step when it finishes!
I leave Networking Components set as-is as it defaults to DHCP. Make sure your image machine is set to DHCP when it shuts down to be imaged or it may not come up that way!
Workgroup or domain is another option which depends on the imaging/duplication mechanism you employ. For one off imaging, it can be helpful to setup Sysprep to automatically join the machine to your domain. This is especially nice if you delegate the imaging process to a junior admin who may not have rights to do this themselves as the wizard will take care of it all. The account specified should have rights to create and delete computer objects and write access to all properties for Computer objects. It also needs the Add Computers to the Domain right delegated at the domain level. Don't be cheap and add the account to the Domain Admins group and forget about it. There is an additional option which can be specified in the Sysprep.inf file that will be generated which tells Sysprep to put the machine in a specific OU (this is not supported in Windows 2000). If you use this option the account only needs rights over that OU.
If you're using something like the Ghost Agent to automate the post imaging process, just choose the workgroup option and let Ghost manage joining the domain.
The rest of the wizard is pretty straight forward and I just fill it out even if some of the prompts aren’t really necessary. Install Printers is something I generally do via Group Policy, so I don't typically use that feature. Additional Commands can be used to specify post imaging tasks (e.g. scripts). Identification String has no functional value out of the box. It's just a string that's stored in the registry. I typically set it to something that identifies each image e.g. "Dell GX260 XP Pro BCD v1.1". This tells me that this machine is built with version 1.1 of my XP Pro image for the Dell GX260. I can then use scripts/inventory tools to report on what images are on PCs in my domain. The Identification String page has the Finish button which saves the Sysprep.inf file.
At this point you're done, or you can customize the process more by editing the resultant INF file manually. The two CHM files that come with Sysprep fully document every option available and are worth skimming just to know the format if nothing else.
As an example, I'm going to edit the Sysprep.inf file and setup a few additional settings:
- Using the administrator password configuration in my image rather than setting a new one;
- Extending the C partition to fill the hard disk;
- Prompting for the computer name;
- Joining the domain and putting the computer in a specific Organizational Unit.
Fresh out of the wizard the Sysprep.inf file should look something like this:
;SetupMgrTag
[Unattended]
OemSkipEula=Yes
InstallFilesPath=C:\sysprep\i386
[GuiUnattended]
AdminPassword="password1"
EncryptedAdminPassword=NO
TimeZone=35
OEMSkipRegional=1
OemSkipWelcome=1
[UserData]
ProductKey=ABCDE-ABCDE-ABCDE-ABCDE-ABCDE
FullName="Brian Desmond"
OrgName="Brian Desmond Consulting, LLC"
ComputerName=*
[SetupMgr]
DistFolder=C:\sysprep\i386
DistShare=windist
[Identification]
JoinDomain=DOMAIN
DomainAdmin=sysprepadmin
DomainAdminPassword=password
[Networking]
InstallDefaultComponents=Yes
To use the administrator password in the image, set AdminPassword=*. Also remove the EncryptedAdminPassword=NO line.
Extending the C partition to fill the hard disk is something I often do for desktop images depending upon the environment. To do this, add a line in the [Unattended] section called ExtendOEMPartition=1.
To prompt for the computer name, delete everything behind the =, such that ComputerName= is the whole line
To put the computer in a specific Organizational Unit in the Active Directory domain, add a line under the [Identification] section called similar to this: MachineObjectOU="OU=Desktops,OU=Machines,DC=Domain,DC=local". Obviously you’ll need to customize this string for your environment.
With all these additions the Sysprep.inf file now looks like this:
;SetupMgrTag
[Unattended]
OemSkipEula=Yes
InstallFilesPath=C:\sysprep\i386
ExtendOEMPartition=1
[GuiUnattended]
AdminPassword="!Password1"
EncryptedAdminPassword=NO
OEMSkipRegional=1
OemSkipWelcome=1
[UserData]
ProductKey=ABCDE-ABCDE-ABCDE-ABCDE-ABCDE
FullName="Brian Desmond"
OrgName="Brian Desmond Consulting, LLC"
ComputerName=*
[SetupMgr]
DistFolder=C:\sysprep\i386
DistShare=windist
[Identification]
JoinDomain=DOMAIN
DomainAdmin=sysprepadmin
DomainAdminPassword=password
MachineObjectOU="OU=Desktops,OU=Machines,DC=Domain,DC=local"
[Networking]
InstallDefaultComponents=Yes
To run the Sysprep utility, copy everything from the deploy.cab or the download to a folder called c:\sysprep and launch sysprep.exe. Choose the Reseal option and make sure the option to run mini-setup is checked. Everything will take care of itself from here. The machine will shutdown and be ready to have an image captured. My suggestion is to boot the machine back up and test the Sysprep process to make sure things go as planned.
That's it. I keep a folder called Syspreps on the imaging server which I then create subfolders of for each configuration. I copy the entire contents of the deploy.cab as well as the Sysprep.inf for each configuration to this folder so I have it available anytime an image is going to get updated.
Comments, Trackbacks, & Pingbacks
#1 re: How to Build a Sysprep Answer File for Imaging
Tuesday, January 16 2007 6:29 PM by Emanuel#2 re: How to Build a Sysprep Answer File for Imaging
Wednesday, January 17 2007 3:00 PM by Denise MarchalI am looking for a way so that it will prompt for DomainAdmin and DomainAdminPassword. If I leave these blank like I did for ComputerName it doesn't stop and prompt for this. Would like to be able to enter username and password for a user who has authority to add a computer to the domain... do you know how to do this?
#3 re: How to Build a Sysprep Answer File for Imaging
Wednesday, January 17 2007 3:07 PM by Denise MarchalNevermind, I just figured it out. I just left the three fields empty like:
JoinDomain=
DomainAdmin=
DomainAdminPassword=
#4 re: How to Build a Sysprep Answer File for Imaging
Thursday, December 13 2007 10:27 AM by Justin LThis is a great tutorial. I used this for help with the Admin password, I couldn't figure out how to let sysprep know to use the password on the image (by putting the wildcard * in). Time to update a lot of images, but thanks!
#5 re: How to Build a Sysprep Answer File for Imaging
Wednesday, July 09 2008 10:14 AM by xdThanks dude, saved me some trouble.
#6 re: How to Build a Sysprep Answer File for Imaging
Friday, December 05 2008 2:03 PM by Mitch KranitzHi Brian! I was just plugging away at another KIPP laptop blast and came across your article via a google search, and you helped me once again! I couldn't remember the machine name part, so I suppose you can send me an invoice for this!!! ;)
Thanks a lot for this, what a small world
#7 re: How to Build a Sysprep Answer File for Imaging
Monday, March 09 2009 9:54 AM by SteveDoes anyone know how to create a sysprep.inf file that will reassign the original client hostname (NetBIOS name) via resolving the client assigned IP address against DHCP or a WINS server?
Let's say you have 50 client PCs and you re-image all them but generic hostnames were assigned via sysprep. You want to retain their previous hostnames that are entered in DHCP.
Thoughts?
#9 re: How to Build a Sysprep Answer File for Imaging
Thursday, March 19 2009 3:55 PM by CraigHi Steve,
Great article! Got this working and thought I was the greatest, until a coworker imaged a box off of one of my sysprepped images. Sysprep adds the default links back into IE, which clutters up our custom links bar. Also, the default DHCP setup checks "Enable LMHOSTS", which we don't use, and unchecks "Use this connection's DNS Suffix in DNS..."-- which we do use. Minor annoyances, but they *are" annoying after getting the image just so. I'm sure these can be defined in the Networking section of the answer file, just don't have a clue how? I did try a star by Install Default Components, and removing the network section altogether. This did result in prompting (which works), but I'd like to keep it automated. Any ideas? Thanks again..
#10 re: How to Build a Sysprep Answer File for Imaging
Thursday, March 19 2009 3:58 PM by CraigUh, sorry Brian. Had Steve's name staring me in the face, so typed it.. ;-) Cheers.
#11 re: How to Build a Sysprep Answer File for Imaging
Friday, April 03 2009 7:15 PM by KazI had a non-blank administrator password within sysprep i left the admin password field blank. i then ran sysprep in fully automated mode.
Once i cloned it i powered on the server and now i am unable to login as administrator. What password did it reset to?
Thank you in advance for your help.
#13 re: How to Build a Sysprep Answer File for Imaging
Friday, April 03 2009 10:44 PM by kazi usually like to retype the password when i run sysprep on the master server as we always have a set password for the admin thus making sure i am in sync. But today when i ran the sysprep i mistakenly left it blank (while the admin password was set to "test12")
i tried to login with no password and the original admin set password (test12). I am still not able to login to the master server now that it is powered on.
hope this helps you understand my problem. i have totally run out of ideas. this is a w2003 sp2 VM in vmware.
#14 re: How to Build a Sysprep Answer File for Imaging
Friday, July 10 2009 7:23 AM by Mike LambourneI've been googling on WDS & sysprep for some weeks now trying to fathom out the replacement for RIS and finally through all comments/artices including these pages, managed to get to a somewhat satisfactory solution. We are an educational establishment in the UK so we are running server 2003 sp1 plus XP pro clients. What I can't find however is the correct settings in sysprep.inf to initialize the hard drive. Obviously with new machines with blank drives its fine. But if you have a corrupt machine and you want to rebuild, RIS was able to wipe the drive as it installed - but I can't get WDS/sysprep.inf to do this. Anyone achieved this?
#15 re: How to Build a Sysprep Answer File for Imaging
Wednesday, November 04 2009 11:40 PM by mmqFollow #7 and #8
Would you please explain more about the post-sysprep with a script? We have numbers of machines and want them to keep their original hostnames after re-imaging. What we are doing are to change hostnames manually and join them to a domain. Look forward to finding a solution for this. Appreciate for any advice or comments!
#16 re: How to Build a Sysprep Answer File for Imaging
Sunday, November 08 2009 12:09 PM by mmqThanks for your help. I am so behind and don't know what the associated binaries are.
The setting of our sysprep.inf is same as what you posted above. It is perfect to get a machine set before joining a domain, or joining domain OU with a hostname random assigned. Our case, for instance, we have a machine named class01. After we deploy a new image to this machine, its hostname should still be class01. All of our machines are joined a domain, with DHCP. We don't know how to let our sysprep.inf know which machine is which.
Based on this link http://www.symantec.com/connect/forums/need-help-sysprepinf-file-network-settings, is this way the one you suggested?
thanks for any tip on this!
------------------------
add a path of vbs on the sample image machine:
"C:\WINDOWS\Scripts\Network Settings"
script name: DNS Registration.VBS
On Error Resume Next Const FULL_DNS_REGISTRATION = FALSEConst DOMAIN_DNS_REGISTRATION = TRUE strComputer = "."Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")Set colNetCards = objWMIService.ExecQuery _ ("Select * From Win32_NetworkAdapterConfiguration Where IPEnabled = True")For Each objNetCard in colNetCards objNetCard.SetDynamicDNSRegistration FULL_DNS_REGISTRATION, _ DOMAIN_DNS_REGISTRATIONNext
Add following line in Sysprep:
[GuiRunOnce]
Command0="C:\WINDOWS\Scripts\Network Settings\DNS Registration.vbs"
#17 re: How to Build a Sysprep Answer File for Imaging
Thursday, December 24 2009 1:06 AM by Mohammed AliI have a problem sysprep works and I entered the activation key but when mini comes up it asks me to enter it again?? This should not happen. Any ideas?
#18 re: How to Build a Sysprep Answer File for Imaging
Sunday, February 14 2010 5:39 PM by JesusAwesome info dude!
#19 re: How to Build a Sysprep Answer File for Imaging
Monday, February 15 2010 11:30 AM by Hughthe vbs code returns and error. Is this code correct? thanks
#20 re: How to Build a Sysprep Answer File for Imaging
Friday, March 05 2010 2:12 AM by Corvoin answer to #7:
just in case someone still wants to know:
the tool "wsname" (search in google) can resolve the hostname after running sysprep in factory mode and write it to sysprep.ini. upon the next reboot the system is joined to active directory with the correct hostname.
#21 re: How to Build a Sysprep Answer File for Imaging
Thursday, April 08 2010 6:05 PM by PeterLine 4: net user administrator /active: yes (does "administrator" refer to the username or the permissions? The reason I ask is the username "administrator" has been change to "Hello". The Password:*
Line 7: AutoLogon (enabled: False) since I want to manually logon to the computer after sysprep. I also left Username:Hello
UserAccounts - AdministratorPassword:*
Local Account[Name="Hello"]
Description:Local Administrator
DisplayName:Hello
Group:Administrators
Name:Hello
Password*
I don't know why I can't login with username: Hello and the password I set in the image. Any thoughts or solutions?
#22 re: How to Build a Sysprep Answer File for Imaging
Wednesday, June 30 2010 12:50 AM by A tech at HeartCan sysprep rename multiple PC's in numeric order? If so please provide a detailed explanation. Example of PC naming convention: ccabw00, ccabw01, ccabw02
#23 re: How to Build a Sysprep Answer File for Imaging
September 21, 2006 9:22 PM by Brian Desmond's BlogNote that you'll need to have a Sysprep answer file created and the associated binaries. This post covers
#24 re: How to Build a Sysprep Answer File for Imaging
March 5, 2010 4:02 AM by Sysprep a Windows Server 2003 SP2 VPC | A Curious AriesPingback from Sysprep a Windows Server 2003 SP2 VPC | A Curious Aries
#25 re: How to Build a Sysprep Answer File for Imaging
July 11, 2010 12:48 AM by How to Sysprep in Windows Server 2008 R2 and Windows 7 : Brian Desmond's BlogPingback from How to Sysprep in Windows Server 2008 R2 and Windows 7 : Brian Desmond's Blog
#26 re: How to Build a Sysprep Answer File for Imaging
July 11, 2010 1:06 AM by How to Sysprep in Windows 2008 : Brian Desmond's BlogPingback from How to Sysprep in Windows 2008 : Brian Desmond's Blog
I have a problem sysprep works and I entered the activation key but when mini comes up it asks me to enter it again?? This should not happen :( Any ideas?