Mapping Sysprep Settings

Mapping Sysprep Settings

When you run Sysprep, it modifies hundreds if not thousands of registry settings to prepare the computer's hard disk for duplication. Table 15-2 on the next page describes the registry settings that relate directly to Sysprep. These are settings that prepare Mini-Setup Wizard to run the next time Windows starts. I tracked these down by comparing snapshots of the registry before and after running Sysprep. I divided the table into sections, with each key in a different section.

Sysprep changes other settings that I don't describe in Table 15-2. The settings that it changes depend on the computer's configuration. For example, Sysprep disables Remote Desktop and Remote Assistance. It configures System Restore to create an initial system checkpoint the next time that Windows starts. Sysprep also resets the computer's digital ID and resets the Windows Product Activation timer. Last, if you're using [SysprepMassStorage], Sysprep fills the critical devices database and configures the device drivers for each device. The changes that Sysprep makes to the registry are numerous, but the following list summarizes some of the most significant differences that I found from comparing the registry snapshots:

• Sysprep resets the event system. These settings are in HKLM\SOFTWARE\Microsoft\EventSystem.

• Sysprep removes certificate templates and certificates from the following keys: HKLM\SOFTWARE\Microsoft\Cryptography HKLM\SOFTWARE\Microsoft\EnterpriseCertificates

• Sysprep resets the configuration of Group Policy in the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy.

• Sysprep removes the computer from the domain, if it's a domain member, by deleting the appropriate values from the following keys, and elsewhere: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DomainCache

• Sysprep removes policies from the key HKLM\SOFTWARE\Policies.

• Sysprep removes networking components from the following keys: HKLM\SYSTEM\CurrentControlSet\ControlHKLM\SYSTEM\CurrentControlSet\Enum HKLM\SYSTEM\CurrentControlSet\Services.

• Sysprep resets the application compatibility data in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility.

• Sysprep resets power management settings in the key HKLM\SYSTEM\ControlSet001\Control\Session Manager\Power.

• Sysprep configures the Netlogon service to load on demand instead of automatically in HKLM\SYSTEM\CurrentControlSet\Services\Netlogon.

• Sysprep adds the devices specified in [SysprepMassStorage] to the critical devices database. This database is in the key HKLM\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase.

• Sysprep installs and configures device drivers for the devices listed in the [SysprepMassStorage] section. It configures these device drivers in the key HKLM\SYSTEM\CurrentControlSet\Services.

Table 15-2 Sysprep Registry Settings

Value	Type	Description
HKLM\SOFTWARE\Microsoft\Sysprep
SidsGenerated	REG_DWORD	Sysprep sets this value to 0x01, indicating that it removed the computer's SID and Setupcl.exe will regenerate it.
CriticalDevicesInstalled	REG_DWORD	Sysprep sets this value to 0x01, indicating that it created the critical devices database.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
SourcePath	REG_DWORD	Sysprep sets this to the value of InstallFilesPath in Sysprep.inf, which indicates to the setup program where to find installation files.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE
RunWelcomeProcess	REG_DWORD	Sysprep sets this value to 0x00, which disables the Windows Welcome out-of-box experience.
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\SidCache
MachineSid	REG_BINARY	Sysprep deletes this value to remove the computer's SID.
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager
SetupExecute	REG_MULTI_SZ	Setup adds Setupcl.exe to this value. This runs Setupcl.exe when Windows restarts so that Setupcl.exe can regenerate the computer's SID and run Mini-Setup Wizard.
HKLM\SYSTEM\Setup
BootDiskSig	REG_DWORD	Sysprep stores the signature of the boot disk in this value.
CloneTag	REG_MULTI_SZ	Sysprep stores the date and time that you ran the prepared disk in this value.
Cmdline	REG_SZ	Sysprep stores the setup command line setup -newsetup -mini in this value. This is the command that runs Mini-Setup Wizard.
MiniSetupInProgress	REG_DWORD	Sysprep sets this value to 0x01, indicating that Mini-Setup Wizard is in the process of running.
SetupType	REG_DWORD	Sysprep sets this value to 0x01.
SystemSetupInProgress	REG_DWORD	Sysprep sets this value to 0x01.