Sysprep /generalize /oobe (Respecialize)

R

Russ

New Member
Cruising the forums I see this has been asked a zillion times. I need to deploy a custom W10 21H2 image to a couple hundred machines. SCCM is in play so they need to have clean SIDs. For some reason when I generalize false/false then reseal with OOBE, my sysprep logs on the imaged machine all say respecialized vs. generalized. Am I missing something?
 
Last edited:
I don't think I've heard of "respecialized". Maybe you can detail your steps in the sysprep process. That might be more useful for our understanding of the problem.
 
Thanks for the reply Garlin... My steps... I baselined my image, then ran a successful sysprep /generalize /oobe /reboot and from there created a new .wim using gimagex. Loaded everything in to NTLite and optimized/customized as needed.

Unattended settings...

1715350561509.png


And the Sysprep log...

2024-05-10 06:59:24, Info [0x0f004d] SYSPRP The time is now 2024-05-10 06:59:24
2024-05-10 06:59:24, Info [0x0f004e] SYSPRP Initialized SysPrep log at C:\Windows\system32\Sysprep\Panther
2024-05-10 06:59:24, Info [0x0f0054] SYSPRP ValidatePrivileges:User has required privileges to sysprep machine
2024-05-10 06:59:24, Info [0x0f007e] SYSPRP FCreateTagFile:Tag file C:\Windows\system32\Sysprep\Sysprep_succeeded.tag does not already exist, no need to delete anything
2024-05-10 06:59:24, Info [0x0f005f] SYSPRP ParseCommands:Found supported command line option 'RESPECIALIZE'
2024-05-10 06:59:24, Info [0x0f005f] SYSPRP ParseCommands:Found supported command line option 'QUIET'
2024-05-10 06:59:24, Info SYSPRP WinMain:processing 're-specialize' internal provider request.
2024-05-10 06:59:24, Info SYSPRP RunDlls:Running platform actions specified in action file for phase 6
2024-05-10 06:59:24, Info SYSPRP SysprepSession::CreateSession: Successfully created instance with action file C:\Windows\System32\Sysprep\ActionFiles\ReSpecialize.xml, and mode <null>
2024-05-10 06:59:24, Info SYSPRP SysprepSession::Execute: Beginning action execution from C:\Windows\System32\Sysprep\ActionFiles\ReSpecialize.xml
2024-05-10 06:59:24, Info SYSPRP SysprepSession::CreateXPathForSelection: Sysprep mode in registry is <null>
2024-05-10 06:59:24, Info SYSPRP SysprepSession::CreateXPathForSelection: Processor architecture in registry is AMD64
2024-05-10 06:59:24, Info SYSPRP After sorting, components will be excuted in the following order:
2024-05-10 06:59:24, Info SYSPRP Name: Microsoft-Windows-PnpSysprep, Order: 256
2024-05-10 06:59:24, Info SYSPRP ActionPlatform::LaunchModule: Executing method 'Sysprep_Respecialize_Pnp' from C:\Windows\System32\sppnp.dll
2024-05-10 06:59:24, Info SYSPRP SPPNP: Sysprep_Respecialize_Pnp: Enter
2024-05-10 06:59:24, Info SYSPRP SPPNP: Created progress thread.
2024-05-10 06:59:24, Info SYSPRP SPPNP: Creating device install status thread.
2024-05-10 06:59:24, Info SYSPRP SPPNP: Waiting for device install status thread to exit.
2024-05-10 06:59:24, Info SYSPRP SPPNP: Status: Starting...
2024-05-10 06:59:24, Info SYSPRP SPPNP: Status: Total = 0, Complete = 0, Progress = 0% (0%)
2024-05-10 06:59:24, Info SYSPRP SPPNP: Status: Active
2024-05-10 06:59:24, Info SYSPRP SPPNP: Status: Total = 8, Complete = 1, Progress = 12% (12%)
2024-05-10 06:59:24, Info SYSPRP SPPNP: Installing devices.
2024-05-10 06:59:24, Info SYSPRP SPPNP: Persisting installed devices.
2024-05-10 06:59:24, Info SYSPRP SPPNP: Deferring startup of system services.
2024-05-10 06:59:24, Info SYSPRP SPPNP: Waiting for pending device installs.
2024-05-10 06:59:25, Info SYSPRP SPPNP: Status: Active
2024-05-10 06:59:25, Info SYSPRP SPPNP: Status: Total = 8, Complete = 2, Progress = 25% (25%)
2024-05-10 06:59:25, Info SYSPRP SPPNP: Status: Active
2024-05-10 06:59:25, Info SYSPRP SPPNP: Status: Total = 8, Complete = 3, Progress = 37% (37%)
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Active
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Total = 8, Complete = 4, Progress = 50% (50%)
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Active
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Total = 8, Complete = 5, Progress = 62% (62%)
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Active
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Total = 8, Complete = 6, Progress = 75% (75%)
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Active
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Total = 8, Complete = 7, Progress = 87% (87%)
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Active
2024-05-10 06:59:26, Info SYSPRP SPPNP: Status: Total = 8, Complete = 8, Progress = 100% (100%)
2024-05-10 06:59:26, Info SYSPRP SPPNP: Completed pending device installs.
2024-05-10 06:59:26, Info SYSPRP SPPNP: Alerting progress thread.
2024-05-10 06:59:26, Info SYSPRP SPPNP: Alerting device install status thread.
2024-05-10 06:59:26, Info SYSPRP SPPNP: Finished waiting for device install status.
2024-05-10 06:59:27, Info SYSPRP SPPNP: Devices pre-configured: 0
2024-05-10 06:59:27, Info SYSPRP SPPNP: Devices pre-installed: 0
2024-05-10 06:59:27, Info SYSPRP SPPNP: Devices need install: 0
2024-05-10 06:59:27, Info SYSPRP SPPNP: Devices configured: 235
2024-05-10 06:59:27, Info SYSPRP SPPNP: Devices installed: 3
2024-05-10 06:59:27, Info SYSPRP SPPNP: Devices non-present: 108
2024-05-10 06:59:27, Info SYSPRP SPPNP: Device installation completed.
2024-05-10 06:59:27, Info SYSPRP SPPNP: Waiting for progress thread to exit.
2024-05-10 06:59:27, Info SYSPRP SPPNP: Progress thread exited.
2024-05-10 06:59:27, Info SYSPRP SPPNP: Sysprep_Respecialize_Pnp: Exit
2024-05-10 06:59:27, Info SYSPRP ActionPlatform::LaunchModule: Successfully executed 'Sysprep_Respecialize_Pnp' from C:\Windows\System32\sppnp.dll
2024-05-10 06:59:27, Info SYSPRP SysprepSession::Execute: Sysprep mode was not specified, deleting it from registry
2024-05-10 06:59:27, Info [0x0f0052] SYSPRP Shutting down SysPrep log
2024-05-10 06:59:27, Info [0x0f004d] SYSPRP The time is now 2024-05-10 06:59:27


So am I just mis interrupting the logs or missing something in the configuration steps? Appreciate the assist.
 
Respecialize in this context refers to SPPNP, which is Sysprep Plug & Play.

Because you elected to clear the list of loaded drivers, Windows has to re-run the driver scan that originally happened in Specialize pass. So it's repeating that Specialize function (Re-Specializing) to look for current devices on the target system.

No drivers loaded in this driver store.
Code: 
2024-05-10 06:59:27, Info                  SYSPRP SPPNP: Devices pre-configured: 0
2024-05-10 06:59:27, Info                  SYSPRP SPPNP: Devices pre-installed: 0
2024-05-10 06:59:27, Info                  SYSPRP SPPNP: Devices need install: 0

Finished device discovery, and loaded some generic drivers.
Code: 
2024-05-10 06:59:27, Info                  SYSPRP SPPNP: Devices configured: 235
2024-05-10 06:59:27, Info                  SYSPRP SPPNP: Devices installed: 3
2024-05-10 06:59:27, Info                  SYSPRP SPPNP: Devices non-present: 108

Just for self-education, you might want to run the same sysprep except to keep the non-loading & detected drivers and see if that makes a difference in the log reporting. Maybe that would address some of your concerns.
 
I appreciate it Garlin - My biggest concern is if the is SID changing on the new image. I hate to assume it is... the reason I was looking for the Generalized output. I'll rerun it generalize true/true and check view the logs.
 
Most folks point to Sysinternal's PsGetSid tool as a way of reporting the local (or remote) machine's SID.

You could do a test install on the same PC twice in a row, and it should always create a different SID if properly generalized.
 
I tried that earlier... it gave me the same SID both times. I was kinda under the impression SIDs were based on hardware and such. I'm going to change the hardware configuration and see if I get the same outcome. I'll hook up another PC and see what happens after that test.
 
That was unsuccessful - Installed the ISO on a old Dell 5050 and the result was the same SID as the original workstation. Thoughts?
 
Did you sysprep /reboot, instead of /shutdown? Rebooting starts the specialization process, which nullifies the point of /generalize.

You shutdown; boot from alternate media, and perform the capture.
 
You must log in or register to reply here.
Back
Top