Sysprep, Windows XP SP and Ghost 8

[john.peeler]

In a nutshell: We have MS volume licensing, and Enterprise Ghost, 1400
users in one division and 3500+ in another. For the 1400 users, we
have always built our images in house, and deployed, using GhostWalker
to change the SID before booting up the freshly-imaged system and
configuring for the end-user. We have now trying to use our
laptop/PC/server vendor to image our systems and ship direct to our end
users for the 3500+ users division. Since Sysprep is the MS supported
SID changer, we are trying to use it, but we are in a major time crunch
as the project lead was "downsized" and we are clawing through 8-9
months of work in a span of 2 two weeks trying to get this project back
on track. We are stumbling over how to use Sysprep to simply change
the SID and not prompt the user, rebuild plug-n-play, etc, etc.

Is there an easy way to use Sysprep to simply change the SID and not do
everything else that is not needed/wanted?

Thanks for any help any one can offer

 

[Johan Arwidmark]

You cannot configure sysprep to only reset the SID, sysprep will still
carry out the other tasks, which you really would like sysprep to do.

Automating sysprep mini-setup can be done by using a sysprep.inf file

regards

Johan Arwidmark
Microsoft MVP - Setup/Deployment

 

[john.peeler]

Johan,
Thanks for the reply. We have used GhostWalker for years, as we build
our images for exact hardware duplicates. I am trying to cram a full
knowlege of sysprep into a single day, (along with re-doing 9 months of
work in two weeks, completly new image) to comply with my director's
timeline, but I am struggling with keeping sysprep from wiping out our
custom settings we normally configure as an admin ID profile, then copy
to the Default User profile.

My "ugly" option is to mail all of our sites a GhostWalker floppy/CD
and make changing the SID part of the intial config, but that adds time
and $$.

It appears that the former project lead ran sysprep on the image before
FTP'ing it up to our vendor for installation on our PC's (there is a
sysprep folder on the root), but I can't find any documentation or
notes indicating settings, and when that image is applied to our
hardware, it does not appear to do ANY Sysprep, it just boots up.

Is there a way to confirm the image was actually sysprep'ed?

 

[Johan Arwidmark]

Windows XP SP2 sysprep by default copies the admin profile to default
user during sysprep minisetup (new behavior in SP2 version of sysprep)

If you run Sysprep on a source computer, it changes the following
registry values (some values may differ depending on what switches
where used when launching sysprep). You should be able to loading the
registry hive offline and check these values.

HKEY_LOCAL_MACHINE\SYSTEM\Setup
Cmdline:REG_SZ:setup -newsetup -mini
MiniSetupInProgress:REG_DWORD:0x1
SetupType:REG_DWORD:0x1
SystemSetupInProgress:REG_DWORD:0x1

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
SetupExecute:REG_MULTI_SZ:setupcl.exe



regards

Johan Arwidmark
Microsoft MVP - Setup/Deployment

 

[john.peeler]

I was unabled to locate the referenced values on the source PC with the
"sysprep'ed" image. Am I safe to assume that this image was not
actually "sysprep'ed", and would cause SID issues when deployed?

Such would mean there was no "secret process" I was overlooking, and my
team can move forward with either a Ghostwalker-based solution, or find
time to build and document a Sysprep process.

Thanks!

 

[Johan Arwidmark]

If you checked the offline registry of the image (without booting the
computer into the Windows XP OS) and these regsitry entries doesnt
exist you can at least assume that sysprep didn't run correctly on the
reference computer.

regards

Johan Arwidmark
Microsoft MVP - Setup/Deployment

 

[Johan Arwidmark]

And, I do recommend you to take the time learning sysprep. I will be
worth the time (IMHO).

regards

Johan Arwidmark
Microsoft MVP - Setup/Deployment

 

[Adam Leinss]

(e-mail address removed) wrote in

Johan,
Thanks for the reply. We have used GhostWalker for years, as we
build our images for exact hardware duplicates. I am trying to
cram a full knowledge of sysprep into a single day, (along with
re-doing 9 months of work in two weeks, completely new image) to
comply with my director's timeline, but I am struggling with
keeping sysprep from wiping out our custom settings we normally
configure as an admin ID profile, then copy to the Default User
profile.

I've heard of Ghostwalker, but never used it. If you really don't want
to use Sysprep and still want the SIDs be unique, you could try NewSID
from Sysinternals and stick it in here:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Now close the image.

On the next boot it will change the SID and reboot the workstation for
you.

Of course, Microsoft doesn't support anything but using Sysprep.
However, they have frequently referenced Russinovich and his utilities
in their knowledgebase articles. We actually do not use Sysprep for
one of our images. It's an autologin PC locked down with the XP Shared
Computer Tool Kit. When we tried using sysprep on this image, both the
profile and the autologin portion broke, so we decided to just use
NewSID for this one image.

Adam

 

[john.peeler]

Thanks for the answers, and ideas. This particular image is also
(until we can get a child domain setup) for an autologin XP image being
deployed ASAP to replace a well-worn Win98 image that has hung on due
to far too many custom applications essential to the business being
firmly entrenched, but with little or no orignal source code to even be
found. It has been a mess and every step has been painful. I hope I
never have to do one like this ever again.

 

[furtherside]

(e-mail address removed) wrote in


I've heard of Ghostwalker, but never used it. If you really don't want
to use Sysprep and still want the SIDs be unique, you could try NewSID
from Sysinternals and stick it in here:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Now close the image.

On the next boot it will change the SID and reboot the workstation for
you.

Of course, Microsoft doesn't support anything but using Sysprep.
However, they have frequently referenced Russinovich and his utilities
in their knowledgebase articles. We actually do not use Sysprep for
one of our images. It's an autologin PC locked down with the XP Shared
Computer Tool Kit. When we tried using sysprep on this image, both the
profile and the autologin portion broke, so we decided to just use
NewSID for this one image.

Adam

I've been struggling (as you may recall) with similar issues recently.
The hotfix from KB887816 seems to help keep customizations of user
accounts on the machine from being re-written from the default admin
account (the NTUSER.DAT issue) when doing a sysprep -mini -reseal. Not
sure if this would help the OP, but maybe worth looking at...

However, I just learned last night that this hotfix doesn't address the
case where you've both made customizations to the user accounts *and*
you've set them to be roaming profiles (e.g. by using the MS Shared
Computer Toolkit profile restriction tool). The roaming profiles get
blown away and cannot be reestablished with the SCT. Game over.

After reading this, I'm going to see if there is a way I can just clone
without using Sysprep and then use a SID reset tool (like the one
mentioned). After all, my goal is to simply clone my image the way *I*
built it -- not the way Sysprep thinks I ought to have done it. I want
to do so and at the same time stay compliant with the product key for
XP.

If the SID reset tool causes me to have to phone in validation to MS,
then that's not good, however.

-Chris