Share via

Customize Windows in Audit Mode

  • Article

Audit mode enables OEMs and corporations to customize a Windows installation before shipping the computer to an end-user. In audit mode, you can install applications, add device drivers, run scripts, and test the validity of a Windows installation. Audit mode is a networked-enabled environment that does not require settings in Windows Welcome to be applied.

Typically, Windows starts Windows Welcome immediately after installation. However, by booting to audit mode, you can bypass Windows Welcome and boot to audit mode instead. This enables you to access the desktop as quickly as possible.

Additionally, you can use audit mode to add additional customizations to a reference image; this reduces the number of different images you need to manage. For example, you can create a single reference image that contains the basic customizations you want applied to all Windows images. You can then boot the reference image to audit mode and make additional changes specific to the computer. These changes can be customer-requested applications, or specific device drivers.

In auditSystem, the built-in administrator account is enabled by the system, and after logging into the system, the built-in administrator account is disabled during auditUser. This enables you to use audit mode with administrator privileges, but the next time the computer shuts down, the built-in administrator account will continue to be disabled. For more information, see Enable and Disable the Built-in Administrator Account.

Differences between Audit Mode and Windows Welcome

When Windows Vista boots, there are two modes in which the computer will start:

  • Windows Welcome. Windows Welcome, also called Machine OOBE (out-of-box experience), is the first user experience and enables end-users to customize their Windows installation. End users can create user accounts, read and accept the Microsoft Software License Terms, and choose their language and time zones.
    By default, all Windows installations boot to Windows Welcome first. However, if you have additional customizations to make to the computer, Microsoft recommends that you either make these customizations in audit mode, or use the SkipMachineOOBE setting in the Microsoft-Windows-Shell-Setup component.
    The oobeSystem configuration pass runs immediately before Windows Welcome starts. For more information about this configuration pass, see oobeSystem.
  • Audit Mode. Audit mode is used by OEMs and corporations to add customizations to their Windows images. Audit mode does not require settings in Windows Welcome to be applied. By bypassing Windows Welcome, you can get to the desktop quicker and perform your customizations. You can add additional device drivers, install applications, and test the validity of the installation. OEMs and corps should use audit mode to complete their manual customizations before shipping the computer to an end user.
    In audit mode, settings in an unattended answer file in the auditSystem and auditUser configuration passes are processed. For more information about these configuration passes, see auditSystem and auditUser.
    If you are running in audit mode, to configure the installation to boot to Windows Welcome, run the sysprep/oobe command. For more information, see Sysprep Technical Reference. OEMs are required to run sysprep/oobe before shipping a computer to an end user.

To Boot to Audit Mode

There are several ways to boot to audit mode:

  • For attended installations, from Windows Welcome screen, press SHIFT+CTRL+F3.
    -Or-
  • In unattended installations, configure the Microsoft-Windows-Deployment | Reseal | Mode setting to audit. For more information on this settings, see the Unattended Windows Setup Reference.
    You can use Windows System Image Manager to create an answer file. For more information, see Windows System Image Manager Technical Reference.
    -Or-
  • Run sysprep/audit to configure the system to boot to audit mode on the next reboot. For more information, see the Sysprep Technical Reference.
  • After a computer boots to audit mode, the computer will continue to boot to audit mode until you configure the computer to boot wo Windows Welcome.

To Prepare the Computer for an End User

After you have completed your customizations and have verified that the computer is ready to ship to a customer, configure the system to boot to Windows Welcome by running sysprep/oobe. The next time the system starts, Windows Welcome starts.

OEM and system builders must configure the computer to boot to Windows Welcome when an end-user starts the computer. The end-user must agree to the Microsoft License Terms. For more information, see Sysprep Technical Reference.

In unattended installations, configure the Microsoft-Windows-Deployment | Reseal | Mode setting to oobe. For more information on this settings, see the Unattended Windows Setup Reference.

You can use Windows System Image Manager to create an answer file. For more information, see Windows System Image Manager Technical Reference.

Corporations are allowed to bypass Windows Welcome for their end users.

You can pre-configure custom options in Windows Welcome by using the oobe.xml content file. For more information, see Oobe.xml Technical Reference.

Limitations of using Audit Mode

  • If you use sysprep/audit to boot to audit mode, the computer will be removed from a domain. You must rejoin the computer to a domain in audit mode.