Microsoft Windows Registry Guide, Second Edition

Mapping Sysprep Settings

When you run Sysprep, it modifies hundreds if not thousands of registry settings to prepare the computer's hard disk for duplication. Table 15-2 on the next page describes the registry settings that relate directly to Sysprep. These are settings that prepare Mini-Setup Wizard to run the next time Windows starts. I tracked these down by comparing snapshots of the registry before and after running Sysprep. I divided the table into sections, with each key in a different section.

Sysprep changes other settings that I don't describe in Table 15-2. The settings that it changes depend on the computer's configuration. For example, Sysprep disables Remote Desktop and Remote Assistance. It configures System Restore to create an initial system checkpoint the next time that Windows starts. Sysprep also resets the computer's digital ID and resets the Windows Product Activation timer. Last, if you're using [SysprepMassStorage], Sysprep fills the critical devices database and configures the device drivers for each device. The changes that Sysprep makes to the registry are numerous, but the following list summarizes some of the most significant differences that I found from comparing the registry snapshots:

• Sysprep resets the event system. These settings are in HKLM\SOFTWARE\Microsoft\EventSystem.

• Sysprep removes certificate templates and certificates from the following keys: HKLM\SOFTWARE\Microsoft\Cryptography HKLM\SOFTWARE\Microsoft\EnterpriseCertificates

• Sysprep resets the configuration of Group Policy in the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy.

• Sysprep removes the computer from the domain, if it's a domain member, by deleting the appropriate values from the following keys, and elsewhere: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DomainCache

• Sysprep removes policies from the key HKLM\SOFTWARE\Policies.

• Sysprep removes networking components from the following keys: HKLM\SYSTEM\CurrentControlSet\ControlHKLM\SYSTEM\CurrentControlSet\Enum HKLM\SYSTEM\CurrentControlSet\Services.

• Sysprep resets the application compatibility data in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility.

• Sysprep resets power management settings in the key HKLM\SYSTEM\ControlSet001\Control\Session Manager\Power.

• Sysprep configures the Netlogon service to load on demand instead of automatically in HKLM\SYSTEM\CurrentControlSet\Services\Netlogon.

• Sysprep adds the devices specified in [SysprepMassStorage] to the critical devices database. This database is in the key HKLM\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase.

• Sysprep installs and configures device drivers for the devices listed in the [SysprepMassStorage] section. It configures these device drivers in the key HKLM\SYSTEM\CurrentControlSet\Services.