Forum Discussion
Windows 11 Sysprep /Generalize Errors after restart
Hi guys,
I am coming here as I'm having a really strange issue thats rather frustrating with regards to trying to SysPrep /Generalize a new Windows 11 22H2 image as our latest image is 1903 and was created by my predecessor.
I am getting the image to a stage with some general programs installed these being Watchguard VPN, Adobe Reader, Office, VLC Media Player, Google Chrome, Dell Command Update, and thats the full list of non standard programs I've installed I've not uninstalled anything just allowed Dell Command Update to install some driver updates on the device and I've also not allowed that to run and still have the same issue. I get the below three errors appear on the desktop after logging in, I can close them and they won't reappear again but I'm unsure why this is happening and trying to update our image is becoming a headache and the error code means nothing from my research.
C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_4.42204.13303.0_x64_...\Win32Bridge.Server.exe
File System Error (-1069587196).
C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_10.0.53.96.0...\PAD.Console.Host\exe
File System Error (-1069587196).
C:\Program Files\WindowsApps\Microsoft.YourPhone_1.22092.214.0_x62_82...\PhoneExperienceHost.exe
File System Error (-1069587196).
The errors appear in the list above and all I can figure out is they're related to Windows pre-installed apps such as Cortana, PowerAutomate Desktop and Phone Companion but I've not touched these files, and this error only happens when I "Generalize" the image I've tried without and I get no issues but it doesn't matter when I generalize whether I go to Audit mode or OOBE the errors still apper the only time they don't is when I don't generalize the image.
Any help appreciated as I'm keen to get a list of users new laptops and don't want to have to update the old image to windows 11 as that takes hours per device with the installation assistant.
I cannot find anything online for this so hope someone whos come across this error might see this and help me resolve it any help appreciated or diagnoses tips.
8 Replies
- Alright so I have verified this works and the image deploys as intended and all I have to do was adjust a couple registry keys prior to generalizing my image for capture.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Windows 11 Fix"="REG DELETE HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\ClipSVC\\Parameters /V AuditAfterRearm /F"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Windows 11 Fix"="REG DELETE HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\ClipSVC\\Parameters /V AuditAfterRearm /F"
[HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe\CortanaStartupId]
"State"=dword:00000001
"UserEnabledStartupOnce"=dword:00000000
"Startupdelayinmsec"=dword:000007d0
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe\CortanaStartupId]
"State"=dword:00000001
"UserEnabledStartupOnce"=dword:00000000
"Startupdelayinmsec"=dword:000007d0
So what I did was set a run once to delete "AuditAfterRearm" and I also had to add a 2 second startup delay to Cortana and also set Cortana to not run at log on. I have confirmed the image deployment was successful with no file system error and the OS resealed to OOBE with no issues.- So after a recent conversation I think this little bit of information is necessary, to be clear the initial filesystem error is indeed Cortana but Cortana is not the root cause. Because Cortana will always auto run it will trip the error first under Win32Bridge. Server.exe and though a Google search will tell you that the Cortana install is corrupted this is not the case. The event viewer gives better details and scrolling through you will notice a service called ClipSVC is failing to load. This is an authentication service and without it you will find yourself unable to open most applications as they will all return the above mentioned file system error. So what is ClipSVC? Well in terms of the service description it's referred only as "Client License Service". But what does it do? Provides infrastructure support for the Microsoft Store as well as verification for programs running on the system. It is started on demand by applications that require said verification and if it cannot run the neither will your applications resulting in that file system error. During generalization of an image that service is disabled through the "AuditAfterRearm" key that gets injected into the registry and a before and after comparison shows that after resealing to OOBE the key gets deleted and everything works again but when you need to deploy multiple systems in generalized audit mode this is a significant problem that is resolved with a simple registry edit prior to generalizing. Adding the delay to Cortana's startup is absolutely necessary, because of how fast it starts you will initially still receive the file system error because the autorun key to delete the AuditAfterRearm does not occur faster that Cortana takes to load. Adding a 2 second delay addresses that and since nobody really seems to use Cortana I doubt anyone would ever notice.
- Only took me about 1.5 days to determine this was the source of the error, once removed no reboot is required and all apps will open again in audit mode.
- From my experience playing with the image this is caused specifically by Microsoft and has nothing to do with you. This error will come up on a clean install with no modifications simply because the image was generalized. Something is happening during generalization that breaks most of the apps causing that file system error.
- That is true in my experience, sysprep is fundamentally broken in Windows 11 22H2.
I "fixed" it in a very dirty way for one image we really needed by installing Windows 10 and upgrading to Windows 11 in Audit mode.
This image can be sysprepped without issue and the apps do work after that.
Note that I would not recommend this as upgrading an image in Audit mode is absolutely not supported and needed its own workaround.
Harry-TSLWhat I'm about to say is really obvious, so it shouldn't surprise you. Even if you're using a DIY approach like this, you should apply the cumulative updates / drivers with DISM first, and then finalize the image. Anything at that point you could capture in a VM and apply as a siloed provisioning package ( without needing to generalize the image, as none of these things create a unique SID string that you have to remove by generalizing with sysprep. ) If you have to complete a set of tasks, like adding features, windows universal apps / app updates, or installing some types of software, then of course that creates pending actions that you can usually only resolve with sysprep and audit mode. The end-result should actually be an WIM / FFU image that you can apply unattended using WinPE cmdlets and a script, although initially you should start with a pre-patched ISO image. You could still do three quarters of these things WITHOUT generalizing the image or wasting your own time:
"Desktop manufacturing" -> https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/
Add and Remove Driver packages to an offline Windows Image -> https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-and-remove-drivers-to-an-offline-windows-image
Add or Remove Packages Offline Using DISM -> https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-or-remove-packages-offline-using-dism
"Alternatively, the siloed provisioning packages can be captured using a VM instead of a physical device"
Scenarios for using siloed provisioning packages -> Capturing and applying independent applications -> https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/siloed-provisioning-packages?view=windows-11#capturing-and-applying-independent-applications
"/Apply-SiloedPackage can only be run once against a Windows image, but /PackagePath can used more than once in the same command to apply multiple SPPs." -> https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14?view=windows-11#apply-siloedpackage
Windows 11, version 21H2 update history -> https://support.microsoft.com/en-us/topic/windows-11-update-history-a19cd327-b57f-44b9-84e0-26ced7109ba9
History of Cumulative Updates for .NET Framework for Windows 11 -> https://support.microsoft.com/en-us/topic/history-of-cumulative-updates-for-net-framework-for-windows-11-b56e9c5b-fc56-49fb-9490-dc09b0b89758
Here's an example you can easily edit, although you'd have to create all your own scripts yourself:
@ECHO OFF MKDIR "C:\Scratch_Win" MKDIR "C:\Mount" DISM /Mount-Image /ImageFile:"C:\Win_11\sources\install.wim" /Index:1 /MountDir:"C:\Mount" DISM /Image:"C:\Mount" /ScratchDir:"C:\Scratch_Win" /Add-Package /PackagePath:"C:\Answer_Files\Win11\22H2\windows11.0-kb5021255-x64_2830fb558a628b0a1847a0025d3da14928f82a5e.msu" /PackagePath:"C:\Answer_Files\Win11\22H2\windows11.0-kb5020882-x64-ndp481_c1b9ed0bbd7bec142c66c5b27f82533b04ee807a.msu" DISM /Cleanup-Image /Image:"C:\Mount" /ScratchDir:"C:\Scratch_Win" /StartComponentCleanup /ResetBase DISM /Unmount-Image /MountDir:"C:\Mount" /Commit DISM /Cleanup-Mountpoints RMDIR /S /Q "C:\Scratch_Win" RMDIR /S /Q "C:\Mount" REM https://www.catalog.update.microsoft.com/Search.aspx?q=KB5021255 11 -"GDR-DU" -"Dynamic" -"ARM64" REM https://www.catalog.update.microsoft.com/Search.aspx?q=KB5021090 11 -"GDR-DU" -"Dynamic" -"ARM64"I have the same issue, came across it trying to create images for Windows 11 22H2.
In testing, I was able to reproduce the error on different systems and with a fresh .iso from the Media Creation Tool:
- Install Windows 11 from .iso (USB drive)
- enter Audit mode (Ctrl + Shift + F3)
- install apps, drivers (or nothing at all)
- sysprep to Audit mode (C:\Windows\system32\sysprep\sysprep.exe /generalize /audit /shutdown)
- boot up and let Administrator account login again
--> error pops up for basically all apps (e.g. notepad).
For us, we need to customize some Windows images as baseline which have to be sysprepped already, save them and later do some more customizations in Audit before sysprepping again, which is why we sysprep to audit.
