Forum Discussion
Harry-TSL
Dec 16, 2022Copper Contributor
Windows 11 Sysprep /Generalize Errors after restart
Hi guys, I am coming here as I'm having a really strange issue thats rather frustrating with regards to trying to SysPrep /Generalize a new Windows 11 22H2 image as our latest image is 1903 and w...
J12583B
Mar 29, 2023Copper Contributor
Alright so I have verified this works and the image deploys as intended and all I have to do was adjust a couple registry keys prior to generalizing my image for capture.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Windows 11 Fix"="REG DELETE HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\ClipSVC\\Parameters /V AuditAfterRearm /F"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Windows 11 Fix"="REG DELETE HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\ClipSVC\\Parameters /V AuditAfterRearm /F"
[HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe\CortanaStartupId]
"State"=dword:00000001
"UserEnabledStartupOnce"=dword:00000000
"Startupdelayinmsec"=dword:000007d0
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe\CortanaStartupId]
"State"=dword:00000001
"UserEnabledStartupOnce"=dword:00000000
"Startupdelayinmsec"=dword:000007d0
So what I did was set a run once to delete "AuditAfterRearm" and I also had to add a 2 second startup delay to Cortana and also set Cortana to not run at log on. I have confirmed the image deployment was successful with no file system error and the OS resealed to OOBE with no issues.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Windows 11 Fix"="REG DELETE HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\ClipSVC\\Parameters /V AuditAfterRearm /F"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Windows 11 Fix"="REG DELETE HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\ClipSVC\\Parameters /V AuditAfterRearm /F"
[HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe\CortanaStartupId]
"State"=dword:00000001
"UserEnabledStartupOnce"=dword:00000000
"Startupdelayinmsec"=dword:000007d0
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe\CortanaStartupId]
"State"=dword:00000001
"UserEnabledStartupOnce"=dword:00000000
"Startupdelayinmsec"=dword:000007d0
So what I did was set a run once to delete "AuditAfterRearm" and I also had to add a 2 second startup delay to Cortana and also set Cortana to not run at log on. I have confirmed the image deployment was successful with no file system error and the OS resealed to OOBE with no issues.
- J12583BJul 20, 2023Copper ContributorSo after a recent conversation I think this little bit of information is necessary, to be clear the initial filesystem error is indeed Cortana but Cortana is not the root cause. Because Cortana will always auto run it will trip the error first under Win32Bridge. Server.exe and though a Google search will tell you that the Cortana install is corrupted this is not the case. The event viewer gives better details and scrolling through you will notice a service called ClipSVC is failing to load. This is an authentication service and without it you will find yourself unable to open most applications as they will all return the above mentioned file system error. So what is ClipSVC? Well in terms of the service description it's referred only as "Client License Service". But what does it do? Provides infrastructure support for the Microsoft Store as well as verification for programs running on the system. It is started on demand by applications that require said verification and if it cannot run the neither will your applications resulting in that file system error. During generalization of an image that service is disabled through the "AuditAfterRearm" key that gets injected into the registry and a before and after comparison shows that after resealing to OOBE the key gets deleted and everything works again but when you need to deploy multiple systems in generalized audit mode this is a significant problem that is resolved with a simple registry edit prior to generalizing. Adding the delay to Cortana's startup is absolutely necessary, because of how fast it starts you will initially still receive the file system error because the autorun key to delete the AuditAfterRearm does not occur faster that Cortana takes to load. Adding a 2 second delay addresses that and since nobody really seems to use Cortana I doubt anyone would ever notice.