Sign in with
Sign up | Sign in
Your question
Solved

Can't get rid of audit mode!

Last response: in Windows 7
Share
April 11, 2012 7:43:00 PM

I was trying to install an OS on my SSD and got myself into audit mode thought the command prompt. Well, i've decided to not do install the OS there, but now I can't get audit mode from coming up everytime I restart the PC, not to mention things like anti-virus don't work currently. I've already tried navigating to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State and deleting the value for ImageState, but it is not working. What do I need to do to get rid of audit mode? Also, when the PC first launches, I have the option to run in OOBE mode. I tried doing so, but it just says a fatal error has occurred. Any help is greatly appreciated!

More about : rid audit mode

a b $ Windows 7
April 11, 2012 8:17:18 PM

Hello,

The easiest way to fix it would be just to do a full re-install.
m
0
l
April 11, 2012 8:22:59 PM

Chainzsaw said:
Hello,

The easiest way to fix it would be just to do a full re-install.


Well, that's not going to happen. What I should have said is that I was trying to install an OS on the SSD so I could use it as a boot drive instead of the OS on my HDD. I am still using my HDD and everything. I'm typing this from it. I'd rather not loose all of my stuff, especially since I would think getting rid of the audit mode should be simple.
m
0
l
Related resources
a b $ Windows 7
April 11, 2012 8:42:08 PM

Gundown64 said:
Well, that's not going to happen. What I should have said is that I was trying to install an OS on the SSD so I could use it as a boot drive instead of the OS on my HDD. I am still using my HDD and everything. I'm typing this from it. I'd rather not loose all of my stuff, especially since I would think getting rid of the audit mode should be simple.


Huh?

You have an SSD. You tried installing the OS on it. You messed up. Theres nothing on the SSD right (besides the bad install)? Unplug your HDD. Plug in your SSD, now re-install your OS.

Your not re-installing it on your HDD so theres no need to worry about the data loss on it.
m
0
l
April 11, 2012 9:00:43 PM

Chainzsaw said:
Huh?

You have an SSD. You tried installing the OS on it. You messed up. Theres nothing on the SSD right (besides the bad install)? Unplug your HDD. Plug in your SSD, now re-install your OS.

Your not re-installing it on your HDD so theres no need to worry about the data loss on it.


Kind of. It's not that the install is bad. It installed correctly. I forgot that I got into audit mode when I was trying to transfer user folders over form the HDD to the SSD. I will try that, but it seems that the audit mode will still occur regardless of that since the registry value that I talked about is present on this current HDD as well as the SSD. I delete it, but it just comes back after restart.
m
0
l
a b $ Windows 7
April 11, 2012 9:20:55 PM

Ok i did some digging for you.

Take a look here:

http://www.bizzntech.com/2009/11/04/how-to-turn-off-aud...

Go to the Start> Run.

Type ‘regedit’ and hit enter.

Find and right-click the relevant registry key for your operating system:
Windows 7: ImageState in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State

Select modify - then delete it. I know you mentioned you tried this in the first post, but did you modify it first?

If that doesn't work try this:

If you are running in audit mode, to configure the installation to boot to Windows Welcome, run the sysprep/oobe command. For more information, see Sysprep Technical Reference. OEMs are required to run sysprep/oobe before shipping a computer to an end user.

After a computer boots to audit mode, the computer will continue to boot to audit mode until you configure the computer to boot to Windows Welcome.

If OOBE still doesn't work - put your win 7 DVD in - make sure only your HDD is plugged in - and try to boot off your DVD and try to repair your installation.


However....I reccomend just doing it like I said. Unplug the HDD, plug in your SSD, install the OS, then pull off all your information off the old HDD. <--- I would do this if you don't want to lose any data.
m
0
l
April 11, 2012 9:29:52 PM

Chainzsaw said:
Ok i did some digging for you.

Take a look here:

http://www.bizzntech.com/2009/11/04/how-to-turn-off-aud...

Go to the Start> Run.

Type ‘regedit’ and hit enter.

Find and right-click the relevant registry key for your operating system:
Windows 7: ImageState in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State

Select modify - then delete it. I know you mentioned you tried this in the first post, but did you modify it first?

If that doesn't work try this


Yea, that is the guide I followed. I right click ImageState and click Modify, highlight and delete the value and the click ok. Reboot, but audit mode is still present and the value is back. It looks like if I just simply run the OOBE mode that comes up that should take care of everything, but I get an error when I do. I am going to restart and try a few things and see if I can't fix it. I'll report back shortly.
m
0
l
a b $ Windows 7
April 11, 2012 9:32:47 PM

Gundown64 said:
Yea, that is the guide I followed. I right click ImageState and click Modify, highlight and delete the value and the click ok. Reboot, but audit mode is still present and the value is back. It looks like if I just simply run the OOBE mode that comes up that should take care of everything, but I get an error when I do. I am going to restart and try a few things and see if I can't fix it. I'll report back shortly.


Ok. Like I mentioned try repairing your OS on your HDD. Maybe sOMEHOW THE OOBE command/files got corrupted somehow.
m
0
l
April 11, 2012 11:18:50 PM

Alright, I tried two things with no success. First I tried running the OOBE without deleting the registry value, hoping that would fix the error. No luck. I then tried changing the value to "IMAGE_STATE_COMPLETE" which is the value for a normal startup. No luck, same thing. Oh, and I also completely wiped/formatted my SSD so there is nothing on it. That didn't effect anything, so I would doubt a fresh install on the SSD would fix anything. Maybe a repair to the OS on the HDD might fix the problem? Not sure. I t would seem my only option is to be able to run the OOBE which should just prompt me like my PC was brand new, but other than that it would be normal I would imagine?
m
0
l
a b $ Windows 7
April 12, 2012 10:26:36 AM

new version of windows bit little bit of info into the master boot record. you may want to wipe the ssd and remve any partion on the ssd and do a fdisk/mbr and try again.
m
0
l
April 12, 2012 12:34:45 PM

smorizio said:
new version of windows bit little bit of info into the master boot record. you may want to wipe the ssd and remve any partion on the ssd and do a fdisk/mbr and try again.


The SSD should have nothing to do with it. I am not booting from the SSD. I am booting from my HDD. Besides, my SSD is completely wiped and formatted.
m
0
l
a b $ Windows 7
April 12, 2012 1:46:19 PM

Argh. Sorry to hear none of that stuff worked.

I'm actually out of ideas!
m
0
l
April 15, 2012 12:06:07 AM

Anybody else got some ideas?
m
0
l
April 19, 2012 12:46:30 PM

Still need to fix this.
m
0
l
April 19, 2012 3:08:50 PM

When Windows boots, there are two modes in which a computer can start:

• Windows Welcome (also called Machine OOBE)
• Audit Mode

The above settings are to two options available within the Sysprep component of the Windows operating system.

I believe you said you had already tried this, however, let’s clarify just to be sure. When one is finished installing necessary applications and making the customizations to the computer in audit mode, one would then proceed to run “sysprep /oobe” command to return to the Windows Welcome screen. You can also do this from the GUI found in the Windows/System32/Sysprep folder.

The /oobe option instructs Windows to run Windows Welcome the next time a computer boots. More information about Audit mode can be found by reading Customize Windows in Audit Mode from TechNet. This is the only way to end audit mode. If running the above command does not work you may want to consider running a repair Windows 7 installation as proposed by Chainzsaw or make provisions for reinstalling the OS.

Jessica
Windows Outreach Team – IT Pro
m
0
l
April 19, 2012 7:42:59 PM

winoutreach5 said:
When Windows boots, there are two modes in which a computer can start:

• Windows Welcome (also called Machine OOBE)
• Audit Mode

The above settings are to two options available within the Sysprep component of the Windows operating system.

I believe you said you had already tried this, however, let’s clarify just to be sure. When one is finished installing necessary applications and making the customizations to the computer in audit mode, one would then proceed to run “sysprep /oobe” command to return to the Windows Welcome screen. You can also do this from the GUI found in the Windows/System32/Sysprep folder.

The /oobe option instructs Windows to run Windows Welcome the next time a computer boots. More information about Audit mode can be found by reading Customize Windows in Audit Mode from TechNet. This is the only way to end audit mode. If running the above command does not work you may want to consider running a repair Windows 7 installation as proposed by Chainzsaw or make provisions for reinstalling the OS.

Jessica
Windows Outreach Team – IT Pro


I appreciate your response Jessica. I have already tried that unsuccessfully. When I run the OOBE mode I get a "fatal error has occurred" and thus nothing happens. I need to figure out either how to fix that error or exit audit mode another way. And just so you know, this computer is not being sold or anything like that, this is my personal PC and I mistakenly got myself into audit mode without really needing to do it in the first place. So I just dug myself into a hole basically. Any more suggestions? Thanks!
m
0
l
April 21, 2012 1:53:24 AM

Let’s try this, run the following command at an elevated command prompt level: “slmgr /dlv” A window should pop up that contains some very important information. The second to last line should read: “Remaining windows rearm count: x” Note: “x” is used as a placeholder as there will be a number likely between 0 and 3 displayed there. You can read more about slmgr.vbs options directly from TechNet here.

From the sound of your problem and according to this Microsoft Knowledge Base (kb) article, an error message such as the one you are describing occurs when the Windows Software Licensing Rearm program has one more than 3 times in a single Windows image. Typically speaking, each computer has a max rearm count of 3. Each time you sysprep a machine you lose one of those rearms. If you see a 0 listed next to the “Remaining Windows rearm count” line you will be unable to run the sysprep command and therefore will need to rebuild the Windows image.

As the Microsoft KB article states, there is an available work around via utilizing the <SkipRearm> command in an XML file. An example of how you would run this command would be: sysprep /oobe /shutdown /unattend:NAMEOFYOURANSWERFILE.xml

More information about sysprep, SkipRearm and more can be found on a TechNet blog here.

Again, if the above does not work, you may need to consider rebuilding the Windows image.

Jessica
Windows Outreach Team – IT Pro
m
0
l
April 22, 2012 5:20:14 PM

winoutreach5 said:
Let’s try this, run the following command at an elevated command prompt level: “slmgr /dlv” A window should pop up that contains some very important information. The second to last line should read: “Remaining windows rearm count: x” Note: “x” is used as a placeholder as there will be a number likely between 0 and 3 displayed there. You can read more about slmgr.vbs options directly from TechNet here.

From the sound of your problem and according to this Microsoft Knowledge Base (kb) article, an error message such as the one you are describing occurs when the Windows Software Licensing Rearm program has one more than 3 times in a single Windows image. Typically speaking, each computer has a max rearm count of 3. Each time you sysprep a machine you lose one of those rearms. If you see a 0 listed next to the “Remaining Windows rearm count” line you will be unable to run the sysprep command and therefore will need to rebuild the Windows image.

As the Microsoft KB article states, there is an available work around via utilizing the <SkipRearm> command in an XML file. An example of how you would run this command would be: sysprep /oobe /shutdown /unattend:NAMEOFYOURANSWERFILE.xml

More information about sysprep, SkipRearm and more can be found on a TechNet blog here.

Again, if the above does not work, you may need to consider rebuilding the Windows image.

Jessica
Windows Outreach Team – IT Pro


It actually says I have 5 remaining. What does that mean and is that change the situation? I had no idea how big of a deal this was, lol. I am anxious to get the back up as it is preventing any anti-virus from running currently. Again, I appreciate your help Jessica.
m
0
l
April 23, 2012 5:38:53 PM

First, it is extremely important to understand what Sysprep is intended to do and who it is intended to be used by. The System Preparation (Sysprep) tool prepares an installation of Windows for duplication, auditing, and customer delivery. It would be wise to refrain from issuing a Sysprep command in the future without first familiarizing yourself with the following references:

What is Sysprep?
How Sysprep Works?

I have attempted to replicate your scenario on my own system and am unable to produce the same error under similar circumstances. I went searching for a few more potential solutions and came across this thread on the TechNet forums. As you can see, Gandalf50 recommends checking the following logs: setupact.log and setuperr.log. To access these logs quickly, go to start, type in ‘run’ and then type in the following commands:
Quote:
%windir%\system32\sysprep\panther\setupact.log
and
Quote:
%windir%\system32\sysprep\panther\setuperr.log


As Gandalf50 proceeds to state in a later comment, the image may be corrupt as sighted in this Microsoft Knowledge Base article if you see the following error message in the setuperr.log:

Quote:
Date Time, Error [0x0f0073] SYSPRP RunExternalDlls:Not running DLLs; either the machine is in an invalid state or we couldn't update the recorded state, dwRet = 31


Just as a side note, in any documentation you may read you will want to refrain from using the /generalize pass. The sysprep /generalize command removes unique information from your Windows installation, which enables you to reuse that image on different computers – which is not what you intend to do.

I realize that you want to resolve your issue without performing a clean install however the more we dive into the problem you are experiencing, the more the signs point to needing to do just that.

Please check your error logs and consider what has been stated in the KB article and thread mentioned above.

Jessica
Windows Outreach Team – IT Pro
m
0
l
April 23, 2012 9:47:36 PM

winoutreach5 said:
First, it is extremely important to understand what Sysprep is intended to do and who it is intended to be used by. The System Preparation (Sysprep) tool prepares an installation of Windows for duplication, auditing, and customer delivery. It would be wise to refrain from issuing a Sysprep command in the future without first familiarizing yourself with the following references:

What is Sysprep?
How Sysprep Works?

I have attempted to replicate your scenario on my own system and am unable to produce the same error under similar circumstances. I went searching for a few more potential solutions and came across this thread on the TechNet forums. As you can see, Gandalf50 recommends checking the following logs: setupact.log and setuperr.log. To access these logs quickly, go to start, type in ‘run’ and then type in the following commands:
Quote:
%windir%\system32\sysprep\panther\setupact.log
and
Quote:
%windir%\system32\sysprep\panther\setuperr.log


As Gandalf50 proceeds to state in a later comment, the image may be corrupt as sighted in this Microsoft Knowledge Base article if you see the following error message in the setuperr.log:

Quote:
Date Time, Error [0x0f0073] SYSPRP RunExternalDlls:Not running DLLs; either the machine is in an invalid state or we couldn't update the recorded state, dwRet = 31


Just as a side note, in any documentation you may read you will want to refrain from using the /generalize pass. The sysprep /generalize command removes unique information from your Windows installation, which enables you to reuse that image on different computers – which is not what you intend to do.

I realize that you want to resolve your issue without performing a clean install however the more we dive into the problem you are experiencing, the more the signs point to needing to do just that.

Please check your error logs and consider what has been stated in the KB article and thread mentioned above.

Jessica
Windows Outreach Team – IT Pro


I am just amazed at how much I messed things up by doing this. I had no idea this would lead to this much trouble. Anyway, I do not have that error in the setuperr.log. Here are the errors I have gotten so far:

Quote:
[0x0f0082] SYSPRP LaunchDll:Failure occurred while executing 'drmv2clt.dll,Sysprep', returned error code -2147024864[gle=0x00000020]


Quote:
[0x0f0070] SYSPRP RunExternalDlls:An error occurred while running registry sysprep DLLs, halting sysprep execution. dwRet = -2147024864[gle=0x00000020]


Quote:
[0x0f00a8] SYSPRP WinMain:Hit failure while processing sysprep cleanup providers; hr = 0x80070020[gle=0x00000020]


Quote:
[0x0f0043] SYSPRP WinMain:The sysprep dialog box returned FALSE


These errors show up in that order 8 times, which I would imagine is the number of time I have restarted my PC and tried to fix the problem.

I definitely do not want to do a clean install if I don't have to especially because it will be such a pain to get everything back how I want it in terms of settings and all that, but if it comes down to it what can I do, you know? However, I will stick it out as long as I can if possible. Thanks again!
m
0
l

Best solution

April 24, 2012 3:02:09 PM

Again, I seriously urge you to consider reinstalling the OS as it appears your image may now be corrupt.

However, with that said I did look in to the error messages in your sysprep setuperr.log and came across this article from TechNet proposing a potential reason for your issue and a work around.

Please try the following and run the sysprep /oobe command again.

Quote:
Click Start > Run, type Services.msc to open the Services applet.
Scroll down to Windows Media Player Network Sharing Service, double click it, and change the Startup type to Disabled. Click OK.


Jessica
Windows Outreach Team – IT Pro
Share
April 24, 2012 5:23:16 PM

winoutreach5 said:
Again, I seriously urge you to consider reinstalling the OS as it appears your image may now be corrupt.

However, with that said I did look in to the error messages in you sysprep setuperr.log and came across this article from TechNet proposing a potential reason for your issue and a work around.

Please try the following and run the sysprep /oobe command again.

Quote:
Click Start > Run, type Services.msc to open the Services applet.
Scroll down to Windows Media Player Network Sharing Service, double click it, and change the Startup type to Disabled. Click OK.


Jessica
Windows Outreach Team – IT Pro


Well Jessica, I think you deserve a big hug. That seems to have worked. I disabled the service and then rebooted my PC. The same things happened and I was prompted with the Sysprep.exe. I ran the OOBE command, but this time it gave me no error, restarted, and I was prompted with the typical first time use screen. It just made another account, but I deleted it and everything seems to be back to normal, hopefully. ;)  It is amazing how that one service was ruining everything, haha. Anyway, I can't thank you enough for your continued support through all of this. Thank you very much! And hey, this is one more problem that you can add to your arsenal if someone else comes along with it. :D 
m
0
l
April 24, 2012 5:25:19 PM

Best answer selected by Gundown64.
m
0
l
January 9, 2013 11:02:21 AM

Hello all

this also helped me after creating a windows gold image with sysprep.

I remember a post stating that you have to kill the windows media player / network service before running sysprep. Since I did not do this I probably ended up with this problem in my gold image and after deploying it to other clients.

This trick solved the issue so I did not need to revert to my ghosted windows7 image and is okey for a first customer install, since I added this note to the how-to for setting up a new client.

So please be aware to kill all media player services before creating a windows image file with sysprep so you will not end up with a halfway broken gold image.

Cheers
Adrian

Asc software - it and services, zurich, switzerland
m
0
l
April 5, 2013 4:59:52 AM

winoutreach5 said:
Again, I seriously urge you to consider reinstalling the OS as it appears your image may now be corrupt.

However, with that said I did look in to the error messages in your sysprep setuperr.log and came across this article from TechNet proposing a potential reason for your issue and a work around.

Please try the following and run the sysprep /oobe command again.

Quote:
Click Start > Run, type Services.msc to open the Services applet.
Scroll down to Windows Media Player Network Sharing Service, double click it, and change the Startup type to Disabled. Click OK.


Jessica
Windows Outreach Team – IT Pro


hello Jessica or anybody who monitors this board,
I typed sysprp in cmd line in win8 Samsung laptop, its still running but I would like to get out of it to the original setup. From what I can see in setupact log, many things were changed, and the laptop is not the same as it was before. Any suggestions?
m
0
l
April 5, 2013 1:29:36 PM

pav said:
winoutreach5 said:
Again, I seriously urge you to consider reinstalling the OS as it appears your image may now be corrupt.

However, with that said I did look in to the error messages in your sysprep setuperr.log and came across this article from TechNet proposing a potential reason for your issue and a work around.

Please try the following and run the sysprep /oobe command again.

Quote:
Click Start > Run, type Services.msc to open the Services applet.
Scroll down to Windows Media Player Network Sharing Service, double click it, and change the Startup type to Disabled. Click OK.


Jessica
Windows Outreach Team – IT Pro


hello Jessica or anybody who monitors this board,
I typed sysprp in cmd line in win8 Samsung laptop, its still running but I would like to get out of it to the original setup. From what I can see in setupact log, many things were changed, and the laptop is not the same as it was before. Any suggestions?


Pav,

It would be best to create a new thread for your specific issue since this thread is a year old. Feel free to create the new thread and PM me directly with the link. I am more than happy to help you trouble shoot the problems you are experiencing with Sysprep. I would also checkout How Sysprep Works from the Springboard Series on TechNet in an effort to become more familiar with the tool.

Keep me posted!

Jessica
Windows Outreach Team – IT Pro

m
0
l
!