I was trying to install an OS on my SSD and got myself into audit mode thought the command prompt. Well, i've decided to not do install the OS there, but now I can't get audit mode from coming up everytime I restart the PC, not to mention things like anti-virus don't work currently. I've already tried navigating to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State and deleting the value for ImageState, but it is not working. What do I need to do to get rid of audit mode? Also, when the PC first launches, I have the option to run in OOBE mode. I tried doing so, but it just says a fatal error has occurred. Any help is greatly appreciated!
Can't get rid of audit mode!
- Thread starter Gundown64
- Start date
Solution
Well, that's not going to happen. What I should have said is that I was trying to install an OS on the SSD so I could use it as a boot drive instead of the OS on my HDD. I am still using my HDD and everything. I'm typing this from it. I'd rather not loose all of my stuff, especially since I would think getting rid of the audit mode should be simple.
Huh?
You have an SSD. You tried installing the OS on it. You messed up. Theres nothing on the SSD right (besides the bad install)? Unplug your HDD. Plug in your SSD, now re-install your OS.
Your not re-installing it on your HDD so theres no need to worry about the data loss on it.
Kind of. It's not that the install is bad. It installed correctly. I forgot that I got into audit mode when I was trying to transfer user folders over form the HDD to the SSD. I will try that, but it seems that the audit mode will still occur regardless of that since the registry value that I talked about is present on this current HDD as well as the SSD. I delete it, but it just comes back after restart.
smorizio
Titan
- Jan 22, 2010
- 30,984
- 9
- 125,315
http://answers.microsoft.com/en-us/windows/forum/windows_7-hardware/how-to-exit-audit-mode-in-a-simple-step/9b8ef608-576a-4245-a294-9751bb680135
dont forget to enable the main uses account..it gets turned off in audit mode.
dont forget to enable the main uses account..it gets turned off in audit mode.
Ok i did some digging for you.
Take a look here:
http://www.bizzntech.com/2009/11/04/how-to-turn-off-audit-mode-in-windows-7
Go to the Start> Run.
Type ‘regedit’ and hit enter.
Find and right-click the relevant registry key for your operating system:
Windows 7: ImageState in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State
Select modify - then delete it. I know you mentioned you tried this in the first post, but did you modify it first?
If that doesn't work try this:
If you are running in audit mode, to configure the installation to boot to Windows Welcome, run the sysprep/oobe command. For more information, see Sysprep Technical Reference. OEMs are required to run sysprep/oobe before shipping a computer to an end user.
After a computer boots to audit mode, the computer will continue to boot to audit mode until you configure the computer to boot to Windows Welcome.
If OOBE still doesn't work - put your win 7 DVD in - make sure only your HDD is plugged in - and try to boot off your DVD and try to repair your installation.
However....I reccomend just doing it like I said. Unplug the HDD, plug in your SSD, install the OS, then pull off all your information off the old HDD. <--- I would do this if you don't want to lose any data.
Take a look here:
http://www.bizzntech.com/2009/11/04/how-to-turn-off-audit-mode-in-windows-7
Go to the Start> Run.
Type ‘regedit’ and hit enter.
Find and right-click the relevant registry key for your operating system:
Windows 7: ImageState in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State
Select modify - then delete it. I know you mentioned you tried this in the first post, but did you modify it first?
If that doesn't work try this:
If you are running in audit mode, to configure the installation to boot to Windows Welcome, run the sysprep/oobe command. For more information, see Sysprep Technical Reference. OEMs are required to run sysprep/oobe before shipping a computer to an end user.
After a computer boots to audit mode, the computer will continue to boot to audit mode until you configure the computer to boot to Windows Welcome.
If OOBE still doesn't work - put your win 7 DVD in - make sure only your HDD is plugged in - and try to boot off your DVD and try to repair your installation.
However....I reccomend just doing it like I said. Unplug the HDD, plug in your SSD, install the OS, then pull off all your information off the old HDD. <--- I would do this if you don't want to lose any data.
Yea, that is the guide I followed. I right click ImageState and click Modify, highlight and delete the value and the click ok. Reboot, but audit mode is still present and the value is back. It looks like if I just simply run the OOBE mode that comes up that should take care of everything, but I get an error when I do. I am going to restart and try a few things and see if I can't fix it. I'll report back shortly.
Alright, I tried two things with no success. First I tried running the OOBE without deleting the registry value, hoping that would fix the error. No luck. I then tried changing the value to "IMAGE_STATE_COMPLETE" which is the value for a normal startup. No luck, same thing. Oh, and I also completely wiped/formatted my SSD so there is nothing on it. That didn't effect anything, so I would doubt a fresh install on the SSD would fix anything. Maybe a repair to the OS on the HDD might fix the problem? Not sure. I t would seem my only option is to be able to run the OOBE which should just prompt me like my PC was brand new, but other than that it would be normal I would imagine?
winoutreach5
Distinguished
- Dec 1, 2011
- 124
- 0
- 18,710
When Windows boots, there are two modes in which a computer can start:
• Windows Welcome (also called Machine OOBE)
• Audit Mode
The above settings are to two options available within the Sysprep component of the Windows operating system.
I believe you said you had already tried this, however, let’s clarify just to be sure. When one is finished installing necessary applications and making the customizations to the computer in audit mode, one would then proceed to run “sysprep /oobe” command to return to the Windows Welcome screen. You can also do this from the GUI found in the Windows/System32/Sysprep folder.
The /oobe option instructs Windows to run Windows Welcome the next time a computer boots. More information about Audit mode can be found by reading Customize Windows in Audit Mode from TechNet. This is the only way to end audit mode. If running the above command does not work you may want to consider running a repair Windows 7 installation as proposed by Chainzsaw or make provisions for reinstalling the OS.
Jessica
Windows Outreach Team – IT Pro
• Windows Welcome (also called Machine OOBE)
• Audit Mode
The above settings are to two options available within the Sysprep component of the Windows operating system.
I believe you said you had already tried this, however, let’s clarify just to be sure. When one is finished installing necessary applications and making the customizations to the computer in audit mode, one would then proceed to run “sysprep /oobe” command to return to the Windows Welcome screen. You can also do this from the GUI found in the Windows/System32/Sysprep folder.
The /oobe option instructs Windows to run Windows Welcome the next time a computer boots. More information about Audit mode can be found by reading Customize Windows in Audit Mode from TechNet. This is the only way to end audit mode. If running the above command does not work you may want to consider running a repair Windows 7 installation as proposed by Chainzsaw or make provisions for reinstalling the OS.
Jessica
Windows Outreach Team – IT Pro
I appreciate your response Jessica. I have already tried that unsuccessfully. When I run the OOBE mode I get a "fatal error has occurred" and thus nothing happens. I need to figure out either how to fix that error or exit audit mode another way. And just so you know, this computer is not being sold or anything like that, this is my personal PC and I mistakenly got myself into audit mode without really needing to do it in the first place. So I just dug myself into a hole basically. Any more suggestions? Thanks!
winoutreach5
Distinguished
- Dec 1, 2011
- 124
- 0
- 18,710
Let’s try this, run the following command at an elevated command prompt level: “slmgr /dlv” A window should pop up that contains some very important information. The second to last line should read: “Remaining windows rearm count: x” Note: “x” is used as a placeholder as there will be a number likely between 0 and 3 displayed there. You can read more about slmgr.vbs options directly from TechNet here.
From the sound of your problem and according to this Microsoft Knowledge Base (kb) article, an error message such as the one you are describing occurs when the Windows Software Licensing Rearm program has one more than 3 times in a single Windows image. Typically speaking, each computer has a max rearm count of 3. Each time you sysprep a machine you lose one of those rearms. If you see a 0 listed next to the “Remaining Windows rearm count” line you will be unable to run the sysprep command and therefore will need to rebuild the Windows image.
As the Microsoft KB article states, there is an available work around via utilizing the <SkipRearm> command in an XML file. An example of how you would run this command would be: sysprep /oobe /shutdown /unattend:NAMEOFYOURANSWERFILE.xml
More information about sysprep, SkipRearm and more can be found on a TechNet blog here.
Again, if the above does not work, you may need to consider rebuilding the Windows image.
Jessica
Windows Outreach Team – IT Pro
From the sound of your problem and according to this Microsoft Knowledge Base (kb) article, an error message such as the one you are describing occurs when the Windows Software Licensing Rearm program has one more than 3 times in a single Windows image. Typically speaking, each computer has a max rearm count of 3. Each time you sysprep a machine you lose one of those rearms. If you see a 0 listed next to the “Remaining Windows rearm count” line you will be unable to run the sysprep command and therefore will need to rebuild the Windows image.
As the Microsoft KB article states, there is an available work around via utilizing the <SkipRearm> command in an XML file. An example of how you would run this command would be: sysprep /oobe /shutdown /unattend:NAMEOFYOURANSWERFILE.xml
More information about sysprep, SkipRearm and more can be found on a TechNet blog here.
Again, if the above does not work, you may need to consider rebuilding the Windows image.
Jessica
Windows Outreach Team – IT Pro
It actually says I have 5 remaining. What does that mean and is that change the situation? I had no idea how big of a deal this was, lol. I am anxious to get the back up as it is preventing any anti-virus from running currently. Again, I appreciate your help Jessica.
winoutreach5
Distinguished
- Dec 1, 2011
- 124
- 0
- 18,710
First, it is extremely important to understand what Sysprep is intended to do and who it is intended to be used by. The System Preparation (Sysprep) tool prepares an installation of Windows for duplication, auditing, and customer delivery. It would be wise to refrain from issuing a Sysprep command in the future without first familiarizing yourself with the following references:
• What is Sysprep?
• How Sysprep Works?
I have attempted to replicate your scenario on my own system and am unable to produce the same error under similar circumstances. I went searching for a few more potential solutions and came across this thread on the TechNet forums. As you can see, Gandalf50 recommends checking the following logs: setupact.log and setuperr.log. To access these logs quickly, go to start, type in ‘run’ and then type in the following commands:
As Gandalf50 proceeds to state in a later comment, the image may be corrupt as sighted in this Microsoft Knowledge Base article if you see the following error message in the setuperr.log:
Just as a side note, in any documentation you may read you will want to refrain from using the /generalize pass. The sysprep /generalize command removes unique information from your Windows installation, which enables you to reuse that image on different computers – which is not what you intend to do.
I realize that you want to resolve your issue without performing a clean install however the more we dive into the problem you are experiencing, the more the signs point to needing to do just that.
Please check your error logs and consider what has been stated in the KB article and thread mentioned above.
Jessica
Windows Outreach Team – IT Pro
• What is Sysprep?
• How Sysprep Works?
I have attempted to replicate your scenario on my own system and am unable to produce the same error under similar circumstances. I went searching for a few more potential solutions and came across this thread on the TechNet forums. As you can see, Gandalf50 recommends checking the following logs: setupact.log and setuperr.log. To access these logs quickly, go to start, type in ‘run’ and then type in the following commands:
and
As Gandalf50 proceeds to state in a later comment, the image may be corrupt as sighted in this Microsoft Knowledge Base article if you see the following error message in the setuperr.log:
Just as a side note, in any documentation you may read you will want to refrain from using the /generalize pass. The sysprep /generalize command removes unique information from your Windows installation, which enables you to reuse that image on different computers – which is not what you intend to do.
I realize that you want to resolve your issue without performing a clean install however the more we dive into the problem you are experiencing, the more the signs point to needing to do just that.
Please check your error logs and consider what has been stated in the KB article and thread mentioned above.
Jessica
Windows Outreach Team – IT Pro
I am just amazed at how much I messed things up by doing this. I had no idea this would lead to this much trouble. Anyway, I do not have that error in the setuperr.log. Here are the errors I have gotten so far:
These errors show up in that order 8 times, which I would imagine is the number of time I have restarted my PC and tried to fix the problem.
I definitely do not want to do a clean install if I don't have to especially because it will be such a pain to get everything back how I want it in terms of settings and all that, but if it comes down to it what can I do, you know? However, I will stick it out as long as I can if possible. Thanks again!
winoutreach5
Distinguished
- Dec 1, 2011
- 124
- 0
- 18,710
Again, I seriously urge you to consider reinstalling the OS as it appears your image may now be corrupt.
However, with that said I did look in to the error messages in your sysprep setuperr.log and came across this article from TechNet proposing a potential reason for your issue and a work around.
Please try the following and run the sysprep /oobe command again.
Jessica
Windows Outreach Team – IT Pro
However, with that said I did look in to the error messages in your sysprep setuperr.log and came across this article from TechNet proposing a potential reason for your issue and a work around.
Please try the following and run the sysprep /oobe command again.
Jessica
Windows Outreach Team – IT Pro
Well Jessica, I think you deserve a big hug. That seems to have worked. I disabled the service and then rebooted my PC. The same things happened and I was prompted with the Sysprep.exe. I ran the OOBE command, but this time it gave me no error, restarted, and I was prompted with the typical first time use screen. It just made another account, but I deleted it and everything seems to be back to normal, hopefully.
It is amazing how that one service was ruining everything, haha. Anyway, I can't thank you enough for your continued support through all of this. Thank you very much! And hey, this is one more problem that you can add to your arsenal if someone else comes along with it. 
Facebook
Twitter
Instagram