Windows 10: Seeing the RunOnce process when automatically dropping into Audit Mode

Hi there,For WDS, I wrote an answer file that instructs the client machine to drop into Audit Mode, instead of the OOBE.When I try to put a command line in said answer file or in a HKLM RunOnce registry value, it gets stuck at Welcome Administrator login screen.However, when I hit CTRL-ALT-DEL followed by ESC, I'll get to see the result of said command line. mostly test BATs that wait for keyboard input to closeIs there a way to basically kill that Welcome screen that seems to get stuck?

:)

 

Audit mode

Hi Diane,

Windows boots into Windows Welcome Mode and Audit Mode. Windows Welcome Mode
is the first user experience while the Audit mode is used to add customization to Windows images. Sometimes, Windows keeps running in Audit Mode and user has no idea about it, just like in your case. While your machine is running Audit
Mode when upgrading or reinstalling Windows 10, the upgrade won’t progress.

Here's how to exit from Audit mode to reinstall Windows 10:

• Open the administrative or elevated Command Prompt. Type cmd in the
  Search field at the taskbar.
• Type the following command and press Enter key: sysprep /oobe /generalize
  DISCLAIMER: Running sysprep command each time resets Windows licensing state to default. So if your Windows is activated and you run this command, you’ll need to reactivate Windows after executing this command.
  
  
• Once the command IS successfully executed, you’ll be out of Audit Mode. Now you can re-try to upgrade to Windows 10 and it should work.

Let us know if the steps above worked for you.

 

what is audit mode

Hi,



Thank you for writing to Microsoft Community Forums.



I understand that you are facing issues with Audit Mode on your PC.



Usually, Audit mode is used to add customization to Windows images. Sometimes, Windows keeps running in Audit Mode and user has no idea about it, just like in your case. While your machine is running Audit Mode when upgrading
or reinstalling Windows 10, the upgrade won’t progress.



Kindly follow the steps mentioned below to exit Audit mode:

1. Now press Windows +
   S key together to open Search.
   
2. Now type CMD and select Run as administrator.
   
3. Accept the UAC prompts.
   
4. Type in the following commands one by one and hit
   Enter:
   
   sysprep /oobe /generalize
   
5. Close the command prompt window.
   

DISCLAIMER: Running sysprep command each time resets Windows licensing state to default. So if your Windows is activated and you run this command, you’ll need to reactivate Windows after executing
this command.



Let us know how it goes.



Regards,

Prakhar Khare

Microsoft Community – Moderator

 

Updating Windows 10 in Audit Mode

Deleting existing user accounts when returning to Audit Mode after a build or feature upgrade as mentioned in that post I quoted is of course not necessary if and when the image is for your personal use only. The thread where I posted that is however about how to do this in corporate network environment, deploying to 100 laptops and possibly re-deploying an upgraded image when next LTSB version will be released.

When doing this for your own private deployment image keeping existing user accounts there are additional steps required because when sysprepping Windows installation with existing user accounts, active user accounts lose Start and Cortana / Search functionality due Windows SID / GUID being changed. Therefore for you and other private users, disabling all user accounts before sysprep is strongly recommended:

1. Upgrade Windows in normal mode
2. Run net user Administrator /active:yes in elevated Command Prompt
3. Sign out from all user accounts
4. Sign in to built-in admin
5. Run net user USERNAME /active:no in elevated Command Prompt to disable each existing user account
6. Restart to Audit Mode with %windir%\system32\sysprep\sysprep.exe /audit /reboot
   [*]When in Audit Mode, change / add / remove what you want to / need to
7. Run Disk Clean-up
8. Place your answer file unattend.xml in %windir%\system32\sysprep\ folder
9. Run %windir%\system32\sysprep\sysprep.exe /generalize /oobe
   [*]Boot from WinPE, capture the image
10. Boot from HDD, let Windows go through OOBE
11. In OOBE you must create a new admin user, use any temporary name (can't use names of existing users even when they are disabled)
12. When on desktop activate your old existing users with net user USERNAME /active:yes in elevated Command Prompt
    [*]Sign out from temporary admin user, sign in to your old admin user
13. Remove the temporary admin user

Repeat steps 13 through 16 on each machine you deploy this image. Steps 2 through 5 and 13 through 16 are not required if all existing users will be removed in Audit Mode.

Sounds and looks more complicated than what it is