Windows 10: Win10 Enterprise; suddenly in audit mode?

Discus and support Win10 Enterprise; suddenly in audit mode? in Windows 10 Installation and Upgrade to solve the problem; Guys, hear me out... VMware ESXi virtual machine. Installed Win10 Enterprise, went into audit mode, did my installs and whatnot. Shut down the... Discussion in 'Windows 10 Installation and Upgrade' started by Cyphos, Oct 26, 2015.

  1. Cyphos Win User

    Win10 Enterprise; suddenly in audit mode?


    Guys, hear me out...

    VMware ESXi virtual machine. Installed Win10 Enterprise, went into audit mode, did my installs and whatnot. Shut down the machine. Copied that vm and ran sysprep, everything seems just fine and dandy. Activated Windows, put into domain. Used a domain admin account, logged in as domain user. Put in settings, blah, blah...

    Until one day, vm starts up and user cannot log in remotely. I went to the console and logged in as domain admin. Screen goes all glitchy and sysprep window opens, just like in audit mode. Tinkered around a bit, but didn't have time to play with it too much. Restored a previous nights image and everything is fine.

    Fast forward a few weeks. User cannot log in. I log in from console, everything seems ok. Remote desktop services won't start and there's nobody listening @3389. That's weird. All I can find is Event ID 34 with TerminalServices-LocalSessionManager. It's telling me, and I'm paraphrasing, "Remote Desktop Services cannot accept logins, because there is an installation in progress". It's really in Finnish and that's what I came up with. This is the exact same message that I can see when I run my original vm which is in audit mode.

    I've looked into registry and I've looked into the setup state file; both are saying that the ImageState equals IMAGE_STATE_COMPLETE. However, the setup state file has a modified date and date from the evening before everything went weird.

    So, I looked into Panther directory and I saw that setupact.log was growing. All I could see was loads of "Primitive installers commited for repair". I ran sfc /scannow (apparently it found errors but was able to fix them), then ran DISM with restorehealth, and then sfc /scannow again. No errors left. That got rid of the Primitive installer error, but didn't affect otherwise.

    And now, I've found this in C:\windows\panther\unattendgc\setupact.log:

    Code: 2015-10-22 17:27:03, Info [audit.exe] Audit.exe launched with command-line [/user]...2015-10-22 17:27:03, Info [audit.exe] Parsing command line arguments... 2015-10-22 17:27:03, Info [audit.exe] Parsing the following command line: [/user] 2015-10-22 17:27:03, Info [audit.exe] GetAdminAccountName: Local built-in admin account name is [Järjestelmänvalvoja] 2015-10-22 17:27:03, Info [audit.exe] Successfully restored previous state (0x10203) for user [Järjestelmänvalvoja] 2015-10-22 17:27:03, Info [audit.exe] ScreenSaver:Successfully disabled screen saver 2015-10-22 17:27:03, Info [audit.exe] Status for unattend pass [auditUser] = 0x0 2015-10-22 17:27:03, Info [audit.exe] UnattendSearchExplicitPath: Found unattend file at [C:\Windows\Panther\unattend.xml]; examining for applicability. 2015-10-22 17:27:03, Info [audit.exe] UnattendSearchExplicitPath: [C:\Windows\Panther\unattend.xml] does not meet criteria to be used for this unattend pass. 2015-10-22 17:27:05, Info [audit.exe] Found no unattend file for auditUser pass; skipping pass. 2015-10-22 17:27:05, Info [audit.exe] No reboot has been requested for auditUser unattend. 2015-10-22 17:27:05, Info [audit.exe] Successfully ran unattend pass. 2015-10-22 17:27:05, Info [audit.exe] Successfully launched Sysprep with command line [C:\Windows\system32\sysprep\sysprep.exe /reboot ] 2015-10-22 17:27:05, Info [audit.exe] ScreenSaver:Screen saver was originally enabled, successfully re-enabled it 2015-10-22 17:27:05, Info [audit.exe] Audit.exe exiting with code [0x0]... 2015-10-23 08:29:24, Info [windeploy.exe] ------------------------------------------------ 2015-10-23 08:29:24, Info [windeploy.exe] WinDeploy.exe launched with command-line []... 2015-10-23 08:29:24, Info [windeploy.exe] LogBootDeviceInfo:The firmware boot device ARC path is [multi(0)disk(0)rdisk(0)partition(1)] and NT path is [\Device\Harddisk0\Partition1]. 2015-10-23 08:29:24, Info [windeploy.exe] LogBootDeviceInfo:The system boot device ARC path is [multi(0)disk(0)rdisk(0)partition(2)] and NT path is [\Device\Harddisk0\Partition2]. 2015-10-23 08:29:24, Info [windeploy.exe] Making sure that SystemSetupInProgress is cleared. 2015-10-23 08:29:24, Info [windeploy.exe] Starting system services... 2015-10-23 08:29:30, Info [windeploy.exe] WinDeploy.exe exiting with code [0x0] 2015-10-23 08:36:09, Info [windeploy.exe] ------------------------------------------------[/quote] After that audit.exe ran, these problems started. And that windeploy.exe sequence is seen everytime the machine starts up. What the h**k is happening? Just worried about other machines starting to run audit.exe whenever they please...

    :)
     
    Cyphos, Oct 26, 2015
    #1
  2. Dusty2169 Win User

    Windows 10 N

    The MS link for the full comparison seem to be suddenly unavaible. Would you have a updated list of the different versions?

    Win10 US Home Pro Enterprise Education

    Win10 N Home Pro Enterprise Education

    Win 10 others. Home Pro Enterprise Education

    This information is rather elusive at the mommnet
     
    Dusty2169, Oct 26, 2015
    #2
  3. Windows 10 Home fresh install blue screens, Windows program failure and 3rd party program crashes.

    Did you upgrade Win10 Pro to Win10 Enterprise (before you did the fresh install of Win10 Home) or did you replace Win10 Pro with Win10 Enterprise (before you did the fresh install of Win10 Home)? Where did you obtain the installation media for Win10 Home?
    ...Win10 Pro? ...Win10 Enterprise?
     
    PA Bear - MS MVP, Oct 26, 2015
    #3
  4. Cyphos Win User

    Win10 Enterprise; suddenly in audit mode?

    So. I found something. See below:


    Win10 Enterprise; suddenly in audit mode? [​IMG]


    I cleared CmdLine, removed Respecialize and set the rest of them to 0. This is how these were on other machines made from the same image. After rebooting everything seems to be working again.

    I'm still a bit concerned whether there's still something that would need to be set (you know, like what I did to those keys I mentioned earlier) related to sysprep, audit.exe or windeploy.exe. And I'm still worried this might happen again, because I've got no clue what caused this phenomenon.

    Only 30 more years to retirement...
     
    Cyphos, Oct 26, 2015
    #4
  5. SYOB SYOT Win User
    You dude are genious.
    So much better than microsoft customer support.
     
    SYOB SYOT, Apr 4, 2018
    #5
Thema:

Win10 Enterprise; suddenly in audit mode?

Loading...
  1. Win10 Enterprise; suddenly in audit mode? - Similar Threads - Win10 Enterprise suddenly

  2. upgrade to Win10 Enterprise

    in Windows 10 Updates and Activation
    upgrade to Win10 Enterprise: I just bought a Dell Inspiron with Windows 10 Home pre-loaded. I found I needed Remote Desktop but that version didn't support it. So I upgraded to Enterprise but now I can't activate the Windows new version. I bought the upgrade from the Microsoft store but it did not come...
  3. Audit Mode and Robocopy

    in Windows 10 Network and Sharing
    Audit Mode and Robocopy: So today I had an interesting issue. I had a data transfer from an old hard drive to a newly purchased system. It wasnt my system, else I would've follow windows oobe and then transfered the files. Instead, i hit control+shift+F3 to enter audit mode and then I opened PS as...
  4. uninstall win10 enterprise

    in Windows 10 Installation and Upgrade
    uninstall win10 enterprise: micros up graded me to win10 enterprise. since i have win7-8- to win10 ,so I have a bios digital key, can not find. I am not develper or working or school. so micros accessed denided my admin. blocked update except what they give me. blocked download. refused to active. and...
  5. How to update windows 1803 in audit mode?

    in Windows 10 Updates and Activation
    How to update windows 1803 in audit mode?: Hello, creating a golden image with loads of applications and doing updates, was able to do up to doing the 1803 update which does not allow me to, using windows 10 education, in audit mode. heard of doing an offline update, not sure where to find this info, many thanks 115725
  6. Windows 10 Audit mode and Windows Updates

    in Windows 10 Installation and Upgrade
    Windows 10 Audit mode and Windows Updates: I apologize for the confusion on this, but I've been hitting a lot of brick walls with sysprep and WIndows 10. I'm rebuilding an image from scratch. With Windows 10, should I boot into Audit Mode and install all my applications, and configure my desktop and my start menu,...
  7. Updating Windows 10 in Audit Mode

    in Windows 10 Updates and Activation
    Updating Windows 10 in Audit Mode: We have a Windows 10 WIM configured with the required software. When I pull down the pre-Syspreped image (which was captured while in Audit Mode), I am unable to use Windows Update to patch the image. How are you folks handling the updates to your gold Windows 10 images?...
  8. Pinned Icons in Customized Audit Mode

    in Windows 10 Installation and Upgrade
    Pinned Icons in Customized Audit Mode: I customized my Windows 10 in Audit Mode and created a answer file by the Windows System Image Manager. CopyProfile in the answer file is set on true In the customization I removed the Edge browser Icon and the Windows Store from the Task bar. I know that pinned Icons at...
  9. Audit Mode going into OOBE

    in Windows 10 Installation and Upgrade
    Audit Mode going into OOBE: Hello all, Why is it that when I am in audit mode and I set my .theme package, I then OOBE out, and it deletes the theme that I installed? Do I need to add the theme to an unattended XML file? 78210
  10. Sysprep and Audit Mode questions

    in Windows 10 Installation and Upgrade
    Sysprep and Audit Mode questions: I'm noticing some stuff when running sysprep on an image: - I uninstalled OneDrive in Audit Mode, but after generalization it comes right back? Any way to keep it uninstalled? - Windows Updates seemingly gets undone after going to OOBE, and some drivers got reverted as...