Windows 10: Win10 Enterprise; suddenly in audit mode?

Discus and support Win10 Enterprise; suddenly in audit mode? in Windows 10 Installation and Upgrade to solve the problem; Guys, hear me out... VMware ESXi virtual machine. Installed Win10 Enterprise, went into audit mode, did my installs and whatnot. Shut down the... Discussion in 'Windows 10 Installation and Upgrade' started by Cyphos, Oct 26, 2015.

  1. Cyphos Win User

    Win10 Enterprise; suddenly in audit mode?


    Guys, hear me out...

    VMware ESXi virtual machine. Installed Win10 Enterprise, went into audit mode, did my installs and whatnot. Shut down the machine. Copied that vm and ran sysprep, everything seems just fine and dandy. Activated Windows, put into domain. Used a domain admin account, logged in as domain user. Put in settings, blah, blah...

    Until one day, vm starts up and user cannot log in remotely. I went to the console and logged in as domain admin. Screen goes all glitchy and sysprep window opens, just like in audit mode. Tinkered around a bit, but didn't have time to play with it too much. Restored a previous nights image and everything is fine.

    Fast forward a few weeks. User cannot log in. I log in from console, everything seems ok. Remote desktop services won't start and there's nobody listening @3389. That's weird. All I can find is Event ID 34 with TerminalServices-LocalSessionManager. It's telling me, and I'm paraphrasing, "Remote Desktop Services cannot accept logins, because there is an installation in progress". It's really in Finnish and that's what I came up with. This is the exact same message that I can see when I run my original vm which is in audit mode.

    I've looked into registry and I've looked into the setup state file; both are saying that the ImageState equals IMAGE_STATE_COMPLETE. However, the setup state file has a modified date and date from the evening before everything went weird.

    So, I looked into Panther directory and I saw that setupact.log was growing. All I could see was loads of "Primitive installers commited for repair". I ran sfc /scannow (apparently it found errors but was able to fix them), then ran DISM with restorehealth, and then sfc /scannow again. No errors left. That got rid of the Primitive installer error, but didn't affect otherwise.

    And now, I've found this in C:\windows\panther\unattendgc\setupact.log:

    Code: 2015-10-22 17:27:03, Info [audit.exe] Audit.exe launched with command-line [/user]...2015-10-22 17:27:03, Info [audit.exe] Parsing command line arguments... 2015-10-22 17:27:03, Info [audit.exe] Parsing the following command line: [/user] 2015-10-22 17:27:03, Info [audit.exe] GetAdminAccountName: Local built-in admin account name is [Järjestelmänvalvoja] 2015-10-22 17:27:03, Info [audit.exe] Successfully restored previous state (0x10203) for user [Järjestelmänvalvoja] 2015-10-22 17:27:03, Info [audit.exe] ScreenSaver:Successfully disabled screen saver 2015-10-22 17:27:03, Info [audit.exe] Status for unattend pass [auditUser] = 0x0 2015-10-22 17:27:03, Info [audit.exe] UnattendSearchExplicitPath: Found unattend file at [C:\Windows\Panther\unattend.xml]; examining for applicability. 2015-10-22 17:27:03, Info [audit.exe] UnattendSearchExplicitPath: [C:\Windows\Panther\unattend.xml] does not meet criteria to be used for this unattend pass. 2015-10-22 17:27:05, Info [audit.exe] Found no unattend file for auditUser pass; skipping pass. 2015-10-22 17:27:05, Info [audit.exe] No reboot has been requested for auditUser unattend. 2015-10-22 17:27:05, Info [audit.exe] Successfully ran unattend pass. 2015-10-22 17:27:05, Info [audit.exe] Successfully launched Sysprep with command line [C:\Windows\system32\sysprep\sysprep.exe /reboot ] 2015-10-22 17:27:05, Info [audit.exe] ScreenSaver:Screen saver was originally enabled, successfully re-enabled it 2015-10-22 17:27:05, Info [audit.exe] Audit.exe exiting with code [0x0]... 2015-10-23 08:29:24, Info [windeploy.exe] ------------------------------------------------ 2015-10-23 08:29:24, Info [windeploy.exe] WinDeploy.exe launched with command-line []... 2015-10-23 08:29:24, Info [windeploy.exe] LogBootDeviceInfo:The firmware boot device ARC path is [multi(0)disk(0)rdisk(0)partition(1)] and NT path is [\Device\Harddisk0\Partition1]. 2015-10-23 08:29:24, Info [windeploy.exe] LogBootDeviceInfo:The system boot device ARC path is [multi(0)disk(0)rdisk(0)partition(2)] and NT path is [\Device\Harddisk0\Partition2]. 2015-10-23 08:29:24, Info [windeploy.exe] Making sure that SystemSetupInProgress is cleared. 2015-10-23 08:29:24, Info [windeploy.exe] Starting system services... 2015-10-23 08:29:30, Info [windeploy.exe] WinDeploy.exe exiting with code [0x0] 2015-10-23 08:36:09, Info [windeploy.exe] ------------------------------------------------[/quote] After that audit.exe ran, these problems started. And that windeploy.exe sequence is seen everytime the machine starts up. What the h**k is happening? Just worried about other machines starting to run audit.exe whenever they please...

    :)
     
    Cyphos, Oct 26, 2015
    #1
  2. Dusty2169 Win User

    Windows 10 N

    The MS link for the full comparison seem to be suddenly unavaible. Would you have a updated list of the different versions?

    Win10 US Home Pro Enterprise Education

    Win10 N Home Pro Enterprise Education

    Win 10 others. Home Pro Enterprise Education

    This information is rather elusive at the mommnet
     
    Dusty2169, Oct 26, 2015
    #2
  3. Windows 10 Home fresh install blue screens, Windows program failure and 3rd party program crashes.

    Did you upgrade Win10 Pro to Win10 Enterprise (before you did the fresh install of Win10 Home) or did you replace Win10 Pro with Win10 Enterprise (before you did the fresh install of Win10 Home)? Where did you obtain the installation media for Win10 Home?
    ...Win10 Pro? ...Win10 Enterprise?
     
    PA Bear - MS MVP, Oct 26, 2015
    #3
  4. Cyphos Win User

    Win10 Enterprise; suddenly in audit mode?

    So. I found something. See below:


    Win10 Enterprise; suddenly in audit mode? [​IMG]


    I cleared CmdLine, removed Respecialize and set the rest of them to 0. This is how these were on other machines made from the same image. After rebooting everything seems to be working again.

    I'm still a bit concerned whether there's still something that would need to be set (you know, like what I did to those keys I mentioned earlier) related to sysprep, audit.exe or windeploy.exe. And I'm still worried this might happen again, because I've got no clue what caused this phenomenon.

    Only 30 more years to retirement...
     
    Cyphos, Oct 26, 2015
    #4
  5. SYOB SYOT Win User
    You dude are genious.
    So much better than microsoft customer support.
     
    SYOB SYOT, Apr 4, 2018
    #5
Thema:

Win10 Enterprise; suddenly in audit mode?

Loading...
  1. Win10 Enterprise; suddenly in audit mode? - Similar Threads - Win10 Enterprise suddenly

  2. Win10 Enterprise to Pro

    in Windows 10 Gaming
    Win10 Enterprise to Pro: Hello everyone.I have an old pc to be recycled that slmgr -dli shows as a retail channel linked to my microsoft account - so has a digital license product key. I believe it had win7 that was upgraded to win 10 pro. I also have a pc that my university allowed me to keep when I...
  3. Audit mode

    in Windows 10 Installation and Upgrade
    Audit mode: How do I get out of audit mode? https://answers.microsoft.com/en-us/windows/forum/all/audit-mode/806c0874-884f-479b-8ddb-dee09d104dc4
  4. What is Audit Mode in Windows 10? How to boot into or out of Audit Mode?

    in Windows 10 News
    What is Audit Mode in Windows 10? How to boot into or out of Audit Mode?: [ATTACH]Have you ever wondered how OEMs deploy Windows 10 OS with their own set of apps and drivers? Or how does the recovery partition helps […] This article What is Audit Mode in Windows 10? How to boot into or out of Audit Mode? first appeared on TheWindowsClub.com. read...
  5. what is audit mode

    in Windows 10 Installation and Upgrade
    what is audit mode: my win 10 won't install because it's in audit mode. what is audit mode? https://answers.microsoft.com/en-us/windows/forum/all/what-is-audit-mode/d0b1a6aa-be1e-4abb-b82b-1a3e54675033
  6. audit mode in win10 version 1909 impossible to print

    in Windows 10 Installation and Upgrade
    audit mode in win10 version 1909 impossible to print: I created with MediaCreationTool a USB stick with Win10Pro Version 1909 Build 18363.418 So I installed Windows on a new PC. At the first start I called the Audit Mode with (Shift+Ctrl+F3). From now on it is no longer possible to print. The Windows installed printers...
  7. Audit Mode and Robocopy

    in Windows 10 Network and Sharing
    Audit Mode and Robocopy: So today I had an interesting issue. I had a data transfer from an old hard drive to a newly purchased system. It wasnt my system, else I would've follow windows oobe and then transfered the files. Instead, i hit control+shift+F3 to enter audit mode and then I opened PS as...
  8. Updating Windows 10 in Audit Mode

    in Windows 10 Updates and Activation
    Updating Windows 10 in Audit Mode: We have a Windows 10 WIM configured with the required software. When I pull down the pre-Syspreped image (which was captured while in Audit Mode), I am unable to use Windows Update to patch the image. How are you folks handling the updates to your gold Windows 10 images?...
  9. Audit Mode going into OOBE

    in Windows 10 Installation and Upgrade
    Audit Mode going into OOBE: Hello all, Why is it that when I am in audit mode and I set my .theme package, I then OOBE out, and it deletes the theme that I installed? Do I need to add the theme to an unattended XML file? 78210
  10. Sysprep and Audit Mode questions

    in Windows 10 Installation and Upgrade
    Sysprep and Audit Mode questions: I'm noticing some stuff when running sysprep on an image: - I uninstalled OneDrive in Audit Mode, but after generalization it comes right back? Any way to keep it uninstalled? - Windows Updates seemingly gets undone after going to OOBE, and some drivers got reverted as...