Need your help with Windows 10 sysprep (weird issue of course)

Boyan Biandov

Hi guys,

I’m posting here as a long time FOG user and although this isn’t FOG specific thing I am using the collective expertise accumulated around FOG user base to seek Windows advice.

We’ve observed this anomaly with ANY sysprepped windows 10 image where sysprep was used with an answer file. I am deliberate in making that clear because the issue doesn’t manifest itself if one uses the stand alone sysprep method where you have to answer by hand the interview questions after a re-seal/generalize without an answer file.

So back to the issue; once the image has been reselaed then any future user will get stuck with moving blue dots upon any kind of start menu search. The only fix is to copy c:\users\Administrator\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy to the profile of the user in question. Of course that must be done for every user that would use that machine - you can see how crazy that is.

Domain join or workgroup – no difference. It happens with local users so this isn’t the GPO thing some are talking about as a potential culprit.

Has anyone encountered this and if so what’s the remedy? Thank you all!

alt text

Joe Schmitt

@boyan-biandov that is certainly strange and I’ve never seen it happen before. I’m not sure what you’ve tried so far, but here’s a couple ideas to hopefully at least workaround the issue:

Try copying c:\users\Administrator\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy to C:\Users\Default\AppData\
I suppose you could use Logon script via GPO to also manually copy over that folder every time

Would you also be able to share your unattend file? Feel free to strip out any sensitive information in it.

Boyan Biandov

@Joe-Schmitt Thanks Joe, yes I’ve tried to copy the immersive control panel folder to c:\uses\default – no go.

The unattended file is below, I’ve tried with the simplest of all files - still the same thing.
Are you saying that you sysprep your win10 images, re-seal them with an answer file and this issue doesn’t occur for you? FYI: I am using MAK enterprise media: SW_DVD9_Win_Pro_10_1709.1_64BIT_English_Pro_Ent_EDU_N_MLF_X21-67518.ISO straight from Microsoft.

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="specialize">
        <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <RunSynchronous>
                <RunSynchronousCommand wcm:action="add">
                    <Order>1</Order>
                    <Path>net user Administrator /active:yes</Path>
                </RunSynchronousCommand>
            </RunSynchronous>
        </component>
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <CopyProfile>true</CopyProfile>
            <ShowWindowsLive>false</ShowWindowsLive>
            <TimeZone>Pacific Standard Time</TimeZone>
            <DoNotCleanTaskBar>true</DoNotCleanTaskBar>
            <ComputerName>*</ComputerName>
            <OEMName>SEIU 1021</OEMName>
            <RegisteredOrganization>ORG</RegisteredOrganization>
            <RegisteredOwner>ORG</RegisteredOwner>
        </component>
    </settings>
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <AutoLogon>
                <Password>
                    <Value>....</Value>
                    <PlainText>false</PlainText>
                </Password>
                <Enabled>true</Enabled>
                <LogonCount>1</LogonCount>
                <Username>Administrator</Username>
            </AutoLogon>
            <OOBE>
                <HideEULAPage>true</HideEULAPage>
                <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
                <NetworkLocation>Work</NetworkLocation>
                <ProtectYourPC>1</ProtectYourPC>
                <SkipMachineOOBE>true</SkipMachineOOBE>
                <SkipUserOOBE>true</SkipUserOOBE>
                <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
                <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
                <UnattendEnableRetailDemo>false</UnattendEnableRetailDemo>
            </OOBE>
            <UserAccounts>
                <AdministratorPassword>
                    <Value>....</Value>
                    <PlainText>false</PlainText>
                </AdministratorPassword>
                <LocalAccounts>
                    <LocalAccount wcm:action="add">
                        <Password>
                            <Value>....</Value>
                            <PlainText>false</PlainText>
                        </Password>
                        <Description>Local Administrator</Description>
                        <DisplayName>Administrator</DisplayName>
                        <Group>Administrators</Group>
                        <Name>Administrator</Name>
                    </LocalAccount>
                </LocalAccounts>
            </UserAccounts>
            <RegisteredOrganization>Your Org</RegisteredOrganization>
            <RegisteredOwner>End User</RegisteredOwner>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="wim:c:/soft/install.wim#Windows 10 Pro" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

Mod note: edited out some strings

imagingmaster21

@boyan-biandov
On one of the machines affected can you launch Command Line elevated and run this:

sfc -scannow

Let me know the results, this will check for integrity issues with Windows. I haven’t seen this issue in particular but dealt with strange issues and running this scan sometimes fixes it. It is worth a shot. Along with @Joe-Schmitt suggestion of the app data folder.

x23piracy

Microsoft is closing the sysprep doors, the new shit is intune and autopilot brave new world
I am sure from version to version 1803 1809 1903 they will close more doors.

Welcome to the cloud

Regards X23

Boyan Biandov

@imagingmaster21 Thanks - I don’t get any files replaced or indicated as an anomaly when using sfc. This isn’t an anomaly caused by some corruption, it is replicated 100% of the time using a clean install and going into audit mode straight on the first boot.

I am astonished how nobody is actually using sysprep from a clean ISO boot and ctrl-shift-f3 since those who claim to be “using” sysprep do not confirm this issue yet this is a FOG forum. If one is using FOG then sysprep and audit mode is a must? I may be missing something of course.

The MDT method does not manifest this issue, sure but then that requires changing to a whole another animal. There’s a reason why I love fog!

imagingmaster21

@boyan-biandov I’ve laely bene building images off Virtual Machines and not running Sysprep Before capturing I just do a command of:

shutdown -s -t 0

I hae not had any issues with both Windows 7 and 10, with it being a VM it does just as good if not better at getting drivers after imaging on actual machines than with sysprep.

imagingmaster21

@boyan-biandov
Did you try putting something like this in your answer file:

<cpi:offlineImage cpi:source="wim:c:/users/administrator/desktop/10%20pro/sw_dvd5_win_pro_ent_edu_n_10_1709_64bit_english_mlf_x21-50143/sources/install.wim#Windows 10 Pro" xmlns:cpi="urn:schemas-microsoft-com:cpi" />

p4cm4n

sorry, but it just popped up -

the issue is with copy profile. who knows why - but i have had the same issue. i’ve just defaulted to NOT using copy profile true, and some people have been using some ForensIT products like defprof to combat the issue…

i second that microsoft doesn’t care about us who use sysprep, and its limited lifespan remaining…if it did, sysprep would be much more feature robust.

sudburr

This is the result of a combination of things. With each successive iteration, 1507, 1511, 1607, 1703, 1709, 1803 things have changed subtly. A fun sleuthing experience each time.

Answer this. Are you doing a copyprofile=true? Google from there.

I recommend building your Win10 image in a VM and include the following.

Disconnect the NIC before installing (to prevent Windows Store updates which WILL otherwise cause problems)
When you reach the Sysprep Tool at the desktop, always only CANCEL. Selecting Enter Audit Mode will generate an extra (invisible) File Explorer.exe shortcut in “C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\”
DISABLE Store AutoUpdates policy while building
Computer \ Administrative Templates \ Windows Components \ Store

Turn off Automatic Download and Install of updates = ENABLED

DISABLE Microsoft Store Install Service (InstallService)

CMD: net stop InstallService
CMD: sc config InstallService start= disabled

Reboot
Connect your NIC
While building your image, to prevent Windows 10 (ie: Edge) from resetting file associations apply this v1803.reg

Windows Registry Editor Version 5.00

; Description Prevents Windows 10 from resetting the file associations
; ... by adding NoOpenWith & NoStaticDefaultVerb values for all the modern apps.
; Created on Feb 13 2016 by Ramesh Srinivasan
; Updated on Sep 28 2016
; The Winhelponline Blog
; http://www.winhelponline.com/blog/windows-10-resetting-file-associations/
; Tested in Windows 10 v1511 & 1607
; Updated 20180522 for Windows 10v1803 by Robert Sudbury

;-------------------
; Microsoft Edge
; [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftEdge_42.17134.1.0_neutral__8wekyb3d8bbwe\MicrosoftEdge\Capabilities\FileAssociations]
;-------------------
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9]
;File Types .htm, .html
"NoOpenWith"=""
"NoStaticDefaultVerb"=""

[HKEY_CURRENT_USER\SOFTWARE\Classes\AppXd4nrz8ff68srnhf9t5a8sbjyar1cr723]
;File Types .pdf
"NoOpenWith"=""
"NoStaticDefaultVerb"=""

[HKEY_CURRENT_USER\SOFTWARE\Classes\AppXde74bfzw9j31bzhcvsrxsyjnhhbq66cs]
;File Types .svg
"NoOpenWith"=""
"NoStaticDefaultVerb"=""

[HKEY_CURRENT_USER\SOFTWARE\Classes\AppXcc58vyzkbjbs4ky0mxrmxf8278rk9b3t]
;File Types .xml
"NoOpenWith"=""
"NoStaticDefaultVerb"=""

[HKEY_CURRENT_USER\SOFTWARE\Classes\AppXvepbp3z66accmsd0x877zbbxjctkpr6t]
;File Types .epub
"NoOpenWith"=""
"NoStaticDefaultVerb"=""


; =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


;-------------------
; Microsoft Windows Photos
; [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2018.18011.15918.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations]
;-------------------

;File Types .bmp, .dib, .gif, .ico, .jfif, .jpe, .jpeg, .jpg, .jxr, .png, .thumb, .tif, .tiff, .wdp
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc]
"NoOpenWith"=""
"NoStaticDefaultVerb"=""

;File Types .arw, .cr2, .crw, .erf, .kdc, .mrw, .nef, .nrw, .orf, .pef, .raf, .raw, .rw2, .rwl, .sr2, .srw,
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h]
"NoOpenWith"=""
"NoStaticDefaultVerb"=""

;File Types .dng
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppXvvwq6wxamf7qhxd0vn6wm1wwehyxrdd6]
"NoOpenWith"=""
"NoStaticDefaultVerb"=""

;File Types .3g2, .3gp, .3gp2, .3gpp, .asf, .avi, .m2t, .m2ts, .m4v, .mkv, .mov, .mp4, .mp4v, .mts, .wm, .wmv
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppXk0g4vb8gvt7b93tg50ybcy892pge6jmt]
"NoOpenWith"=""
"NoStaticDefaultVerb"=""


;-------------------
; Microsoft3DViewer
; [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_2.1803.8022.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\FileAssociations]
;-------------------
;File Types .3MF, .OBJ, .STL, .PLY, .GLTF, .GLB
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppXmgw6pxxs62rbgfp9petmdyb4fx7rnd4k]
"NoOpenWith"=""
"NoStaticDefaultVerb"=""


;-------------------
; Groove Music
; [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.17112.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\FileAssociations]
;-------------------
;File Types .aac, .ac3, .adt, .adts, .amr, .ec3, .flac, .m4a, .m4r, .mka, .mp3, .mpa, .wav, .wma, .m3u, .wpl, .zpl
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs]
"NoOpenWith"=""
"NoStaticDefaultVerb"=""


;-------------------
; Films & TV
; [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.17112.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\FileAssociations]
;-------------------
;File Types .3g2, .3gp, .3gp2, .3gpp, .asf, .avi, .divx, .m1v, .m2ts, .m2t, .m2v, .m4v, .mkv, .mod, .mov, .mp2v, .mp4, .mp4v, .mpe, .mpeg, .mpg, .mpv2, .mts, .tod, .ts, .tts, .wm, .wmv, .xvid
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h]
"NoOpenWith"=""
"NoStaticDefaultVerb"=""


;-------------------
; Print3D
; [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Print3D_2.0.3621.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations]
;-------------------
;File Types .stl, .3mf, .obj, .wrl, .ply
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppXr0rz9yckydawgnrx5df1t9s57ne60yhn]
"NoOpenWith"=""
"NoStaticDefaultVerb"=""


;-------------------
; Windows Sound Recorder
; [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1712.10611.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations]
;-------------------
;File Types .m4a
[HKEY_CURRENT_USER\SOFTWARE\Classes\AppX5sy1gww9q4g2gt941cdxxd7s07xe5vph]
"NoOpenWith"=""
"NoStaticDefaultVerb"=""

To Master your image for capturing is where a lot of voodoo happens depending on your environment and what you want to happen. I incorporate unattend.xml, Scripts (ErrorHandler.cmd + SetupComplete.cmd) and custom scripts for auto-logon and more.

To cleanup problems caused by COPYPROFILE=TRUE, I include the following in my SetupComplete.cmd

REM "Clean up problems caused by using COPYPROFILE=TRUE"
rd /s /q "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache"
rd /s /q "C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache"
del /f /q /a:sh "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCacheLock.dat"

rd /s /q "C:\Users\Default\AppData\Local\Microsoft\Windows\WebCache"
rd /s /q "C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache"
del /f /q /a:sh "C:\Users\Default\AppData\Local\Microsoft\Windows\WebCacheLock.dat"

After setting file associations (eg: Chrome as default browser) I export these settings by:

dism.exe /Online /Export-DefaultAppAssociations:C:\temp\defaults.xml

Add the following Prevent_Association_Reset.vbs to “%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\” . Yes it MUST be re-applied by the user. Sysprep wipes and rebuilds critical sections of the registry breaking what you originally setup to be prevented while building the image.

' UserRunOnce.vbs
' - configuration to be applied at USER logon
'
' 20180517 - initial release

'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
' Define Global Parameters

Option Explicit




'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
' Define Global Constants

Const gcERR1 = "-1"														




'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
' Define Global Objects

Dim objShell : Set objShell = Wscript.CreateObject( "Wscript.Shell" )
Dim objFSO : Set objFSO = CreateObject( "Scripting.FileSystemObject" )




'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
' Make it so ...

sWindows_10v1803_File_Association_Reset_Prevent

Wscript.Quit




'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
' Define Subroutines

Sub sWindows_10v1803_File_Association_Reset_Prevent()
	'Prevent Windows from resetting file associations
	'-------------------
	' Microsoft Windows Photos
	' [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2018.18011.15918.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations]
	'-------------------
	'File Types .bmp, .dib, .gif, .ico, .jfif, .jpe, .jpeg, .jpg, .jxr, .png, .thumb, .tif, .tiff, .wdp
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\NoStaticDefaultVerb","","REG_SZ"

	'File Types .arw, .cr2, .crw, .erf, .kdc, .mrw, .nef, .nrw, .orf, .pef, .raf, .raw, .rw2, .rwl, .sr2, .srw,
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\NoStaticDefaultVerb","","REG_SZ"

	'File Types .dng
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXvvwq6wxamf7qhxd0vn6wm1wwehyxrdd6\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXvvwq6wxamf7qhxd0vn6wm1wwehyxrdd6\NoStaticDefaultVerb","","REG_SZ"

	'File Types .3g2, .3gp, .3gp2, .3gpp, .asf, .avi, .m2t, .m2ts, .m4v, .mkv, .mov, .mp4, .mp4v, .mts, .wm, .wmv
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXk0g4vb8gvt7b93tg50ybcy892pge6jmt\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXk0g4vb8gvt7b93tg50ybcy892pge6jmt\NoStaticDefaultVerb","","REG_SZ"

	'-------------------
	' Microsoft3DViewer
	' [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_2.1803.8022.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\FileAssociations]
	'-------------------
	'File Types .3MF, .OBJ, .STL, .PLY, .GLTF, .GLB
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXmgw6pxxs62rbgfp9petmdyb4fx7rnd4k\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXmgw6pxxs62rbgfp9petmdyb4fx7rnd4k\NoStaticDefaultVerb","","REG_SZ"

	'-------------------
	' Microsoft Edge
	' [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftEdge_42.17134.1.0_neutral__8wekyb3d8bbwe\MicrosoftEdge\Capabilities\FileAssociations]
	'-------------------
	'File Types .htm, .html
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9\NoStaticDefaultVerb","","REG_SZ"

	'File Types .pdf
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXd4nrz8ff68srnhf9t5a8sbjyar1cr723\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXd4nrz8ff68srnhf9t5a8sbjyar1cr723\NoStaticDefaultVerb","","REG_SZ"

	'File Types .svg
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXde74bfzw9j31bzhcvsrxsyjnhhbq66cs\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXde74bfzw9j31bzhcvsrxsyjnhhbq66cs\NoStaticDefaultVerb","","REG_SZ"

	'File Types .xml
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXcc58vyzkbjbs4ky0mxrmxf8278rk9b3t\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXcc58vyzkbjbs4ky0mxrmxf8278rk9b3t\NoStaticDefaultVerb","","REG_SZ"

	'File Types .epub
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXvepbp3z66accmsd0x877zbbxjctkpr6t\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXvepbp3z66accmsd0x877zbbxjctkpr6t\NoStaticDefaultVerb","","REG_SZ"

	'-------------------
	' Groove Music
	' [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.17112.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\FileAssociations]
	'-------------------
	'File Types .aac, .ac3, .adt, .adts, .amr, .ec3, .flac, .m4a, .m4r, .mka, .mp3, .mpa, .wav, .wma, .m3u, .wpl, .zpl
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs\NoStaticDefaultVerb","","REG_SZ"

	'-------------------
	' Films & TV
	' [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.17112.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\FileAssociations]
	'-------------------
	'File Types .3g2, .3gp, .3gp2, .3gpp, .asf, .avi, .divx, .m1v, .m2ts, .m2t, .m2v, .m4v, .mkv, .mod, .mov, .mp2v, .mp4, .mp4v, .mpe, .mpeg, .mpg, .mpv2, .mts, .tod, .ts, .tts, .wm, .wmv, .xvid
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX6eg8h5sxqq90pv53845wmnbewywdqq5h\NoStaticDefaultVerb","","REG_SZ"

	'-------------------
	' Print3D
	' [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Print3D_2.0.3621.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations]
	'-------------------
	'File Types .stl, .3mf, .obj, .wrl, .ply
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXr0rz9yckydawgnrx5df1t9s57ne60yhn\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppXr0rz9yckydawgnrx5df1t9s57ne60yhn\NoStaticDefaultVerb","","REG_SZ"

	'-------------------
	' Windows Sound Recorder
	' [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1712.10611.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations]
	'-------------------
	'File Types .m4a
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX5sy1gww9q4g2gt941cdxxd7s07xe5vph\NoOpenWith","","REG_SZ"
	objShell.RegWrite "HKCU\SOFTWARE\Classes\AppX5sy1gww9q4g2gt941cdxxd7s07xe5vph\NoStaticDefaultVerb","","REG_SZ"
End Sub




'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
' Define Functions




'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=




'EOF

Disconnect the NIC, then rollback the preventative measures put in place at the start of the image build.

[Computer \ Admin Templates \ Windows Components \ Store]
- Turn off Automatic Download and Install of updates = NOT CONFIGURED

CMD:  sc config InstallService start= demand

Copy my scripts and .xml to their end locations then run sysprep as:

sysprep /generalize /oobe /quit /unattend:unattend.xml

… yes QUIT, not shutdown. This allows me to continue working.

I then perform a file association defaults import. This could be included in coming out of sysprep, but I do so many other things at this stage that it’s easier for me to do it here.

dism.exe /Online /Import-DefaultAppAssociations:C:\temp\defaults.xml

Finally I clear all the event logs

for /f %%a in ('WEVTUTIL EL') do WEVTUTIL CL "%%a"

and defrag (even on a vm)

defrag c: /x /h /u /v

Now I shutdown

shutdown -s -t 0

Among the crazier things, Windows 10 likes to revert certain elements of the results of Copy Profile AFTER coming out of sysprep, which makes timing of some of the steps above rather critical. They cannot happen before they are intended or your effort is wasted.

Now there is a LOT I left out that I use to optimize our images even more but these will get you around the current crop of v1803 gotchas.

p4cm4n

@sudburr

Wow.
I just was attempting to help without researching because i had this happen to me and decided…eh screw copy profile. didn’t have time to figure the mess out.

i appreciate it tremendously because what all you just posted will save me a huge headache these next couple batches of images I have to make.

clearly you’ve done your research - THANK YOU.

NT_Tech

@boyan-biandov

I had issues as well. I will over-answer for you in an attempt to help others.

I have a “startup” folder on my root drives for all images. It is protected from anyone but the system administrator from access. I use it for more that this (like a batch file that forces gpupdate after it is joined.)

It has three files in it related to the sysprep process.
prepit.bat <- syspreps the system
unattent.xml <- the unattend xml file for the sysprep (this one is for Enterprise LTS 2016 with KMS Keys)
setupcomplete.cmd <- the file the reinserts FOG Service on the image after imaging.

Prepit.bat

REM make the folder and copy the FOG Service start file there
mkdir C:\Windows\Setup\scripts
copy c:\startup\setupcomplete.cmd C:\Windows\Setup\scripts\setupcomplete.cmd
REM Make sure the current unattend.xml file is in the folder
copy c:\startup\unattend.xml C:\Windows\System32\sysprep\unattend.xml
REM disable the FOG service before sysprep
sc config fogservice start=demand
REM sysprep the machine and shut down.
C:\Windows\System32\sysprep\sysprep /generalize /oobe /shutdown /unattend:C:\Windows\System32\sysprep\unattend.xml

SetupComplete.cmd
sc config FOGService start= auto
shutdown -t 0 -r

Unattend.xml
<?xml version=“1.0” encoding=“utf-8”?>
<unattend xmlns=“urn:schemas-microsoft-com:unattend”>
<settings pass=“specialize”>
<component name=“Microsoft-Windows-Shell-Setup” processorArchitecture=“amd64” publicKeyToken=“31bf3856ad364e35” language=“neutral” versionScope=“nonSxS” xmlns:wcm=“http://schemas.microsoft.com/WMIConfig/2002/State” xmlns:xsi=“http://www.w3.org/2001/XMLSchema-instance”>
<CopyProfile>true</CopyProfile>
<ShowWindowsLive>false</ShowWindowsLive>
<TimeZone>Eastern Standard Time</TimeZone>
<ProductKey>NRG8B-VKK3Q-CXVCJ-9G2XF-6Q84J</ProductKey>
<RegisteredOrganization>NTLS</RegisteredOrganization>
</component>
<component name=“Microsoft-Windows-Deployment” processorArchitecture=“amd64” publicKeyToken=“31bf3856ad364e35” language=“neutral” versionScope=“nonSxS” xmlns:wcm=“http://schemas.microsoft.com/WMIConfig/2002/State” xmlns:xsi=“http://www.w3.org/2001/XMLSchema-instance”>
<RunSynchronous>
<RunSynchronousCommand wcm:action=“add”>
<Order>1</Order>
<Path>cmd /c net user administrator /active:yes</Path>
</RunSynchronousCommand>
</RunSynchronous>
</component>
</settings>
<settings pass=“oobeSystem”>
<component name=“Microsoft-Windows-International-Core” processorArchitecture=“amd64” publicKeyToken=“31bf3856ad364e35” language=“neutral” versionScope=“nonSxS” xmlns:wcm=“http://schemas.microsoft.com/WMIConfig/2002/State” xmlns:xsi=“http://www.w3.org/2001/XMLSchema-instance”>
<InputLocale>en-US</InputLocale>
<SystemLocale>en-US</SystemLocale>
<UILanguage>en-US</UILanguage>
<UILanguageFallback>en-US</UILanguageFallback>
<UserLocale>en-US</UserLocale>
</component>
<component name=“Microsoft-Windows-Shell-Setup” processorArchitecture=“amd64” publicKeyToken=“31bf3856ad364e35” language=“neutral” versionScope=“nonSxS” xmlns:wcm=“http://schemas.microsoft.com/WMIConfig/2002/State” xmlns:xsi=“http://www.w3.org/2001/XMLSchema-instance”>
<OOBE>
<HideEULAPage>true</HideEULAPage>
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
<NetworkLocation>Work</NetworkLocation>
<ProtectYourPC>1</ProtectYourPC>
<SkipMachineOOBE>true</SkipMachineOOBE>
<SkipUserOOBE>true</SkipUserOOBE>
</OOBE>
<RegisteredOrganization>National Trail Local Schools</RegisteredOrganization>
<RegisteredOwner>National Trail Local Schools</RegisteredOwner>
<ShowWindowsLive>false</ShowWindowsLive>
<TimeZone>Eastern Standard Time</TimeZone>
</component>
</settings>
<settings pass=“generalize”>
<component name=“Microsoft-Windows-Security-SPP” processorArchitecture=“amd64” publicKeyToken=“31bf3856ad364e35” language=“neutral” versionScope=“nonSxS” xmlns:wcm=“http://schemas.microsoft.com/WMIConfig/2002/State” xmlns:xsi=“http://www.w3.org/2001/XMLSchema-instance”>
<SkipRearm>1</SkipRearm>
</component>
</settings>
<cpi:offlineImage cpi:source=“wim:c:/users/administrator/documents/win10/sources/install.wim#Windows 10 Enterprise 2016 LTSB” xmlns:cpi=“urn:schemas-microsoft-com:cpi” />
</unattend>

The automation of the killing of FOG and restarting has helped me not forget. You can use the same files to kill other processes as well and restart them after imaging.

Brian

p4cm4n

@NT_Tech product key censor?? thx tho, i’m saving your stuff for future reference too.

Need your help with Windows 10 sysprep (weird issue of course)

191

11.6k

17.1k

154.6k