It looks like a sysprep /generalize into audit mode before capture solved the problem. Thank you for your help!