Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a/the way to tell if a given WIM was captured from a machine that was sysprep'd with the (equivalent of the) /generalize parameter. Interested in Server 2003 R2 as the source platform (x86 and amd64 architectures).

Server 2008 seems to do something with the Registry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State

Such that we can detect that at WIM mount. However, 2003 does not seem to have this or an equivalent that I can determine.

share|improve this question
add comment

1 Answer

HKEY_LOCAL_MACHINE\System\Setup key

If you see a multi-string name of CloneTag then you know its been sysprepped with the /generalized tag. Under the Data you will see the date this was done.

sidenote:// Are you concerned about this in relation to KMS by any chance? If so there also ways to get CMID data from the KMS host, sort, and identify how many computers at your site haven't been generalized.

share|improve this answer
    
Thank you! That will do nicely. –  Joe Baltimore Feb 16 '11 at 2:48
    
Is this for 2003 only? I checked a 2008_amd64 WIM that was sysprep'd without /generalize and the CloneTag is there as well. –  Joe Baltimore Feb 16 '11 at 3:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.