Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a/the way to tell if a given WIM was captured from a machine that was sysprep'd with the (equivalent of the) /generalize parameter. Interested in Server 2003 R2 as the source platform (x86 and amd64 architectures).

Server 2008 seems to do something with the Registry:


Such that we can detect that at WIM mount. However, 2003 does not seem to have this or an equivalent that I can determine.

share|improve this question


If you see a multi-string name of CloneTag then you know its been sysprepped with the /generalized tag. Under the Data you will see the date this was done.

sidenote:// Are you concerned about this in relation to KMS by any chance? If so there also ways to get CMID data from the KMS host, sort, and identify how many computers at your site haven't been generalized.

share|improve this answer
Thank you! That will do nicely. – joebalt Feb 16 '11 at 2:48
Is this for 2003 only? I checked a 2008_amd64 WIM that was sysprep'd without /generalize and the CloneTag is there as well. – joebalt Feb 16 '11 at 3:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.