Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows 2008 R2 host running Hyper-V. I meant to run "sysprep /audit /reboot" on one of the virtual machines, but ended up running that on the host (doing this through 2 layers of RDP - bad idea). The server was one of two domain controllers, but thankfully not in production yet. The second controller is fine, I shut it down to prevent any additional replication.

I know that audit mode can be disabled by removing a registry key, but the question is what is the state of the server? Can it come back up as an AD member or does it need to be reinstalled?

Running "sysprep /generalize" would be the end of the machine, but what happens without that flag? What was changed, what was lost?

Don't have system state backups. This was a new sever I've been configuring for the past few weeks.


I'd still like to know if the server could have been recovered in theory, but at this point I decided to backup as much as I can and reinstall the OS. Seems like the safer thing to do.

share|improve this question

I found this line saying

If you use sysprep/audit to boot to audit mode, the computer will be removed from a domain. You must rejoin the computer to a domain in audit mode.


So your server being a domain controller, I'm guessing the system ran a dcpromo when your rebooted into Audit mode.

share|improve this answer
I thought so too, but currently I still have access to Users and Computers, group policies, etc. System properties still shows the system as being part of the domain. Maybe this will change on next reboot? – VokinLoksar Mar 1 '12 at 0:55
So after you ran sysprep /audit, you still haven't restarted the server yet? – ErJab Mar 1 '12 at 1:00
The server restarted itself, since I also passed /reboot. It up is and running in audit mode, but I can still RDP to it using my domain credentials. It wiped all of my profile settings, but the account itself still works. – VokinLoksar Mar 1 '12 at 1:29
Maybe do a system restore to a point previous of running sysprep on the computer would work for you? – Phillip R. Mar 11 '12 at 17:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.