I'm looking for a/the way to tell if a given WIM was captured from a machine that was sysprep'd with the (equivalent of the) /generalize parameter. Interested in Server 2003 R2 as the source platform (x86 and amd64 architectures).

Server 2008 seems to do something with the Registry:


Such that we can detect that at WIM mount. However, 2003 does not seem to have this or an equivalent that I can determine.



If you see a multi-string name of CloneTag then you know its been sysprepped with the /generalized tag. Under the Data you will see the date this was done.

sidenote:// Are you concerned about this in relation to KMS by any chance? If so there also ways to get CMID data from the KMS host, sort, and identify how many computers at your site haven't been generalized.

  • Is this for 2003 only? I checked a 2008_amd64 WIM that was sysprep'd without /generalize and the CloneTag is there as well.
    – joebalt
    Feb 16 '11 at 3:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.