Registry Hacking Against Sysprep Errors

April 14, 2016 | Views: 8570

Begin Learning Cyber Security for FREE Now!

FREE REGISTRATIONAlready a Member Login Here
NOTE: This article is meant for system administrators only. DO NOT CHANGE YOUR REGISTRY if you administer your PRIVATE PC!

If you want to create images and execute Sysprep, sometimes you may see the following error message displayed when the computer is restarted:

The computer restarted unexpectedly or encountered an unexpected error. Windows installation can not proceed. To install windows click "OK" to restart the computer, and then restart the installation.

After restarting the computer, an error message appears every time you restart the system, which prevents Windows from starting properly. But you’ve already prepared the system for the image creation, so you don’t want to reinstall the system.

In this article, I’ll show you how to save your image without reinstalling the system.

Solving Sysprep Reboot Loop

To escape the continuous reboot loop without losing the preparated image, you have to adjust only one parameter in the registry:

  1. If the error message appears, don’t confirm with “OK” immediately. Press Shift + F10 to open the command line.
  2. In the newly opened command line, type in regedit. The Registry Editor opens.
  3. In the Registry Editor navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\ChildCompletion
  4. Change the value setup.exe from 0x00000001 (1) to 0x00000003 (3)
  5. After restarting the system, Windows starts again – in the Out of Box Experience mode. A new user must be set up. The user name of the new user must not exist yet.

Trapped in Audit Mode

If you’ve configured the system to start in audit mode after the generalization, you may see the following error message:

Windows could not complete the installation. To install Windows on this computer, restart the installation.

To escape the reboot loop, adjusting the value setup.exe only is not the solution. Saving the prepared image seems impossible at first. But even for this case, there’s a remedy:

  1. When the error message appears, press Shift + F10 to open the command line.
  2. In the newly opened command line, type in regedit. The Registry Editor opens.
  3. In the Registry Editor navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status
  4. Adjust the following values if they don’t match the following:
    • HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\AuditBoot
      • 0x00000000 (0)
    • HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\ChildCompletion\setup.exe
      • 0x00000003 (3)
    • HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\ChildCompletion\audit.exe
      • 0x00000000 (0)
    • HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus\CleanupState
      • 0x00000002 (2)
    • HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus\GeneralizationState
      • 0x00000007 (7)
    • HKEY_LOCAL_MACHINE\SYSTEM\SetupStatus\UnattendPasses\auditSystem
      • 0x00000000 (0)
  5. After a reboot, the audit mode is aborted and Windows starts regularly – in the Out of Box Experience mode.

-xyra – Miriam Wiesner


Share with Friends
Use Cybytes and
Tip the Author!
Share with Friends
Ready to share your knowledge and expertise?
  1. happy to be a member this website

  2. I so much appreciate your post. I would like to know if you can help me with my ubuntustudio 14.1. I think I mistakenly did something that made the system not to connect to internet anymore. I have tried all I could to enable the wlan0 and the eth0. Thanks in advance.

  3. good one

  4. Do you have any insight to why a sysprepped image would occasionally generate a temp profile for the built in administrator? Ive had it happen sometimes and redoing the image and sysprepping again fixes it most times. It just seems random.

    • No I didn’t find out why this is exactly happening. But what I found out is the following:

      When this happens, the sysprepped image comes up and fails creating the admin profile/doing the first steps for the already created admin profile…

      I also used the sysprepped image and had no problems after…maybe it could be related to the Metro Apps in Win8…I had to remove them via PowerShell before I was able to sysprep…

Page 1 of 212»
Comment on This

You must be logged in to post a comment.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Support Cybrary

Donate Here to Get This Month's Donor Badge


We recommend always using caution when following any link

Are you sure you want to continue?