Deploying Windows 7 in Audit Mode using MDT 2012

It’s interesting that MDT 2010/12 doesn’t have a native way of deploying Windows 7 in Audit Mode, especially when Audit Mode is often the starting place to building Windows 7 reference or master images.

With no way to do this natively using MDT one would have to do this manually, either by running Sysprep post-install or booting into Audit Mode during the Windows Welcome stage when installing the OS (by hitting Ctrl+Shift+F3).

I have a healthy curiosity when it comes to these things which is exactly what led me to experiment on how Windows 7 could be deployed straight into Audit Mode using MDT 2012 in my Lab. I thought the challenge at hand was quite interesting and I think I may have found a workable solution.

My first few attempts were to edit the Task Sequence’s Unattend.xml answer file to run a Sysprep command. I tried adding synchronous commands in the Specialize pass to run Sysprep with the /audit switch to boot into Audit Mode but that didn’t work out very well.

I then turned my attention to the Task Sequence steps. As with my previous attempts, I knew the only way to get this to work would be to run Sysprep, but the trick was to work out where in the Task Sequence to add the Run Command Line step.

Anyway, here’s how I done this on MDT 2012:

  • Created a new Standard Client Task Sequence to deploy the Windows 7 DVD image (I already had the image imported in my deployment share)
  • Disable all the steps under State Restore in the Task Sequence properties
  • Add a Run Command Line step as a last step under PostInstall
  • Add the following command in the Command line field

sysprep.exe /generalize /audit /reboot in the

  • Add the following directory path in the Start in field


The Task Sequence steps  should look like this:


If you have your Customerttings.ini file configured to hide the Deployment Wizard panes and provide all the answers to the wizard then executing this Task Sequence to deploy Windows 7 and booting into Audit Mode should be fully automated.

There is, however, one minor hiccup to this ‘solution’. Right at the end when Windows 7 is booted into Audit Mode a message pops up saying there is a deployment in progress but is not in an expected state.


It asks if you would like to ignore this in-progress deployment. It is important that you click on Yes on this pop up message.

Although I haven’t found a way of suppressing this message yet, I have used the Task Sequence above to build reference images for testing purposes and it’s worked fine without any problems.

I understand this needs to be tested more thoroughly in a working environment and hope someone, somewhere will find this a useful starting point to take this further with some proper testing.


3 thoughts on “Deploying Windows 7 in Audit Mode using MDT 2012

  1. Personally I created an empty VM, booted on Win7, entered in Audit Mode, customized my Windows (updates, some programs which cannot be deployed with cmd-line or task sequence, etc.), then syspreped my image and captured it as .wim

  2. One way to avoid the “Dirty Environment” warning is to use sysprep.exe /generalize /audit /quit BEFORE the Restart Computer task in Postinstall (notice the /quit instead of /reboot). Basically you need to swap “Restart Computer” and “Boot into Audit Mode” (the order is: Audit mode -> Restart Computer).
    You get a “Dirty Environment” warning when a reboot wasn’t initiated by MDT itself. If you install a program or driver during deployment, then make sure, that it won’t automatically reboot the computer (use command line options or some MSI wrapper). If you need to restart the computer during deployment, then always use the “Restart Computer” task.

    • Thanks for that. This is quite an old post which I wrote when I was just starting with MDT. I automate my image build process using Powershell – take a look at the “Image Factory” script Mikael Nystrom

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s