Ghost Solution Suite

Hi

 

Using the latest version of ghost, occasionally after imaging, I have noticed that the Administrator account is disabled. Doesn't happen all the time in a lab of 35 PC's may be 6 or 7. We are deploying Windows 7 x64 enterprise. I sysprep the image  and upload the image manually and then deploy it via console. With only the clone option checked.

 

 

Here is my answer file

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="specialize">
        <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
            <Identification>
                <JoinWorkgroup>LABS</JoinWorkgroup>
            </Identification>
        </component>
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
            <ComputerName>*</ComputerName>
            <RegisteredOrganization>DC</RegisteredOrganization>
            <RegisteredOwner>Dawson DC</RegisteredOwner>
            <CopyProfile>true</CopyProfile>
        </component>
        <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
            <RunSynchronous>
                <RunSynchronousCommand wcm:action="add">
                    <Description>UIU-COMMAND-ID={4dec1d91-5b7c-4f41-91e1-ee8d57db943e}</Description>
                    <Order>1</Order>
                    <Path>reg add &quot;HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\NewNetworks&quot; /v NetworkList /t REG_MULTI_SZ /d &quot;&quot; /f</Path>
                </RunSynchronousCommand>
                <RunSynchronousCommand wcm:action="add">
                    <Path>net user administrator /active:yes</Path>
                    <Order>2</Order>
                </RunSynchronousCommand>
            </RunSynchronous>
        </component>
    </settings>
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
            <OOBE>
                <HideEULAPage>true</HideEULAPage>
                <SkipMachineOOBE>true</SkipMachineOOBE>
                <SkipUserOOBE>true</SkipUserOOBE>
                <NetworkLocation>Work</NetworkLocation>
                <ProtectYourPC>3</ProtectYourPC>
            </OOBE>
            <TimeZone>Eastern Standard Time</TimeZone>
            <AutoLogon>
                <Password>
                    <Value>aABjAG0AaABzAD8AUABhAHMAcwB3AG8AcgBkAA==</Value>
                    <PlainText>false</PlainText>
                </Password>
                <Enabled>true</Enabled>
                <Username>Administrator</Username>
            </AutoLogon>
        </component>
        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <SystemLocale>en-US</SystemLocale>
            <InputLocale>0409:00000409;1009:00001009;0c0c:00000c0c</InputLocale>
            <UILanguage>en-US</UILanguage>
            <UserLocale>en-US</UserLocale>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="wim:c:/winpro764bit/install.wim#Windows 7 ENTERPRISE" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>
 

I'm fairly certain this isn't really related to Ghost as such, but rather some general twitchiness in the unattend.xml processing because there are several alternate paths which cause the built-in Administrator account to be disabled or not, and it's probably worth trying the full set of recommended settings even if in theory you can get away without some of them some of the time for some Sysprep versions.

I'd suggest trying to explicitly set <UserAccounts><AdministratorPassword> explicitly since although the AutoLogon setting is supposed to be one of the things that prevents the built-in Administrator account from being disabled, depending on the exact source edition of Windows being imaged. The above MS documentation states explicitly that on some editions (e.g. Windows Server 2008) then the built-in administrator password is cleared as part of generalize (i.e, before imaging) and so it'll be necessary to explicitly force the built-in password to have the desired value first, in order for the AutoLogon setting to work.

I cleaned up my answer file tonight. Out of 30 pc's I had 3 crash on the specialize pass of the answer file. I checked the setuperr.log and it had no errors to speak of. Are there anymore sysprep logs I should focus on. Also 27 autologged just fine as Administrator. I have been fighting this problem for about 3 weeks. So any suggestions would be great.

 

What document?

Please follow below article to prevent Sysprep from disabling Local Admin account

www.symantec.com/docs/howto42361

 

Let me know if it helps..........

Thanks.

Upon investigating deeper in to my Sysprep crashing in the specialize phase it seems that indeed occasionally it is bombing out on the copy profile. Here is part of an error log from a sysprep crash last night.

The logs from C:\Windows\Panther\UnattendGC indicate that sysprep is crashing on the copy profile.

I have looked for any extra profiles in HKLM\SOFTWARE\Microsoft\Windows NT\ProfileList there are none.

also no extra users in computer management-->Local Users and Groups

There is only Administrator and Guest.

[windeploy.exe] WinDeploy.exe launched with command-line
2011-09-09 21:14:05, Info                         [windeploy.exe] Setup has not completed, adding pending reboot.
2011-09-09 21:14:05, Info                         [windeploy.exe] Found generalization state [0x4], setup.exe completion flag [False] --> launching setup.exe.
2011-09-09 21:14:05, Info                         [windeploy.exe] Launching [C:\Windows\system32\oobe\setup.exe]...
2011-09-09 21:30:25, Info                         [Shell Unattend] Running 'specialize' pass
2011-09-09 21:30:25, Info                         [Shell Unattend] ComputerName: generating computer name from user name
2011-09-09 21:30:25, Info                         [Shell Unattend] ComputerName: generated name 'DCDC-G5GMRBVM30'
2011-09-09 21:30:26, Info                         [Shell Unattend] ComputerName set to DCDC-G5GMRBVM30 
2011-09-09 21:32:21, Error                        [Shell Unattend] CopyProfileDirectory from C:\Users\Administrator failed (0x8007012b) [gle=0x0000012b]
2011-09-09 21:32:21, Error                        [Shell Unattend] _CopyToDefaultProfile failed (0x8007012b) [gle=0x0000012b]
2011-09-09 21:32:21, Error                        [Shell Unattend] CopyProfile failed (0x8007012b) [gle=0x0000012b]
2011-09-09 21:32:21, Info                         [Shell Unattend] Exiting 'specialize' pass with status 0x8007012b
2011-09-09 21:42:00, Info                         [windeploy.exe] Process exited with exit code [0x1f]
2011-09-09 21:42:00, Error                        [windeploy.exe] Setup.exe failed, returning exit code [0x1f]
2011-09-09 21:42:00, Error                        [windeploy.exe] Failure occured during online installation.  Online installation cannot complete at this time.; hr = 0x80004005
2011-09-09 21:42:00, Info                         [windeploy.exe] Flushing registry to disk...
2011-09-09 21:42:00, Info                         [windeploy.exe] Flush took 265 ms.
2011-09-09 21:42:00, Info                         [windeploy.exe] WinDeploy.exe exiting with code [0x80004005]

You need to set autologon to a value of at least 1

 Edit the unattend.xml file using WAIK

Follow the below link which has screen shot and also will help you to set autologon to value 1

https://www-secure.symantec.com/connect/articles/how-prevent-microsoft-sysprep-disabling-local-administrator-account-windows-7

The final step is to clear the ProfileList in Windows registry (scroll to bottom of this article). Browse to HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList and make sure that profiles exists only for SYSTEM, LocalService, NetworkService and Administrator