How to Sysprep Windows 11 for Image Deployment

To Sysprep Windows 11 for deployment, prepare a reference installation in Audit mode, open Command Prompt as an administrator, and run %WINDIR%\System32\Sysprep\Sysprep.exe /generalize /oobe /shutdown. Once it shuts down, boot into Windows PE to capture the image before starting that Windows installation again.

These steps apply to current Windows 11 Pro, Enterprise, and Education releases on a physical reference PC or a virtual machine, and they match Windows 10 as well. Sysprep prepares an installation for imaging; it does not create the image file. Microsoft does not support using Sysprep to reconfigure a Windows installation already deployed for everyday use, so never run it on your own daily PC. If you only want a personal backup, back up Windows 11 to an external drive instead.

What Sysprep does and why it matters

Every Windows installation gets a unique security identifier (SID) and other computer-specific settings. If you copy one installation to many PCs without preparing it, those PCs share that identity. Sysprep’s generalize option resets the SID, uninstalls the detected hardware devices (the drivers stay on the PC), clears restore points, and deletes event logs. The next time the image starts on any computer, Windows detects that hardware and runs setup as if it were new.

You need to generalize even when every target PC has identical hardware. Generalizing won’t make every app or device work on different hardware, though, so testing still matters.

Before running Sysprep

Work on a reference PC or VM you can rebuild. Take a backup or VM checkpoint first, because Sysprep can’t be undone. Microsoft also notes that if Sysprep hits an error, you can’t run it on the same Windows image again; you have to redeploy or restore the image first. A checkpoint turns that from a rebuild into a quick rollback.

Check Microsoft’s Sysprep scope and limitations before proceeding. The ones that catch people most often:

• Encrypted files: NTFS-encrypted (EFS) files and folders become unreadable and unrecoverable after Sysprep. Don’t leave needed encrypted data in the reference installation.
• Domains: Sysprep runs only on a workgroup PC. If the PC is joined to a domain, Sysprep removes it from the domain. Join target PCs to the domain after deployment instead.
• BitLocker: If BitLocker or device encryption is on for the Windows drive, Sysprep stops with an error. Run manage-bde -status C: in an elevated Command Prompt, and if the drive is encrypted, decrypt it on the reference machine first. The steps for turning off BitLocker in Windows 11 cover both the BitLocker and device encryption switches. Turn encryption on for the deployed PCs through your normal policy after setup.
• Run limit: You can run Sysprep up to 1,001 times on a single Windows image before you must rebuild it.

Prepare bootable capture media and a separate storage destination with enough space before shutting down. Windows PE (WinPE) is a small deployment environment supplied through the Windows ADK and its WinPE add-on. Confirm your media can boot the reference hardware. A consumer recovery USB and a prepared WinPE imaging environment serve different purposes.

1. Enter Audit mode on the reference installation

Install Windows 11 on the reference computer. At its initial Out-of-Box Experience (OOBE) setup screen, press Ctrl + Shift + F3. Windows restarts into Audit mode and signs you in to the built-in Administrator account, where you can customize the installation before delivery. Microsoft’s Audit-mode instructions also explain answer-file methods.

The System Preparation Tool window opens on its own. Close it, since this guide uses the command line. Windows keeps booting into Audit mode until you run Sysprep with /oobe, and the built-in Administrator account is removed during generalization.

Two Audit-mode habits save trouble. Set the power plan so a password-protected screen saver can’t start, because Microsoft warns that it can lock you out of the Audit session. And work only in the built-in Administrator account; any extra local account you create now goes into the image with it.

2. Finish and check your customizations

Install the required desktop applications, suitable drivers, and deployment updates. Finish pending restarts before sealing the image. Check that your intended software works, and remove reference-only files or credentials that should not be distributed. Keep notes on the Windows build, applications, drivers, and customizations so you can reproduce the image.

Avoid installing or updating apps through Microsoft Store in the reference session. A per-user app update can conflict with all-user provisioning and cause generalization to fail. Unplug the network or turn off automatic updates while you work in Audit mode, then add updates you’ve chosen yourself. Follow Microsoft’s generalization guidance for preparing apps.

3. Open an elevated Command Prompt

Open Start, search for Command Prompt, select Run as administrator, and select Yes in the User Account Control prompt. The window title starts with Administrator. For other ways to open an elevated window, read about running Command Prompt as an admin on Windows 11. %WINDIR% is the Command Prompt variable for the Windows folder, so the command works even if Windows isn’t on C:.

Use the Sysprep.exe that came with this Windows installation, not a copy from another image. Run only one instance at a time. Microsoft’s process overview lists these requirements and the log locations.

4. Generalize, select OOBE, and shut down

When the backup, customizations, and capture media are ready, enter this command in the elevated Command Prompt:

%WINDIR%\System32\Sysprep\Sysprep.exe /generalize /oobe /shutdown

The three options do separate jobs:

• /generalize removes machine-specific configuration so the installation can be reused on another computer.
• /oobe selects the initial user setup experience for a subsequent Windows boot.
• /shutdown turns the reference computer off after Sysprep finishes, allowing you to capture it offline.

A small Sysprep progress window appears while it works, which can take several minutes. Let Sysprep finish and shut the PC down. Don’t restart into Windows; the next boot must be into WinPE for the capture. The command-line reference explains these switches and others, such as /quiet for scripts and /quit to close Sysprep without shutting down.

5. Boot into Windows PE and capture the image

Start the reference computer from your prepared WinPE media. Select that media in the firmware boot menu if necessary. Avoid booting its internal Windows installation before capture: that starts specialization and setup again.

In WinPE, find the Windows partition and your separate image destination. Drive letters can differ from normal Windows, so check which drive holds the Windows folder and which is the destination instead of assuming C: and D:. Running diskpart, then list volume, then exit shows every volume with its letter, label, and size. Follow Microsoft’s WIM capture and deployment procedure with the correct letters and image name.

For example, if WinPE shows Windows on C: and your capture drive as D:, run Dism /Capture-Image /ImageFile:"D:\Images\Win11-ref.wim" /CaptureDir:C:\ /Name:"Windows 11 reference". Run dir C:\ and dir D:\ first to confirm which letter is which, and change the file and image names to suit your project. DISM shows a percentage bar and reports that the operation completed successfully.

A WIM holds one partition, not the whole disk layout, so your deployment plan must recreate the boot and recovery partitions. Microsoft’s procedure includes sample DiskPart and apply scripts for that. Save the image outside the Windows partition and keep your earlier backup.

6. Test a deployment before distributing it

Apply the image to a separate test device or VM using your deployment procedure. Confirm it reaches OOBE, completes setup, starts Windows, and has the required drivers and working applications. Check activation and licensing requirements separately; Sysprep does not grant licenses for additional computers. Volume license and retail keys activate automatically, so you don’t need the old SkipRearm setting for them.

For example, a reference image that works on one laptop may need a different network driver on another model. Test on the hardware you’ll actually deploy to; a clean Sysprep shutdown doesn’t tell you the image will work there.

Other ways to run Sysprep

The System Preparation Tool window

Microsoft has deprecated the Sysprep window since Windows 8.1, but it still opens in Audit mode. If you use it, set System Cleanup Action to Enter System Out-of-Box Experience (OOBE), check Generalize, set Shutdown Options to Shutdown, and select OK. That does the same job as the command in step 4. Build new workflows on the command line, since the window may be removed in a future release.

A virtual machine that stays on the same hypervisor

If you’re generalizing a VHD or VHDX that will run as a virtual disk on the same hypervisor and hardware profile, add /mode:vm: %WINDIR%\System32\Sysprep\Sysprep.exe /generalize /oobe /shutdown /mode:vm. This option works only when Sysprep runs inside a VM. After shutdown, copy the virtual disk and attach the copy to each new VM, which then starts at OOBE. For capturing a VM’s image for physical PCs, leave /mode:vm off and use the WinPE steps above. To build a VM in Hyper-V, follow the steps for running a virtual machine on Windows 11.

If Sysprep fails

Sysprep usually shows “A fatal error occurred while trying to sysprep the machine.” Keep the error message and review %WINDIR%\System32\Sysprep\Panther\setupact.log and setuperr.log. Identify the failing component and the latest relevant timestamp. Do not repeatedly rerun the command, clear logs, or apply unrelated registry edits while guessing at the cause.

• “Package … was installed for a user, but not provisioned for all users”: a Store app was installed or updated for one account. Use Microsoft’s Store-app Sysprep troubleshooting procedure. It lists the package with Get-AppxPackage -AllUsers, then removes the user’s copy with Remove-AppxPackage and its provisioning with Remove-AppxProvisionedPackage -Online. Remove only the package the log names, not every built-in app.

• “BitLocker is on for the OS volume” (0x80310039): decrypt the Windows drive, wait until manage-bde -status C: shows Fully Decrypted, and try again.
• The PC is on a domain: Sysprep removes it from the domain. Rebuild the reference as a workgroup PC.

If you aren’t sure what state the image is in, restore your reference backup and fix the logged cause before you try again.

Common questions

Can I automate setup with an answer file?

Yes. An unattended XML answer file can supply deployment settings through /unattend:. Cached answer files may also be applied during later setup passes. Check the configuration passes in Microsoft’s answer-file guidance, build the file with Windows System Image Manager from the Windows ADK, and test it before adding it to your image.

Can I keep the installed devices for identical hardware?

Yes. An answer file with the Microsoft-Windows-PnpSysprep setting PersistAllDeviceInstalls set to true keeps devices installed during generalization, which can speed up first boot on identical PCs. Leave it at the default of false when the hardware varies.

Should I add /mode:vm for every virtual machine?

No. That option is for a VHD deployed as a VHD within the matching VM or hypervisor hardware profile, and it runs only inside a VM. It is not a universal optimization for images intended for physical PCs or different virtual hardware.

What if I already finished OOBE and created a user account?

Start over with a clean installation and press Ctrl + Shift + F3 at OOBE. That account and its files would otherwise go into every deployed PC, and a new user with the same name can’t be created on them.

Does Sysprep erase my personal files?

No. Sysprep isn’t a wipe tool, but NTFS-encrypted (EFS) files become unreadable afterward. Back up first. To erase a PC for disposal, use Reset this PC instead.