How to Identify an Installation Created with the Sysprep Tool

Article translations Article translations
Article ID: 216680 - View products that this article applies to.
This article was previously published under Q216680
Expand all | Collapse all


This article describes how to identify an installation that was created using the Windows 2000 version of the System Preparation (Sysprep) tool.


You can check the following items to determine if an installation was created using Sysprep:
  • Check for a CloneTag value in the registry. Sysprep places the CloneTag value in the HKEY_LOCAL_MACHINE\System\Setup key, noting the date and time the image was prepared for duplication.
  • Look in the HKEY_LOCAL_MACHINE\System\Setup registry key for a cmdline that reads "Setup -newsetup -mini." This places GUI-mode Setup in the Mini-wizard phase.
  • Check for an OemDuplicatorString value. This used by Original Equipment Manufacturers (OEMs) to place a tag on systems they create. This is added using an answer file (Sysprep.inf) for the Mini-Setup Wizard.
  • Check for the existence of Setupcl.exe. This is the file that changes the Security IDs (SIDs) on the system. Look in the %SystemRoot%\System32 folder for this file.
For additional information about identifying Microsoft Windows NT 4.0 installations created with Sysprep, please see the following article in the Microsoft Knowledge Base:
180962 How to Identify When the System Preparation Tool Is Used


Article ID: 216680 - Last Review: October 30, 2006 - Revision: 4.1
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Professional Edition
kbinfo kbsetup KB216680

Give Feedback


Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from