How to Identify an Installation Created with the Sysprep Tool

View products that this article applies to.

This article was previously published under Q216680

Expand all | Collapse all

SUMMARY

This article describes how to identify an installation that was created using the Windows 2000 version of the System Preparation (Sysprep) tool.

MORE INFORMATION

You can check the following items to determine if an installation was created using Sysprep:

Check for a CloneTag value in the registry. Sysprep places the CloneTag value in the HKEY_LOCAL_MACHINE\System\Setup key, noting the date and time the image was prepared for duplication.
Look in the HKEY_LOCAL_MACHINE\System\Setup registry key for a cmdline that reads "Setup -newsetup -mini." This places GUI-mode Setup in the Mini-wizard phase.
Check for an OemDuplicatorString value. This used by Original Equipment Manufacturers (OEMs) to place a tag on systems they create. This is added using an answer file (Sysprep.inf) for the Mini-Setup Wizard.
Check for the existence of Setupcl.exe. This is the file that changes the Security IDs (SIDs) on the system. Look in the %SystemRoot%\System32 folder for this file.

For additional information about identifying Microsoft Windows NT 4.0 installations created with Sysprep, please see the following article in the Microsoft Knowledge Base:

180962 (http://support.microsoft.com/kb/180962/EN-US/ ) How to Identify When the System Preparation Tool Is Used