Consider the following scenario:
- You're working on a Windows 10-based computer.
- You go into Sysprep Audit mode from the Out of Box Experience (OOBE) screen.
- You turn off the computer by using the Shut down command on the Start menu, or you use one of the following Shut down options:
- Log off
- You restart or wake the computer.
Your account has been disabled. Please see your system administrator.
This is expected behavior because the system is using hybrid shutdown (also known as "fast startup") during Audit mode. Hybrid shutdown were introduced in Windows 8. In Audit mode, the administrator account is enabled immediately before logoff and disabled immediately after logon. Therefore, the account is locked out when you turn off the computer and then turn it back on.
To work around this behavior, disable hybrid shutdown. To do this, follow these steps:
- Right-click the Start button, and then click Command Prompt (Admin).
- At the command prompt, type the following command, and then press Enter:
shutdown /s /t 00