Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows 2000
    - Admin Tips
      - Applications
        Identify systems cloned with the Sysprep utility

Section(s): Applications
Published on Apr 20, 2004.
Last Modified on Apr 20, 2004.
Last Modified by Wayne Maples.
Rated 4.2 out of 5 based on 5 votes.

Move user profiles with MOVEUSER, W2K Resource Kit utility

Systems cloned with the Sysprep utility can experience specific problems. You can check the following to determine if a Windows 2000 / XP installation was created using Sysprep:

Sysprep places the date and time the image was prepared for duplication in the key HKEY_LOCAL_MACHINE\System\Setup\CloneTag.
Look in the HKEY_LOCAL_MACHINE\System\Setup registry key for a cmdline that reads Setup -newsetup -mini. This places GUI-mode Setup in the Mini-wizard phase.
Check for an HKEY_LOCAL_MACHINE\System\SetupOemDuplicatorString value. This is added using an answer file (Sysprep.inf) for the Mini-Setup Wizard.
Check for the existence of Setupcl.exe. This is the file that changes the Security IDs (SIDs) on the system. Look in the %SystemRoot%\System32 folder for this file.

For NT

Sysprep places the date and time the image was prepared for duplication in the key HKEY_LOCAL_MACHINE\System\Setup\CloneTag.
Check for the existence of Setupcl.exe. This is the file that changes the Security IDs (SIDs) on the system. Look in the %SystemRoot%\System32 folder for this file.