Identify systems cloned with the Sysprep utility

by Wayne Maples [Published on 20 April 2004 / Last Updated on 20 April 2004]

Move user profiles with MOVEUSER, W2K Resource Kit utility

Systems cloned with the Sysprep utility can experience specific problems. You can check the following to determine if a Windows 2000 / XP installation was created using Sysprep:

  • Sysprep places the date and time the image was prepared for duplication in the key HKEY_LOCAL_MACHINE\System\Setup\CloneTag.
  • Look in the HKEY_LOCAL_MACHINE\System\Setup registry key for a cmdline that reads Setup -newsetup -mini. This places GUI-mode Setup in the Mini-wizard phase.
  • Check for an HKEY_LOCAL_MACHINE\System\SetupOemDuplicatorString value. This is added using an answer file (Sysprep.inf) for the Mini-Setup Wizard.
  • Check for the existence of Setupcl.exe. This is the file that changes the Security IDs (SIDs) on the system. Look in the %SystemRoot%\System32 folder for this file.
For NT
  • Sysprep places the date and time the image was prepared for duplication in the key HKEY_LOCAL_MACHINE\System\Setup\CloneTag.
  • Check for the existence of Setupcl.exe. This is the file that changes the Security IDs (SIDs) on the system. Look in the %SystemRoot%\System32 folder for this file.

Featured Links