unattend.xml C:\Windows\Panther\unattend.xml

unattend.xml in Panther: the cached copy of the answer file Windows Setup used, reread during the specialize and oobeSystem passes; may hold credentials.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

Windows Setup keeps a copy of the answer file it used here so the later passes (specialize, oobeSystem) can read it again after reboots. It is therefore the record of what actually configured the machine: computer name, domain, local account, product key, FirstLogon commands and silent-install settings.

What it contains

An XML document whose root element is unattend, with one settings block per pass (windowsPE, specialize, oobeSystem…) and the configured components (Microsoft-Windows-Shell-Setup, Microsoft-Windows-Deployment, and so on).
Often sensitive data: a local account password, domain join credentials, a product key.
The CopyProfile setting, if it was used, appears in the specialize pass; see the C:\Users\Default entry.

Risks and best practices

Before publishing a reference image, make sure no unattend.xml from the previous deployment is left behind: a file remaining in C:\Windows\Panther can be read and applied again at the next boot.
Passwords in it are at best Base64-encoded, not encrypted. Treat the file as a secret and mask the values before attaching it to a ticket.
For deployments, edit the source file with Windows System Image Manager (SIM) rather than this cache; the cache is there to understand what happened.

Useful commands

# Passes and components present in the file
[xml]$x = Get-Content "$env:windir\Panther\unattend.xml"
$x.unattend.settings | Select-Object pass

# Spot sensitive values before sharing the file
Select-String -Path "$env:windir\Panther\unattend.xml" -Pattern 'Password|ProductKey|Credentials'

# Last modification
(Get-Item "$env:windir\Panther\unattend.xml").LastWriteTime

Report a mistake