Skip to contentGo to the directory tree
FolderRisk: Caution

Sysprep C:\Windows\System32\Sysprep

System Preparation tool (Sysprep) folder: sysprep.exe, Panther logs and tracking files, used to generalize a Windows image.

Updated on By AltF4 Formation

What it’s for

Sysprep holds the System Preparation tool. It prepares a Windows installation for cloning or image capture: generalization (/generalize) removes machine-specific information, such as the security identifier and names, so the image can be deployed to other computers. The machine then goes through first run (OOBE) or audit mode.

What it contains

  • sysprep.exe, the tool, with its graphical interface and command line.
  • The Panther subfolder, which holds Sysprep’s logs (setupact.log, setuperr.log).

Risks and best practices

  • Never run sysprep /generalize on a production machine: it resets machine-specific configuration, irreversibly for that installation.
  • The number of times a Windows image can be generalized is limited. Check the limit for your version before recapturing.
  • Some Microsoft Store apps block generalization. The name of the offending package appears in Panther\setuperr.log.
  • After a failure, read Panther\setuperr.log first, then setupact.log for context.

Useful commands

Fenêtre de terminal
# List Sysprep contents (tool, logs, tracking files)
Get-ChildItem -Force "C:\Windows\System32\Sysprep" -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime
# Generalization errors (SYSPRP lines)
Select-String -Path "$env:windir\System32\Sysprep\Panther\setuperr.log" -Pattern 'SYSPRP' | Select-Object -Last 20
# Read the end of Sysprep's action log
Get-Content "$env:windir\System32\Sysprep\Panther\setupact.log" -Tail 40
# Generalize the image then shut it down (run as administrator; irreversible for this installation, only on an image meant to be captured)
& "$env:windir\System32\Sysprep\sysprep.exe" /generalize /oobe /shutdown

Folder contents

Report a mistake