Sysprep Was Not Able to Validate Your Windows Installation

14.6K

The process of generalizing a Windows image using the SysPrep tool may fail during validation of the Windows installation.

This guide explains how to troubleshoot SysPrep image validation errors on all supported Windows versions (including Windows 25H2 and Windows Server 2025/2022).

Hint. The SysPrep (System Preparation Tool) is used to prepare a reference Windows image and depersonalize it by resetting system-specific identifiers (such as SID), which are regenerated on next boot. This prepared Windows image can then be captured for deployment to multiple corporate computers (see our guide on how to use Sysprep in Windows).

Why SysPrep Validation Fails

Keep in mind that before SysPrep generalizes a Windows image, it validates that the OS is in a supported and deployable state. During this validation phase, Windows checks:

• BitLocker protection status;
• Microsoft Store (Appx/MSIX) provisioning consistency;
• Pending servicing operations;
• Windows Update state;
• Reserved Storage usage;
• Audit mode state;
• Unsupported upgrade cases.

SysPrep validation is especially strict on modern Windows 11 and Windows Server 2025 builds. This is because Microsoft heavily relies on Appx/MSIX provisioning, security hardening, and component servicing integrity.

In most cases, SysPrep failures occur because the reference image contains:

• partially updated Microsoft Store apps;
• pending cumulative updates;
• inconsistent Appx provisioning;
• enabled BitLocker device encryption;
• upgraded Windows installations instead of clean deployments.

So, because of this, you should consider reviewing the setupact.log file as the most important troubleshooting step.

Note. In older Windows versions, Sysprep could fail after multiple image generalization attempts because of activation rearm count limitations. This restriction is largely irrelevant on modern Windows 10/11 and Windows Server 2022/2025 builds, but you can still encounter it when working with legacy OSs/older reference images.

Understanding Audit Mode

Audit Mode is a special Windows deployment mode that allows you to customize the OS before creating a reference image. In this mode, Windows bypasses the Out-of-Box Experience (OOBE) and automatically signs in using the built-in Administrator account.

To enter Audit Mode during Windows Setup, press Ctrl + Shift + F3. The computer will reboot directly into Audit Mode.

Audit Mode is commonly used to install apps, config settings, update drivers, and prepare a reference image before running Sysprep. However, note that Microsoft Store apps, Appx/MSIX provisioning changes, Windows Updates, and Reserved Storage operations performed during Audit Mode are also among the most common causes of Sysprep validation failures.

Quick Pre-Sysprep Checklist (Recommended)

Before running Sysprep, you need to ensure that:

• BitLocker is disabled on the system drive
• Windows installation is clean (not upgraded)
• There are no pending Windows Updates/reboot is required
• Windows component store is healthy (verify using DISM /ScanHealth and repair with DISM /RestoreHealth if needed)
• There are no per-user Microsoft Store apps are installed
• Reserved Storage is not blocking servicing operations
• There are only required user profiles exist on the system
• Consumer Microsoft Store apps are not automatically updating in the background;
• Copilot/inbox Windows components are fully updated;
• Device encryption is disabled on supported hardware;
• Internet connectivity is restricted during image preparation (this is recommended for VMs).

You can quickly verify Windows image/component store integrity before running SysPrep using the following command:

DISM /Online /Cleanup-Image /ScanHealth

DISM /Online /Cleanup-Image /RestoreHealth

Keep in mind that running Sysprep without these checks may result in validation errors.

Note. In case DISM detects corruption in the Windows component store, you should run DISM /RestoreHealth before attempting to run Sysprep. Keep in mind that component store corruption can cause validation failures and servicing-related errors.

Useful PowerShell Commands for SysPrep Troubleshooting

Note. All commands and troubleshooting steps in this guide should be performed from an elevated Command Prompt/PowerShell session running as Administrator.

Before reviewing the setupact.log file manually, we recommend you to quickly verify the current Windows servicing and deployment state using PowerShell. Below you will find the commands that can help identify the most common issues that prevent SysPrep from validating the Windows image.

In order to check BitLocker status, run the command (it verifies whether BitLocker/device encryption is enabled on the system drive):

Get-BitLockerVolume

To check pending servicing/reboot state, use the following (note that in case this registry key exists, Windows may still have pending servicing operations/updates requiring reboot):

Get-ItemProperty `
-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'

To list installed Microsoft Store (Appx) packages, run the command (it lists installed Appx/MSIX packages that may interfere with SysPrep validation):

Get-AppxPackage -AllUsers

In order to check Reserved Storage state, run the following (note that Reserved Storage servicing operations may sometimes block SysPrep validation):

DISM.exe /Online /Get-ReservedStorageState

To check Windows edition and build version, run the command (this helps verify the current Windows version/build before troubleshooting SysPrep compatibility problems):

winver

Troubleshoot SysPrep Validation Errors using the Setupact.log

If SysPrep fails to validate the current Windows installation, the generalizer will fail with an error:

System Preparation Tool 3.14

Sysprep was not able to validate your Windows installation. Review the log file at %windir%\system32\Sysprep\panther\setupact.log for details. After resolving the issue, use Sysprep to validate your installation again.

To investigate the error root cause, examine the Sysprep log file setupact.log located at C:\Windows\System32\Sysprep\Panther. To open this log, run the command:

notepad %windir%\system32\Sysprep\panther\setupact.log

Tip. Although setupact.log is usually the primary troubleshooting source, you should also review other Panther logs if the root cause is not obvious:

C:\Windows\System32\Sysprep\Panther\setupact.log
C:\Windows\System32\Sysprep\Panther\setuperr.log
C:\Windows\Panther\

The setupact.log file contains detailed Sysprep processing info, while setuperr.log typically includes only errors. Additional Windows setup and servicing logs may also be available in the C:\Windows\Panther folder.

How to Quickly Identify the Root Cause in setupact.log

In most cases, the root cause is located near the bottom of the setupact.log file. You should search for the following keywords:

• Error SYSPRP
• Package was installed for a user
• BitLocker is on for the OS volume
• pending reboot
• reserved storage
• failed to remove apps

Keep in mind that these entries usually identify the exact component blocking SysPrep validation.

Quickly Search for Errors with PowerShell

Instead of manually scrolling through the setupact.log file, you can use PowerShell to quickly locate Sysprep-related errors:

Select-String `
-Path "$env:windir\System32\Sysprep\Panther\setupact.log" `
-Pattern "Error","SYSPRP"

Or you can search specifically for Sysprep validation entries:

Get-Content `
"$env:windir\System32\Sysprep\Panther\setupact.log" |
Select-String "SYSPRP"

This allows you to quickly identify the most recent validation failures without manually reviewing the entire log file.

Most common Sysprep error codes and fixes

Scroll through the setupact.log file to find the most recent errors. The following table lists the most common Sysprep error codes, their sources, and quick fixes:

Error Code	Source	Quick Fix Summary
0x80310039	BitLocker is enabled on the system drive.	Disable BitLocker on drive C:
0x80073cf2	Some Microsoft Store apps are installed for a single user only, not for everyone.	Remove this problematic Microsoft Store application for all users and deprovision it from the Windows image.
0x0f0036	The current Windows image has been upgraded from an earlier version (for example, from Windows 10 to Windows 11)	Mark the Windows installation as clean for SysPrep via registry
0x800F0975	Pending Windows Update installation, reserved storage, or enabled audit mode.	Install all Windows updates, reboot the computer, and/or disable reserved storage.

Disable BitLocker Before Running SysPrep: Error 0x80310039

Starting with Windows 11 24H2, BitLocker device encryption automatically activates supported hardware during initial setup. Sysprep cannot continue if BitLocker protection is enabled for the system drive (C:). In this case, your setupact.log should contain the following error:

Error      SYSPRP BitLocker-Sysprep: BitLocker is on for the OS volume. Turn BitLocker off to run Sysprep. (0x80310039)
Error      [0x0f0082] SYSPRP ActionPlatform::LaunchModule: Failure occurred while executing ‘ValidateBitLockerState’ from C:\Windows\System32\BdeSysprep.dll

Check if BitLocker is enabled for the system drive. Open the command prompt as administrator and run the command:

manage-bde -status C:

It should return the following info:

Disk volumes that can be protected with BitLocker Drive Encryption:
Volume C: [OSDisk]
Conversion Status:    Encryption in Progress

To turn off the encryption protection for the Windows system volume, run:

manage-bde -off C:

After confirming that the OS volume is fully decrypted, run the Sysprep again.

Note. Decrypting the system drive may take significant time and may be restricted by organizational security policies.

Remove Conflicting Microsoft Store Apps: Error 0x80073cf2

Sysprep will fail with error code 0x80073cf2 if an app is installed for a specific user without system-wide provisioning, or if APPX/MSIX packages were deprovisioned from the Windows image, but not removed, for a particular user.

First, prevent Microsoft Store apps from updating in the background. Enable the Turn off Automatic Download and Install of updates policy (Computer Configuration > Administrative Templates > Windows Components > Store) via the local Group Policy Editor (gpedit.msc), or disconnect the sysprepped machine from the Internet.

Hint. If you are using Windows 11 25H2 in a virtual machine (VM), it is recommended to disable the network adapter during Sysprep.

Open the setupact.log file and copy the name of the Microsoft Store app that prevents Sysprep from validating the image.

Error                 SYSPRP Package NotepadPlusPlus_1.0.0.0_neutral__7njy0v32s6xk6 was installed for a user, but not provisioned for all users. This package will not function properly in the sysprep image.
Error                 SYSPRP Failed to remove apps for the current user: 0x80073cf2.

Exit code of RemoveAllApps thread was 0x3cf2.

Your task is to remove this UWP/MSIX app from all user profiles and the provisioned app list (if present). Paste your app name into the following PowerShell commands and run them in the PowerShell console as an administrator:

Get-AppxPackage -AllUsers | where-object {$_.PackageFullName -eq 'NotepadPlusPlus_1.0.0.0_neutral__7njy0v32s6xk6'}| Remove-AppxPackage -AllUsers -verbose

Get-AppxProvisionedPackage -online | where-object {$_.PackageName -like '*NotepadPlusPlus*'}| Remove-AppxProvisionedPackage -online

Rerun the Sysprep and remove all the Microsoft Store apps mentioned in the setupact.log until Sysprep completes successfully.

Hint. If some apps were removed from some user profiles, but still remain provisioned, sysprep can fail. Use the following PowerShell one-liner to attempt to re-register built-in Microsoft Store apps:

Get-AppxPackage -AllUsers| Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

You can also delete all the local user profiles, leaving only the local Administrator profile in place. Use the netplwiz snap-in to delete additional user accounts.

Reboot the computer and try running Sysprep again.

Note. You need to avoid mass-removing all Appx packages. You should delete only the specific applications listed in the setupact.log file.

SysPrep Cannot Run on Upgraded Windows: Error 0x0f0036

Microsoft’s recommendation is to use SysPrep on clean Windows installations. If the operating system on a machine has been upgraded from an earlier version of Windows (Windows 10, Windows 8.1, or Windows 7 SP1), you may see the following error in the setupact.log file when you try to run Sysprep:

Error [0x0f0036] SYSPRP spopk.dll:: Sysprep will not run on an upgraded OS. You can only run Sysprep on a custom (clean) install version of Windows.

Microsoft Supported Recommendation

Note that Microsoft officially recommends running SysPrep only on clean Windows installations. Keep in mind that using SysPrep on upgraded Windows installations is unsupported because component servicing metadata from previous OS versions may remain in the image.

For enterprise deployment cases, Microsoft recommendations are as following:

• installing Windows from clean media;
• fully patching the image;
• configuring required applications/settings;
• then running SysPrep before image capture.

Edit the registry to make Sysprep assume that this copy of Windows is being installed from scratch:

Important. Note that this workaround is not officially supported by Microsoft and should only be used in test/lab environments. For production scenarios, we strongly recommend you to use a clean Windows installation for Sysprep.

1. Open the Registry Editor (regedit.exe) and go to the registry key HKEY_LOCAL_MACHINE\SYSTEM\Setup
2. Delete the registry parameter named Upgrade
3. Then navigate to the key HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus and change the value of CleanupState to 7
   

   

SysPrep Failed Due to Pending Windows Updates: Error 0x800F0975

Another SysPrep error occurs when Windows updates are installed in the background:

Error  SYSPRP Sysprep_Clean_Validate_Opk: Audit mode can’t be turned on if there is an active scenario.; hr = 0x800F0975
Error SYSPRP Sysprep_Clean_Validate_Opk:

There are one or more Windows updates that require a reboot. To run Sysprep, reboot the computer and restart the application.[gle=0x000036b7]

In this case, simply restart the computer, scan for updates again, and reboot after installing all the necessary updates. Then, run Sysprep again.

Or pause updates in Settings > Windows Updates.

What to Do If Pending Servicing Operations Remain Stuck?

In some cases, Windows servicing operations may remain in a pending state even after multiple reboots. This can prevent SysPrep from validating the image because the Component-Based Servicing (CBS) engine still detects unfinished update transactions.

You can check whether a pending reboot state exists with the following command:

Get-ItemProperty `
-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'

In case servicing remains stuck and the system cannot complete pending updates, you may attempt to revert pending servicing operations:

DISM /Online /Cleanup-Image /RevertPendingActions

Warning. You should use this option carefully because it rolls back pending Windows update and servicing transactions. It should only be used when normal reboot/update procedures fail to clear the pending state.

After running the command, reboot the machine and check that Windows Update and servicing operations have completed successfully before running SysPrep again.

Another possible cause of the 0x800F0975 sysprep error is the enabled audit mode for the Reserved Storage. The Windows image in this case locked from the changes.

Error SYSPRP Sysprep_Clean_Validate_Opk: Audit mode cannot be turned on if reserved storage is in use. An update or servicing operation may be using reserved storage.; hr = 0x800F0975

To fix this issue:

1. Open the Registry Editor (regedit.exe) and go to HKLM\Software\Microsoft\Windows\CurrentVersion\ReserveManager;
2. Change the value of the ShippedWithReserves parameter from 1 to 0
3. Then change ActiveScenario to 0
4. And disable Reserved Storage in Windows using the command:
   

   DISM.exe /Online /Set-ReservedStorageState /State:Disabled

Keep in mind that SysPrep depends on the Windows servicing stack (CBS). In case Windows still has pending servicing transactions, incomplete cumulative updates, or pending reboot operations, image generalization is blocked to prevent deployment corruption.

This behavior is especially common on modern Windows 11 builds because cumulative updates, Microsoft Store updates, and Reserved Storage operations may continue running in the background even after the desktop appears ready.

Wrapping up

So, we covered the main root causes that can prevent Sysprep from validating the Windows installation, including enabled BitLocker, improper Microsoft Store apps provisioning, and pending Windows Updates. These issues can all be troubleshot and resolved based on the errors in the setupact.log file.