How to Sysprep Windows 11: Step-by-Step Reference Image Guide

14.3K

SysPrep (System Preparation Tool) is used to generalize the Windows 10/11 installation and prepare a customized reference Windows image for deployment to corporate computers. This allows you to quickly deploy a reference Windows image that includes all the necessary apps, drivers, settings, and security updates that your users need to get started.

What is Sysprep and how does it work?

The idea is that an administrator can prepare a reference Windows computer with all the necessary drivers, programs, and required system settings. This configured Windows image can then be captured and deployed to client computers. SysPrep is a built-in tool used to generalize the Windows image and remove computer-specific information (SID, GUID, etc).

This guide explains how to create a reference Windows computer, generalize it using SysPrep and capture the WIM image that will be installed on other computers.

Steps covered in this sysprep guide

• Perform a clean installation of Windows 10/11 from the original ISO image on the reference computer.
• Use the SysPrep tool to put the Windows into the Audit Mode.
• Configure your Windows environment: install drivers, updates, language packs, apps, configure user personalization options, configure the Desktop, create shortcuts, set files and folder permissions, etc.
• Generalize the image using the SysPrep.
• Boot into Windows PE and capture an image using the DISM command.
• Copy the resulting WIM image to the installation media or use the deployment tools to install it on the users’ computers (such as MDT, WDS, or DISM).

How to create a Windows 10 or 11 reference image

For a new Windows 11 deployment, you should use Windows 11 25H2 as the general reference image baseline unless your target hardware specifically requires Windows 11 26H1.

Download the corresponding Windows installation media and perform a clean Windows installation on a reference computer or VM.

Do not connect the computer to the Internet at this stage (unplug the Internet connection (Ethernet) or disable your Wi-Fi adapter on your computer).

Note that you should not join the reference machine to an AD domain. The reference device should remain in a workgroup before running Sysprep and capturing the image.

Then disable automatic updating of Microsoft Store apps (which can break the SysPrep process in Windows 10 and 11):

1. Open the Local Group Policy Editor (gpedit.msc) and go to Computer Configuration > Administrative Templates > Windows Components > Store;
2. Enable the policy Turn off Automatic Download and Install of updates;

   

Note that on supported Windows 11 releases, you no longer need ImageState manipulation. Modifying ImageState and State.ini is considered a workaround and should only be considered when troubleshooting specific Sysprep failures related to Microsoft Store app processing. In case Sysprep fails due to Microsoft Store apps, you should fix the AppX provisioning state instead of modifying Setup State registry keys.

For new Windows 11 deployments, use Windows 11 25H2 as the general reference image baseline unless your target hardware specifically requires Windows 11 26H1. Windows 11 26H1 is designed primarily for new devices and is not intended as a feature update for existing Windows 11 devices. Windows 11 24H2 remains supported, but it is approaching the end of support for Home and Pro editions in October 2026, so 25H2 is generally a better baseline for new deployments.

For new deployments in 2026, you should use Windows 11 as the primary reference image platform. Windows 10 22H2 is out of support as of October 14, 2025 and you should only use it for existing environments that have an appropriate Extended Security Updates (ESU) entitlement or another supported migration strategy.

Our guide focuses on Windows 11. Windows 10-specific procedures are included where they remain relevant for organizations maintaining existing Windows 10 deployments.

Customizing Reference Windows Image in Audit Mode with SysPrep

The next step is to customize your reference Windows image in the Audit Mode. You can boot into Audit Mode from the OOBE screen (run CTRL+Shift+F3) or open an elevated PowerShell console and run sysprep command:

C:\windows\system32\sysprep\sysprep.exe

Select the following options:

• System Cleanup Action: Enter System Audit mode;
• Shutdown Options: Reboot;
• Press the OK button.

Sysprep from CMD with basic options

Sysprep on Windows can be run from the command line with basic options:

sysprep.exe [/oobe | /audit] [/generalize] [/reboot | /shutdown | /quit] [/quiet] [/unattend:answer_file_name]

• /audit — boots Windows into audit mode. In this mode, you can install additional apps and drivers;
• /generalize — removes PC-specific information from the Windows installation, including the computer SID, and prepares the image for deployment to other machines;
• /oobe — restarts the Windows in the Welcome screen mode. The Windows Welcome screen allows users to configure Windows operating system, create new accounts, rename the computer, and perform other tasks;
• /unattend:answer_file_name — allows you to apply the settings from the answer file to Windows during an unattended installation.

Refer to the article for other possible sysprep errors and fixes: Sysprep was not able to validate your Windows installation.

Keep in mind that Sysprep includes a Windows licensing rearm mechanism. On Windows 8.1 and later, including supported Windows 10 and Windows 11 releases, Sysprep can be run up to 1001 times on a single Windows image. Older versions (such as Windows 7) had a lower limit because of the Windows activation rearm mechanism.

For production reference images, it is still best practice to make significant changes on a clean baseline and run Sysprep /generalize when the image is ready for capture. If you need to repeatedly generalize an image during development, the SkipRearm setting can be used in specific deployment cases, but it should be removed from the final production answer file.

If you use an unattended answer file, the Microsoft-Windows-Security-SPP component includes the SkipRearm setting. This setting can be useful during image development when you need to generalize the same installation multiple times, but it should be used carefully and according to Microsoft’s deployment guidance because it affects Windows licensing state.

Note. In some cases, SysPrep returns the error: unable to validate your Windows installation. The cause of the error is listed in the %WINDIR%\System32\Sysprep\Panther\setupact file.

Check log files

For other SysPrep errors, you can check the log files. Depending on the stage, Sysprep may write information to one of the directories:

• Generalize — %WINDIR%\System32\Sysprep\Panther.
• Specialize — %WINDIR%\Panther.
• Windows Unattended installation — %WINDIR%\Panther\UnattendGC.

The computer will automatically restart and boot into Audit Mode. Windows automatically logs on using the built-in administrator account (even if it was previously disabled). Windows will always boot into the Audit Mode until you explicitly switch your computer to Out-of-Box Experience (OOBE).

Security note. Audit Mode uses the built-in Administrator account to config the reference image. Treat this account as a temporary admin account during image creation. Do not store production credentials, personal data, or other secrets in the reference image. Before capturing the image, you need to check if the built-in Administrator account is not enabled with a reusable production password. If the account is not required after deployment, you should disable it in the reference image/configure its state through your deployment process.

The only visible sign that you’ve entered audit mode is the Sysprep dialogue box in the center of the screen. Do not close the SysPrep window, just minimize it.

Common Sysprep Errors and How to Fix Them

Error	Cause	Fix
0x80073cf2	Store App issue	Remove AppX package
Fatal error occurred while trying to sysprep the machine	Generic error	Review Panther logs
0x0f0082	Pending updates	Complete updates
Package installed for a user	AppX mismatch	Remove package
Sysprep cannot run on upgraded OS	Upgrade installation	Reinstall clean OS
Windows SIM unable to generate catalog	Old ADK	Install newer ADK
Stream was too long	Large image/archive	Use other tooling
Sysprep was not able to validate your Windows installation	Updated Store apps	Remove offending package

Steps to customize Windows

You are now ready to start customising your Windows. We will take a look at some popular steps that sysops most often configure in their reference image.

CopyProfile: Deploy Default User Settings to All Users

Note. CopyProfile is considered legacy and is discouraged in modern Windows 11 enterprise deployments. You should use policy-based config instead (Intune/GPO).

Most often, sysadmins using Sysprep to deploy a customized default user profile to all new users who sign in to the machine.

By enabling the CopyProfile setting in the answer file, Sysprep copies the settings from the current Administrator profile (configured in Audit Mode) to the Windows Default Profile. Keep in mind that any new user account created after deployment will inherit these settings.

Here are the typical settings that you can deploy with CopyProfile:

• Desktop customization;
• File Explorer preferences;
• Start menu layout;
• Taskbar config;
• Application settings stored in the user profile;
• Default shortcuts and folders.

For example, you can configure the Start menu, pin apps to the taskbar, customize File Explorer options, and then use CopyProfile to make these settings available to all users on deployed devices.

In order to enable CopyProfile, you need to add the following setting in your answer file:

<CopyProfile>true</CopyProfile>

In Windows System Image Manager (WSIM), you should navigate to:

Microsoft-Windows-Shell-Setup

and add the component to the Specialize pass, then set:

CopyProfile = True

Important. We recommend you testing CopyProfile carefully before deploying it in production. Some user-specific settings and modern app preferences may not transfer correctly. You should always validate the resulting image on a test machine before broad deployment.

Step 1 (Optional): Install OEM Information and Logo

Set your company branding info. In this example, we will set the OEMLogo, Company name, tech support website, and working hours. Create a text file oem.reg, and copy the following code into it:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation]
"Logo"="C:\\WINDOWS\\oem\\OEMlogo.bmp"
"Manufacturer"="TheITBros, LLC"
"Model"="Windows 11 Enterprise"
"SupportHours"="9am to 5pm ET M-F"
"SupportURL"="https://theitbros.com"

Note. You can create the graphic file C:\WINDOWS\oem\OEMlogo.bmp with your company logo.

To apply the REG file, double-click it, and accept the registry changes. This will import these settings into the registry.

After restarting, check your branding information in the System Properties dialog:

Step 2: Install the Drivers and Apps

Install all the required drivers and third-party programs you would like to see in your Windows 10/11 image.

Install only the drivers required for your target hardware platform. In environments with multiple hardware models, it is often better to inject model-specific drivers during deployment rather than embedding all drivers into the reference image. Extract the driver files (including the *.inf files) to the local folder and use PowerShell to inject all the drivers from the source folder into the Windows image:

Get-ChildItem "C:\Drivers\" -Recurse -Filter "*.inf" |
ForEach-Object {PNPUtil.exe /add-driver $_.FullName /install}

Enterprise tip. In large enterprise environments with multiple hardware models, generally you should avoid embedding all device drivers into the reference image. Instead, you can use deployment solutions such as Microsoft Deployment Toolkit (MDT) or Microsoft Configuration Manager (MECM) to inject model-specific driver packages during deployment. This method keeps the reference image smaller and simplifies driver maintenance across different hardware platforms.

Then you can download and install apps manually, or use the built-in WinGet package manager to install software from the WinGet repository. For example, let’s install 7-Zip, Google Chrome, and VLC media player. Open an elevated PowerShell prompt and run the following command:

$apps = @(
"7zip.7zip",
"Google.Chrome",
"VideoLAN.VLC"
)

foreach ($app in $apps) {
Write-Host "Installing $app..."

winget install --id $app -e `
--silent `
--accept-package-agreements `
--accept-source-agreements `
--disable-interactivity
}

If you need to reboot Windows to install the application or update, you can do so. After reboot, the system will return to audit mode.

Note. Don’t install or update any Microsoft Store apps on a reference computer.

Step 3: Install Windows Security Update in Audit Mode

Windows will not allow you to install updates in audit mode by using the Windows Update section of the Settings panel since the OOBE phase is not complete.

Use the PSWindowsUpdate module from PowerShell Gallery to install the security updates from the command prompt.

1. Install the PSWindowsUpdate module:
   

   Install-Module -Name PSWindowsUpdate

2. Automatically download and install all the available Windows updates:
   

   PowerShell -ExecutionPolicy RemoteSigned -Command Import-Module PSWindowsUpdate;
   
   Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot

3. Check again for available updates:
   

   Get-WindowsUpdate

Step 4 (Optional): Remove Built-in Microsoft Store Apps

You can optionally remove built-in Microsoft Store (AppX) apps from the reference image. However, you should review the installed and provisioned packages before removing anything. Removing an AppX package that is installed for a user but not provisioned for all users can cause Sysprep to fail with errors (such as 0x80073cf2).

Before removing apps, list the AppX packages currently installed for all users and the packages provisioned in the Windows image:

Get-AppxPackage -AllUsers |
Select-Object Name, PackageFullName
Get-AppxProvisionedPackage -Online |
Select-Object DisplayName, PackageName

You need to review these lists and remove only the packages that are not required in your deployment. This is especially important when preparing modern Windows 11 reference images, including Windows 11 24H2 and 25H2, where AppX package dependencies and provisioning state can affect Sysprep.

Important. Note that the following commands are examples, not a recommended list of packages to remove from every Windows installation. Package names and dependencies can vary between Windows releases. Do not blindly remove all of these packages from a production reference image. First you should verify the package with Get-AppxPackage and Get-AppxProvisionedPackage, and test the resulting image with Sysprep.

For example, if a particular package is not required in your environment, you can remove it with Remove-AppxPackage. The following commands illustrate the syntax for several common packages:

#News app
Get-AppxPackage *BingNews* | Remove-AppxPackage

#Weather
Get-AppxPackage *BingWeather* | Remove-AppxPackage

#PowerShell
Get-AppxPackage *PowerShell* | Remove-AppxPackage

#Music app
Get-AppxPackage *ZuneMusic* | Remove-AppxPackage

#Movies and TV
Get-AppxPackage *ZuneVideo* | Remove-AppxPackage

#MS Office
Get-AppxPackage *MicrosoftOfficeHub* | Remove-AppxPackage

#People app
Get-AppxPackage *People* | Remove-AppxPackage

#Maps
Get-AppxPackage *WindowsMaps* | Remove-AppxPackage

#Help and tips
Get-AppxPackage *GetHelp* | Remove-AppxPackage

#Voice Recorder
Get-AppxPackage *WindowsSoundRecorder* | Remove-AppxPackage

#Sticky Notes
Get-AppxPackage *MicrosoftStickyNotes* | Remove-AppxPackage

#PowerAutomate
Get-AppxPackage *PowerAutomateDesktop* | Remove-AppxPackage

#Xbox and related apps
Get-AppxPackage *Xbox* | Remove-AppxPackage

#Feedback Hub
Get-AppxPackage *WindowsFeedbackHub* | Remove-AppxPackage

#Microsoft To-Do
Get-AppxPackage *Todos* | Remove-AppxPackage

#Calculator
Get-AppxPackage *WindowsCalculator* | Remove-AppxPackage

#Alarms and Clocks
Get-AppxPackage *WindowsAlarms* | Remove-AppxPackage

#Teams/Chat
Get-AppxPackage *Teams* | Remove-AppxPackage

#Your Phone
Get-AppxPackage *YourPhone* | Remove-AppxPackage

#Spotify
Get-AppxPackage *SpotifyAB.SpotifyMusic* | Remove-AppxPackage

#Screen & Sketch/Snipping tool
Get-AppxPackage *ScreenSketch* | Remove-AppxPackage

#Solitaire Collection
Get-AppxPackage *MicrosoftSolitaireCollection* | Remove-AppxPackage

#Photos
Get-AppxPackage *Windows.Photos* | Remove-AppxPackage

#OneDrive
Get-AppxPackage *OneDriveSync* | Remove-AppxPackage

#Skype
Get-AppxPackage *SkypeApp* | Remove-AppxPackage

#Xbox Console Companion
Get-AppxPackage *GamingApp* | Remove-AppxPackage

Before removing built-in Microsoft Store apps, you need to check if they are not required by your users. Some Windows 11 features depend on inbox apps (such as Photos, Calculator, and Snipping Tool).

Important. AppX-related Sysprep failures can occur on modern Windows 11 builds, including 24H2 and 25H2. A typical cause is a mismatch between a package installed for a user and the packages provisioned in the Windows image. If Sysprep fails with 0x80073cf2, review the Sysprep Panther logs and compare the installed and provisioned AppX packages before attempting further removals.

Error SYSPRP Package <PackageFullName> was installed for a user, but not provisioned for all users. This package will not function properly in the sysprep image.
Error SYSPRP Failed to remove apps for the current user: 0x80073cf2.

This is a known Windows 10/11 issue and you can fix it according to the guide.

BitLocker Considerations

In case BitLocker is enabled on the reference device, you need suspend or decrypt the drive before capturing the image.

You can check BitLocker status with the command:

manage-bde -status

To suspend BitLocker, run the following command:

manage-bde -protectors -disable C:

Note that failing to handle BitLocker correctly may cause deployment/recovery problems after image deployment.

Check Installed AppX Packages Before Running Sysprep

One of the most common causes of Sysprep failures is a mismatch between installed Microsoft Store (AppX) packages and provisioned packages. Before running Sysprep, we recommend you to review the installed AppX apps on the reference machine.

You can list all AppX packages installed for all users with the following command:

Get-AppxPackage -AllUsers |
Select-Object Name, PackageFullName

You can list all provisioned AppX packages included in the Windows image by using the command below:

Get-AppxProvisionedPackage -Online

Now compare both lists if Sysprep reports errors such as:

• Package was installed for a user, but not provisioned for all users.

Reviewing AppX packages before running Sysprep can help identify app inconsistencies and prevent common Sysprep validation errors.

Generalizing Windows image using SysPrep

If your computer has a static IP address, change the configuration to get it automatically (from a DHCP server). Open the network adapter settings, select the IPv4 protocol properties and select Obtain an IP address automatically.

What Happens to Windows Activation After Sysprep?

• Retail activation may require reactivation
• KMS clients reactivate automatically
• Digital licenses are normally preserved
• Generalize resets hardware-specific identifiers

Use PowerShell script to automatically get IP address from DHCP server

You can use the following PowerShell script to automatically get an IP address from a DHCP server:

$IPType = "IPv4"
$adapter = Get-NetAdapter | ? {$_.Status -eq "up"}
$interface = $adapter | Get-NetIPInterface -AddressFamily $IPType
If ($interface.Dhcp -eq "Disabled") {
If (($interface | Get-NetIPConfiguration).Ipv4DefaultGateway) {
$interface | Remove-NetRoute -Confirm:$false
}
$interface | Set-NetIPInterface -DHCP Enabled
$interface | Set-DnsClientServerAddress -ResetServerAddresses
}

Cleanup your image

1. Use the Disk Clean-up tool (cleanmgr.exe) to remove junk and unnecessary files from your computer’s hard disk;
   

   

2. Empty the Recycle Bin;
3. Remove temporary files and folders (%LocalAppData%\temp, C:\Windows\Temp, etc.);
4. Delete all local user profiles, except for the Administrator and Default profiles.
5. Clean up the Web Cache files in the Administrator and Default profiles:
   

   rd /s /q "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache"
   
   rd /s /q "C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache"
   
   del /f /q /a:sh "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCacheLock.dat"
   
   rd /s /q "C:\Users\Default\AppData\Local\Microsoft\Windows\WebCache"
   
   rd /s /q "C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache"
   
   del /f /q /a:sh "C:\Users\Default\AppData\Local\Microsoft\Windows\WebCacheLock.dat"

6. Review local accounts and remove any temporary admin accounts/stored credentials that should not be included in the reference image. If the built-in Administrator account is not required after deployment, you should disable it before capturing the image.

After everything is configured, you can expand the SysPrep windows and select the options:

• System Cleanup Action: Enter System Out-of-Box Experience (OOBE);
• Shutdown Options: Shutdown;
• Check the Generalize option.

Once the Windows image has been generalized, it will start in Out-of-Box Experience (OOBE) mode and reassign unique SIDs.

Using Answer Files with Sysprep for Unattended Windows 10/11 Installation

SysPrep allows using an answer file for unattended Windows installation. This step is optional (used to specify various image deployment options). You can skip this step, and go straight to the step of capturing a Windows image.

The answer file can contain the answer to any question you are asked during Windows Setup (region, language, product key, keyboard, account, and privacy setting, etc.). You can use the answer file to skip some of the steps during the out-of-box experience (OOBE).

How to Create a Windows Answer File with WSIM

An answer file is an XML file that can be created and edited manually or with Windows System Image Manager (Windows SIM). WSIM is included with the Windows Assessment and Deployment Kit (ADK) and provides validation and a graphical interface for configuring answer-file settings. However, WSIM is optional, and many admins create/edit answer files manually or use third-party answer-file generators.

Download the Windows Assessment and Deployment Kit (ADK) for Windows 10 or ADK for Windows 11. Use the ADK version for the Windows version you want to deploy.

Run the adksetup.exe file as an administrator. Then select Deployment Tools to install (it includes the latest version of DISM and Windows SIM).

You will need the install.wim file with the Windows image you want to deploy. You can copy the install.wim file from the sources directory on the installation Windows ISO image. If only the install.esd file is available in the sources directory, you can convert ESD to WIM to get install.wim.

Note that Windows installation media may contain either install.wim or install.esd. The ESD format provides better compression, while WIM is easier to service and modify with deployment tools (such as DISM, MDT, and Configuration Manager).

Creating answer unattended file for Windows

Let’s create an unattended answer file for a supported Windows 11 release.

Run the Windows System Image Manager as an administrator (C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\WSIM\imgmgr.exe). Select File > New Answer File.

Specify the path to your install.wim for which you want to create an answer file for.

After the catalog is generated, the corresponding .clg file will appear in the directory with the install.wim file.

Windows SIM was unable to generate a catalog error

WSIM requires a compatible Windows ADK version to generate the catalog for an installation image. If you use an incompatible or older ADK version, you may receive the following error:

Windows SIM was unable to generate a catalog.

In order to fix this error, you need to install the latest ADK and WSIM available for your Windows build.

Select your Windows edition. If there is only one edition of Windows in your install.wim file, it will be selected automatically.

Using WSIM, you can configure various parameters for the answer file. For example, you can configure the Windows product key (if you are using KMS server or MAK keys), time zone, organization and owner info, default language and region settings, input locales, etc.

In case you want all users to receive the same desktop, Start menu, taskbar, and profile customizations, you need to config the CopyProfile setting in the answer file.

To do this, find the amd64_Microsoft-Windows-Shell-Setup__neutral in the Windows Image section. Right-click on it and select Add Setting to Pass 4 specialize.

Then, in the Answer File panel, expand section 4 Specialize > amd64_Microsoft-Windows-Shell-Setup__neutral. Set the CopyProfile value to TRUE.

Configure options in the Answer file

Additionally, you can configure the following options in the Answer file:

Pass 1 Windows PE

Choosing an installation language in WinPE:

Microsoft-Windows-International-Core-WinPE

InputLocale: en-US;

SystemLocale: en-US

UILanguage: en-US

UserLocale: en-US

Pass 7 oobeSystem

Create a local administrator account and set a password for it:

Microsoft-Windows-Shell-Setup –> UserAccounts –> LocalAccounts -> Insert New Local Account

Name: admin

Group: Administrators

All empty (blank) answer file parameters must be removed.

To check the settings in answer file, select in Tools > Validate Answer File option. If you configured everything correctly, a message should appear in the Messages console: No warning or errors.

Save the answer file by choosing File > Save Answer File As > autounattend.xml.

Now you can close WSIM.

Generalize Windows Image Using Answer File

Now you can use your autounattend file to Sysprep your Windows image. Run the command in the elevated command prompt (replace the path to autounattend.xml with yours):

c:\windows\System32\Sysprep\sysprep.exe /generalize /oobe /shutdown /unattend:C:\ps\autounattend.xml

With the /generalize option the Sysprep will remove unique computer data. This allows you to safely deploy this reference Windows image on other workstations or laptops. After executing the command, the computer will shut down.

Hint. If you want to capture a Windows image running in a virtual machine, you can use the special Sysprep switch /mode:vm:

C:\windows\system32\sysprep\sysprep.exe /generalize /oobe /mode:vm /shutdown /unattend:C:\ps\autounattend.xml

Sysprep in VMware, Hyper-V, and Other Virtual Machines

When building a reference image in a VM, we recommend following the next things:

Windows 11 VM requirements. When creating a reference VM for a new Windows 11 25H2 deployment, make sure the VM meets the Windows 11 hardware requirements and uses UEFI firmware, Secure Boot, and a virtual TPM 2.0 where supported by the hypervisor.

• You should use Generation 2 VMs in Hyper-V for Windows 11, with UEFI, Secure Boot, and a virtual TPM 2.0 enabled;
• You should avoid installing unnecessary hypervisor-specific tools before capturing the image;
• You should use the /mode:vm option when the image will only be deployed to VMs of the same hypervisor type;
• Do not use /mode:vm in case the image will be deployed to physical devices.

Here is an example:

sysprep.exe /generalize /oobe /mode:vm /shutdown

ARM64 and Copilot+ PCs

Windows 11 is also available on ARM64 devices, including newer Copilot+ PCs. You should not treat x64 reference image as a universal image for both x64 and ARM64 devices.

If you are deploying Windows 11 to ARM64 hardware, build and test an ARM64 reference image separately. You should use Windows installation media and deployment components that match the target architecture, and validate ARM64-compatible drivers and apps before deployment.

Hardware-specific drivers should not be copied from an x64 reference image to ARM64 devices. For mixed x64/ARM64 environments, you need to maintain separate deployment images/use a standard Windows image with architecture-appropriate provisioning through Intune and Windows Autopilot.

This is particularly relevant for organizations deploying Copilot+ PCs and other Windows 11 ARM64 devices.

Capture Reference Windows 10/11 Using DISM

After shutting down your computer, you can capture a customized Windows image. You can use special tools to capture a Windows image (such as MDT) or use DISM. Below we will consider the DISM option.

Boot the reference computer into Windows PE. The easiest way to access WinPE is to boot the computer from the Windows 10/11 installation media, or recovery drive.

Press Shift + F10 on the first setup screen.

Type Diskpart command. Use the list vol command to identify the drive letters. In this example, the installed Windows image is located on drive D.

Capture the image with the command:

dism /capture-image /imagefile:E:\win11referenceimg.wim /capturedir:d:\ /name:"Windows 11 reference image" /Compress:Maximum

• /Capturedir — the reference Windows folder.
• /imagefile — the target WIM image file you want to create. Connect an additional disk or USB flash drive to the computer and save the image to it (do not specify the Windows partition drive letter here);
• /Compress — use the /compress:maximum option for best WIM image file reduction (this will increase the image capture time, but save a disk space).

Capture reference Windows image and immediately save it to shared network folder on file server (or MDT host)

You can capture your reference Windows image and immediately save it to a shared network folder on your file server (or MDT host). To do this, you need to mount a network drive in WinPE before running the dism /capture-image command:

1. Initialize network in WinPE and get IP address from DHCP server:
   

   wpeinit

2. Map a shared network folder using the net use command:
   

   Net use E: \\192.168.31.20\share

   
3. Provide user credentials to access shared folder;
4. Now you can capture an image to a shared folder over the network.

Modern Deployment Options: MDT, Configuration Manager, Intune, and Windows Autopilot

After capturing your reference image, you need to choose a deployment method.

Here are traditional image-based deployment solutions:

• Microsoft Deployment Toolkit (MDT);
• Windows Deployment Services (WDS);
• Microsoft Configuration Manager (SCCM/MECM).

Provisioning Packages (PPKG) created with Windows Configuration Designer can also be used to apply config settings to Windows devices without creating a custom reference image.

These tools allow you to deploy customized WIM images over the network, they are still widely used in on-premises environments.

However, many organizations are now moving toward cloud-based provisioning using Microsoft Intune and Windows Autopilot. Microsoft also provides Windows Autopilot device preparation, a newer provisioning method designed to simplify and modernize device deployment for organizations using Microsoft Intune.

Windows Autopilot device preparation is a newer provisioning architecture that works with Microsoft Intune and is designed for streamlined Windows device deployment. It differs from the classic Windows Autopilot flow, so in case you are evaluating modern deployment you should consider both methods and choose the one that best fits your existing management and provisioning requirements.

With Windows Autopilot/Windows Autopilot device preparation, you typically use a standard Microsoft Windows image and config the device through Microsoft Intune instead of maintaining a heavily customized reference image:

• Apps;
• Security policies;
• Device config profiles;
• Windows updates;
• Compliance settings.

Cloud-managed configuration and remediation

In modern Windows environments, you can also use Microsoft Intune to manage config and remediate device settings after deployment instead of embedding every customization into a reference image.

Intune config policies can enforce security settings, app config, Windows settings, and other device policies. Intune Remediations can detect and automatically fix config drift/recurring issues on managed devices.

Windows Config Refresh can periodically reapply supported Windows config policies, helping you to prevent local changes from leaving devices in an undesired config state.

This method reduces the need to rebuild and recapture a Sysprep image every time a config setting changes.

In modern cloud-first environments, you may not need to maintain a custom reference image at all. Instead, you can use Windows Autopilot, Intune, config policies, and remediation capabilities to provision and continuously manage devices after deployment.

Image-based deployment remains useful when you:

• Deploying devices in disconnected environments;
• Installing specialized software that must be present before first logon;
• Supporting manufacturing, lab, kiosk, or classroom cases;
• Deploying large numbers of devices with identical configs.

For most Microsoft 365 organizations, Windows Autopilot and Intune are now the preferred deployment platform (note that MDT, WDS, and Configuration Manager remain common in hybrid and on-premises environments).

Provisioning Packages (PPKG) provide another way to config Windows devices without creating and maintaining a custom reference image. Using Windows Configuration Designer, you can create a .ppkg file containing selected Windows config settings, apps, certificates, policies, and other deployment options.

Provisioning packages are useful for lightweight deployment and config cases where creating a customized WIM image with Sysprep would be unnecessary. They can also complement Microsoft Intune and Windows Autopilot in some deployment workflows.

However, PPKG is not a full replacement for image-based deployment/cloud provisioning. The appropriate method depends on the organization’s management architecture and deployment requirements.

Copy the reference WIM image you’ve got to the installation drive media (copy and replace file ..\sources\install.wim), or put it into your deployment software (MDT, SCCM).

Now you can deploy your customized Windows image using MDT, WDS, Configuration Manager (SCCM/MECM), or other image deployment platforms.

Keep in mind that many organizations now use Microsoft Intune and Windows Autopilot instead of traditional image-based deployment. In those environments, you can often deploy standard Microsoft Windows images and use cloud-based provisioning to install apps and config devices automatically.

Note. Note that the reference WIM image you get may be significantly larger than the clean Windows 10 or 11 installation image.

Test the Reference Image Before Production Deployment

Before deploying the reference image across your organization, you should validate it in different environments. We recommend testing the image on:

• A Hyper-V Generation 2 virtual machine;
• A VMware Workstation/ESXi virtual machine (if applicable);
• At least one physical device from each supported hardware vendor (Dell, HP, Lenovo, etc.);
• Devices with BitLocker enabled (if used in your environment).

You need to verify the following after deployment:

• Windows completes OOBE successfully;
• Device drivers are installed correctly;
• Microsoft Store apps work as expected;
• Windows activation succeeds;
• Domain join/Microsoft Entra ID join works correctly;
• Group Policy/Intune policies are applied successfully;
• Required business applications launch without errors.

Testing the image before production deployment will help you to identify hardware-specific and config issues before they affect end users.

When You May Not Need Sysprep

In modern Microsoft 365 environments, Sysprep and custom image deployment may not be required. You should consider using Microsoft Intune together with Windows Autopilot/Windows Autopilot device preparation in the following cases:

• Devices are purchased directly from OEM vendors;
• Appls can be installed after enrollment;
• Cloud-based management is available;
• You want to reduce image maintenance overhead.

Traditional Sysprep-based imaging remains useful for offline, kiosk, classroom, manufacturing, and highly customized environments.

For new Windows 11 deployments, you should consider whether a custom Sysprep image is actually necessary. Microsoft Intune and Windows Autopilot can often provision a standard Windows image with applications, policies, security settings, and config without maintaining a customized WIM image.