Using Audit Mode in Windows 7

Audit Mode is a feature of Windows 7 (and Windows Vista) that will allow you to install and uninstall applications and drivers and make system changes without creating a user account or entering any computer information. Using Windows’ built-in Administrator account, you can install and uninstall programs, updates and drivers. When you’re finished you can repackage the OS using a program called Sysprep, which will delete the temporary Administrator account and display the Out of Box Experience (OOBE) setup wizard with which Windows users should by now be familiar.

Audit Mode is a tool that is useful only in specific circumstances, but it is very valuable to some – for example, maybe you’ve bought or built a new computer for a friend or family member, and you want to uninstall crapware or update some drivers while allowing the machine to keep that new-computer smell. Maybe you’re a small (or large) PC reseller who wants to customize a PC in certain ways before selling it or passing it to a client. In these and in other scenarios, Audit Mode can be a very valuable tool.

So, how to access it? Audit Mode can only be accessed when Windows is starting up for the first time, during the aforementioned OOBE process – this is the same whether you just installed the OS yourself from a DVD or whether you’re booting up a PC from someone like Dell or HP for the first time. When Windows asks you for your username, press CTRL + Shift + F3. This combo will stop the OOBE wizard and launch Audit Mode. When the PC boots, it will automatically login to the temporary Administrator account and launch Sysprep.

Windows 7 Audit Mode

Windows 7 Audit Mode

Now, you can connect to networks, install and uninstall applications and drivers, and make other changes to the system just as you would as a normal user. Since Audit Mode runs using the built-in Administrator account, you will not see any UAC prompts as you make system changes – this is normal. You can also reboot the PC as many times as you want – it will continue to boot into Audit Mode until you run the Sysprep process.

The Windows 7 Sysprep tool

The Windows 7 Sysprep tool

Now, let’s bring our attention to the Sysprep window, pictured above. It’s a simple tool to use, and it automatically launches in Audit Mode – once you’ve finished making changes to the operating system, you’ll need to run the tool to make the computer boot in normal mode.

Under the System Cleanup Action drop-down menu, make sure to select Enter System Out-of-Box Experience (OOBE), and to make sure that the Generalize box is unchecked – you only need to Generalize a system if you’re planning on making a disk image of the OS and deploying that image on computer with different hardware.

Under the Shutdown Options menu, I usually select Shutdown instead of Reboot – this shuts the PC down and allows you to pack it up or store it until it’s ready to be used. The next time the computer is turned on, it will ask the user for their desired account name and password just like any new PC.

Audit Mode becomes infinitely more useful and powerful when used in conjunction with other Microsoft deployment tools like the Windows Automated Installation Kit (WAIK, or just AIK), though these tools are of limited use to anyone but enterprise IT administrators. Still, complicated as these tools are, I hope to write follow-up pieces to instruct people on the basics of their use. Until then, I hope some of you find Audit Mode useful for deploying more professional-looking PCs.

Subscribe & Connect

Share This Post: 

Subscribe to our e-mail newsletter for updates:

, ,

3 Responses to Using Audit Mode in Windows 7

  1. Anonymous December 30, 2009 at 11:17 pm #

    is there one for vista and XP as well?

    • Andrew December 31, 2009 at 1:07 pm #

      It was introduced in Vista. There’s no equivalent for XP, though if you google “XP Sysprep” you ought to be able to find the XP version of the Sysprep tool and do some things that way.

  2. Ambarbhusari April 3, 2011 at 3:00 am #

    how to exit audit mode..?

Leave a Reply