Last Updated on 2017-11-22.
[:en]Just tried to sysprep a Windows 10 image which had been upgraded from 1703 to 1709.
In general, sysprep does not like Win10’s modern apps. It tries to remove most of them, but this does not always succeed.
After the first try, %windir%\system32\sysprep\panther setupact.log and setuperr.log show:
package xxxx was installed for a user but not provisioned for all users
This is quite simple to solve. Remove unneeded apps e.g. with this command:
$apps = (Get-AppxPackage -AllUsers | where-object {$_.name –notlike "*store*" -And $_.name -notlike "*calc*" -And $_.name -notlike "*photos*" } ).name foreach ($app in $apps) { Get-AppxPackage -Name $app -AllUsers | Remove-AppxPackage -AllUsers }
The second issue I’d like to describe seems to be very rare and might only happen on Win10 machines which were upgraded multiple times (or other unknown reasons).
In my special case, “Get-AppxPackage -AllUsers” showed two different versions of Microsoft.WindowsAlarms. Sysprep tries to delete both versions but can’t, because the older version does not really exist any more. It exits with an error, leaving your VM half-sysprep’d, so absolutely make snapshots after every single step!
Setuperr.log shows:
… sysprep could not remove staged package … (0x80070002) – FileNotFoundException
Unfortunately, it does not tell us what file is exactly missing. Testing with Process Monitor, it seems to be a registry entry, but creating it manually does not help.
Anyway, we have to get rid of the app’s old versioned duplicated entry for sysprep to succeed, so we need to edit the Appx SQLite DB.
This post on SU shows a very good explanation of how you can access the database.
In short, you need 2 applications (both have portable versions):
(Instead of ProcessHacker, you can also use PsTools (psexec) to start DB Browser as system user: psexec -i -s -d cmd)
Steps:
- Open ProcessHacker as Admin
- Select one of the vshost.exe processes -> Misc -> Run as this user
- Choose DB Browser’s .exe file
- Open file with DB Browser: C:\ProgramData\Microsoft\Windows\AppRepository\StateRepository-Machine.srd
- Open tab “Brows data”, then select table Package
- Look for the apps to be removed, then delete the whole line(s) (button)
- Finally, let DB Browser write the changes to the file
To see if it worked, test it e.g. by calling
Get-AppxPackage -AllUsers *alarm*
If it worked (i.e. if the old version does not show up any more), run sysprep again and it should work -> system will finally shut down.
Update 2018-12: Solving Sysprep Error 0x80070003
The Panther setupact.log might come up with this error if you upgraded from a previous version.
See the following registry edit script:
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\Setup] "Upgrade"=- "UninstallActive"=dword:00000000 "UninstallMark"=- "UninstallGUID"=- "UninstallSourceVersion"=- "UninstallScenario"=- [-HKEY_LOCAL_MACHINE\SYSTEM\Setup\Upgrade] ; Adapt following key to the one actually present in your registry [-HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on 8/16/2015 11:36:09)] ; Maybe more... (all of those keys will and should be deleted) [-HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on 8/16/2017 11:36:09)] [-HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on 8/16/2018 11:36:09)]
Run it on the machine where you run sysprep afterwards.
Source[:]
I was unable to delete the row in the package table containing the problem application due to and error stating “no such function: sroptions (DELETE FROM `Package` WHERE `_rowid_` IN (’93’);)
Eventually found I could delete row by going to database structure and deleting the “CREATE TRIGGER TRG_AFTERDELETE” row containing sroptions
David, you’re a genius. If someone else stumbles across this, it seems to be another difficulty increase for sysprepping 1803.
Navigate to Database Structure, go down to where the Triggers are defined, and delete TRIG_AFTERDELETE_Package_Key, write changes, and voila; back to deleting package rows as normal.
I hate Microsoft.
LET US SYSPREP.
David,
This was the missing piece to the puzzle! Thank you for commenting! You save me hours of headache!