auditUser

The auditUser pass processes unattended Setup settings in user context in audit mode. The auditUser pass runs after the auditSystem pass, which is used to apply settings in system context.

Typically, auditUser is used to execute RunSynchronous or RunAsynchronous commands. These commands are used to run scripts, applications, or other executables during audit mode.

Audit mode enables OEMs and corporations to install additional device drivers, applications, and other updates. When Windows boots to audit mode, the auditSystem and auditUser settings for unattended Windows Setup are processed.

By using audit mode, you can maintain fewer Windows images, because you can create a reference image with a minimal set of drivers. The image can be updated with additional drivers during audit mode. You can then test and resolve any issues related to malfunctioning or incorrectly installed devices on the Windows image.

The following diagram illustrates the audit mode process.

auditUser runs only when you configure Windows Setup to boot into audit mode. You can boot to audit mode by using sysprep /audit, or sysprep /generalize /audit, or you can specify the Reseal setting in the Microsoft-Windows-Deployment component. For more information, see the Unattended Windows Setup Reference.

Audit mode is optional.

See Also

Concepts

auditSystem
generalize
offlineServicing
oobeSystem
specialize
windowsPE