auditUser
The auditUser configuration pass processes unattended Windows Setup settings in user context in audit mode. The auditUser configuration pass always runs after the auditSystem pass, which is used to apply settings in system context. Typically, the auditUser configuration pass is used to execute RunSynchronous or RunAsynchronous commands. These commands are used to run scripts, applications, or other executables during audit mode. When Windows boots to audit mode, the auditSystem and auditUser settings for unattended Windows Setup are processed.
Note
It is not necessary to explicitly enable the built-in Administrator account or specify an autologon of the account using an answer file in order to run commands in the auditSystem and auditUser passes. Doing so can prevent the image or device from entering the Out-Of-Box Experience (OOBE) successfully. When booting into Audit Mode, the built-in Administrator account is automatically enabled, is used to run scripts during auditUser pass by default, and is used to sign in automatically.
Audit mode enables OEMs and corporations to install additional device drivers, applications, and other updates to a Windows image. By using audit mode, you can maintain fewer images because you can create a reference image with a minimal set of drivers and applications. The reference image can then be updated with additional drivers during audit mode. Additionally, you can test and resolve any issues related to malfunctioning or incorrectly installed devices on the Windows image before shipping the computer to a customer. Audit mode is optional.
The following diagram illustrates when the auditUser configuration pass is processed in audit mode.
The auditUser configuration pass runs only when you configure Windows Setup to boot into audit mode. You can boot to audit mode by using the sysprep /audit or sysprep /generalize /audit commands, or you can specify the Reseal setting in the Microsoft-Windows-Deployment component. For more information about audit mode, see Audit Mode Overview and Boot Windows to Audit Mode or OOBE.