Preparing a Windows 11 Virtual Machine Image for Mass Deployment with Microsoft Sysprep

When you distribute Windows 11 VMs to your end-users' computers, you may need to manage those virtual machines (VMs) granularly: enroll them into domains, activate Windows licenses, differentiate PC names, enforce specific policies, enable company-wide licensing tools, etc. All that and more can be achieved with the help of Microsoft's Sysprep utility.

This guide explains how to prepare VMs for deployment on Parallels Desktop using MS Sysprep. You are free to selectively follow only the steps that you need to solve your particular task.

By leveraging Sysprep, you can avoid a frequently occurring problem where all VMs activated from the same image appear as a single machine to your endpoint licensing tool (e.g., a KMS server or a cloud-based licensing tool). Sysprep allows you to customize each VM individually, ensuring that they are recognized as separate entities by your licensing and management systems.

Following the steps outlined in this guide will help you streamline your VM deployment process, improve VM management capabilities, and ensure compliance with licensing requirements.

How Sysprep Works

Microsoft provides the Sysprep utility as a means to generalize a Windows 11 image. Using Sysprep, you can remove installation-specific information such as the SID (Security Identifier), GUID (Globally Unique Identifier), and other identifiers before deploying the image. This process allows you to create a standardized image that can be deployed across multiple machines.

You can begin preparing the image by installing all the necessary software, drivers, and security updates and customizing the default user profile. Once the image is ready, you can deploy it to individual devices as if each device had a separate Windows installation.

On a Windows machine, the Sysprep.exe utility can be found inside the C:\Windows\System32\Sysprep folder.

Sysprep also offers a way to automate a sequence of setup tasks using an answer file, which is an XML-based file that contains predefined settings and values that will be applied during the Windows setup process. Within the answer file, you can specify various setup options such as computer name, licensing information, workgroup or domain settings, and more. The answer file is typically named Unattend.xml but can bear any name you want.

A combination of Sysprep and an answer file streamlines the deployment process, ensures consistent settings across devices, and automates the setup tasks.'

Note: Refer to the official Microsoft documentation and guidelines for detailed instructions on utilizing Sysprep and creating answer files tailored to your specific deployment needs.

Preparing a Windows 11 Virtual Machine Image with Sysprep

Note: We highly recommend using snapshots to save the current state of the virtual machine as a restore point before proceeding with the following actions. Learn more about snapshots in KB 5691.

Follow these steps:

1. Open Parallels Desktop for Mac and create a Windows 11 virtual machine. Note: If your virtual machine runs Windows 11 on Arm, for Sysprep to run correctly, you MUST disable system disk encryption which is enabled by default. Use Windows Terminal to run the following command: manage-bde -off C:

   You can also verify the status of disk encryption by using the command:

   manage-bde -status C:

2. Launch the new Windows 11 installation and enter System Audit Mode by launching Sysprep (C:\Windows\System32\Sysprep\sysprep.exe) with the following parameters:

   

   Once you set the parameters, click OK to reboot the Windows into Sysprep mode. The Audit mode is typically used in conjunction with Sysprep (System Preparation) to prepare a Windows installation for deployment. It allows system administrators to customize the installation by adding software updates, drivers, and third-party applications; customizing user profiles; and making configuration changes before the system is sealed and captured for deployment. It provides a way to access and modify the system without triggering the Out-of-Box Experience (OOBE) that usually launches when a new installation is first booted.

   Once the desired modifications are made, Sysprep can be run to generalize the installation and prepare it for imaging or cloning.

3. Once your Windows system reboots into the Audit mode, introduce the necessary modifications: install drivers, updates, third-party software, and other required components. Note: DO NOT enroll this reference Windows machine into domains. DO NOT install or update any Microsoft Store apps. If you plan to later enroll virtual machines into Azure AD or InTune, refer to this KB article which will walk you through the process. Ignore the entire article or parts of it if you don’t plan to enroll your VMs into AAD or InTune.

4. [OPTIONAL] If you're going to mass-deploy the created image in a generalized state, you might want to prepare your own version of the answer.xml file. This will enable you to enroll freshly installed VMs in the domain, randomize their names and IDs, set up customs locales, assign cloud-based licenses correctly, and more. You may find our sample file for both x86-64 and Windows on Arm versions here; the file can be used with either architecture. Since the answer file covers both x86_64 and Arm architectures, any changes to the file should be done to the part of the file that matches the end user's architecture. Change the specified parameters as needed and activate the ones you plan on using by uncommenting the corresponding strings. To uncomment the strings, remove the “” sequences at the end of them, along with the explanations, as displayed in the image below.

   

   

   Once you have made all the changes, save the file as answer.xml, then go to C:\Windows\Setup, create a folder named Scripts, and copy your configured answer.xml file there. Since the file contains usernames and passwords in plain text, it is safer to automatically delete it at the end of the deployment process. In a text editor, create a file containing one line: Erase C:\Windows\Setup\Scripts\answer.xml Save it as setupcomplete.cmd and copy it to the C:\Windows\Setup\Scripts directory. During the setup process, before the login screen appears, Windows will automatically execute setupcomplete.cmd and erase the answer.xml file.

   Make a second copy of setupcomplete.cmd, rename it to ErrorHandled.cmd, and copy it to the C:\Windows\Setup\Scripts directory. This way, the answer.xml file also gets deleted if the setup process crashes with critical errors.

5. [OPTIONAL] If you want to enroll the VM into Intune after the installation process, you need to perform the steps below:

   1. Create a provisioning package as outlined in How to enroll Parallels Desktop Virtual Machines to Azure Active Directory to prepare the InTuneEnrollment.ppkg.

   2. Go to C:\Windows\Setup, and create a folder named Scripts if you have not done it yet.

   3. Open any text editor, create a new file, and add the command below to this file to trigger the execution of the prepared package during the Windows installation process in the VM that will be deployed to the end users. Save the file as SetupComplete.cmd and put it into the Scripts folder. @echo off start /wait %windir%\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass Install-ProvisioningPackage -PackagePath C:\Windows\Setup\Scripts\InTuneEnrollment.ppkg -QuietInstall

6. [RECOMMENDED] Consider creating a backup of the resulting virtual machine image. It may serve as a useful reference point in case of issues with further modifications or updates.

7. Generalize the image before deploying it by doing ONE of the following:

   • If you skipped step 4 and did NOT create the answer.xml file, launch Sysprep (C:\Windows\System32\Sysprep\sysprep.exe), select the OOBE option, tick the Generalize box, and select Shutdown from the drop-down list. Click OK.

     
   • If you DID create the answer.xml file, open the Windows Command prompt, execute the following commands to generalize the installation, and shut down the VM: C:\Windows\System32\Sysprep\Sysprep.exe /unattend:C:\Windows\Setup\Scripts\answer.xml /oobe /generalize /shutdown

8. You can test the resulting image by creating a copy of your virtual machine to start and see how the installation process will look for your end users.

   Once the virtual machine shuts down in step 7, open the Parallels Desktop Control Center (right-click the Parallels Desktop icon in Dock > Control Center) > right-click the VM name > Clone > create a name for the new VM (e.g., Clone of Sysprep image) and click Save.

   Start the cloned virtual machine and monitor the installation process closely. If the test is successful, make sure to remove the snapshots from the original virtual machine by right-clicking on it and selecting Manage snapshots. Proceed with the rest of the steps in the main chapter.