How-To: Image Windows XP with Ghost and Sysprep

I tend to install and reinstall operating systems quite frequently on my home system. With my hectic schedule, I don’t have time to sit down to reinstall and configure every last program. Although it is arguably easier to use a backup of my system for day-to-day mishaps, I tend to change out peripherals a lot and restoring a system that does not have certain drivers “cleaned out” tends to wreak havoc on a new configuration. To make this process go a bit faster, two years ago I created a “Ghost Image” of my hard drive after doing a basic install. Now, instead of it taking a few hours of toiling away to reinstall a system, I can do this all in about 15 minutes with only half a dozen quick mouse clicks. The trick is to use Norton Ghost or any other imaging software and Microsoft Sysprep.

Part 1: Install XP and Sysprep

  1. Install Windows XP on a clean hard drive.
  2. Do not install any drivers or other utilities that are hardware specific beyond what Windows itself installs.
    • This is necessary to make sure the image is as portable as possible across different types of systems. However, different storage controllers and different HALs (Hardware Abstraction Layers) make this harder to predict.
    • Most modern computers these days work fine with a standard ACPI HAL, but if this image is to be truly portable across multiple machines then it must be determined which specific HAL will be needed. Refer to Microsoft KB309283 if you are completely lost.
    • It is also important to determine if the target system uses a storage controller that normally requires a driver disc during a regular XP install. If this is the case, then the necessary paths to the drivers must be included in the Sysprep.inf file. These must be added to the [SysprepMassStorage] section in the form PCI\VEN_###&DEV_#### = PATH_TO_DRIVER_ON_IMAGED_DRIVE where VEN_#### should be replaced by the Vendor ID number (i.e. VEN_1234) and the DEV_#### should be replaced by the Device ID number (DEV_1234). This information can usually be found in the specifc driver INF files. Here is an example for adding the VMWare SCSI controller driver to sysprep.inf

      [SysprepMassStorage]
      ….snipped out windows mass storage driver list….

      PCI\VEN_104B&DEV_1040=C:\Drivers\Mass\VMWare\vmscsi.inf

  3. Create a testuser account with administrative privileges. Use this account to install and configure all the software and policies on the system.
  4. Remember to run Windows Update, Office Update and make sure all the rest of the software is up to date. You’ll probably end up rebooting a few times in between but keep going until everything is updated.
  5. Copy all the start menu items from the testuser account to the Administrator start menu. (Note: This is necessary as some installers do not create start menu items in All Users but within the testuser profile only. This leaves some items missing on the Administrator start menu.)
  6. Log out and log back in as the computer Administrator and then copy the testuser profile folder to the default user profile folder. This is done via Control Panel -> System -> Advanced -> User Profile “Settings” then select testuser and click Copy to. Copy all of this to c:\Documents and Settings\Default User. If you don’t understand then refer to Microsoft KB291586.
  7. Delete the testuser account. Make sure that c:\Documents and Settings\testuser has been deleted too.
  8. Download Sysprep for XP SP2.
  9. Extract the files to c:\sysprep.
  10. Create the basic sysprep.inf file by running setupmgr.exe. This a tool Microsoft provides for creating an answer file so the restore doesn’t involving asking the normal setup questions. The basic steps are below:
    • Run setupmgr.exe
    • Click Create New
    • Click Sysprep Setup
    • Then choose whichever product you are using. In our example it would be XP Professional.
    • The next question asks: Do you want to fully automate the install? All this question determines is who is going to accept the EULA, you or the person restoring the image. Also, picking yes means that you must enter your Product Key. I pick no because this is for my own use and I don’t want someone to swipe my Product Key accidentally, but a large company or OEM may choose differently.
    • The next few sets of options are for you to enter in any information like your Name, Organization, Time Zone, Product Key (I leave this blank), Network Settings, etc.
    • I leave the Computer Name option set to Automatically generate computer name.
    • Once completed, a dialog box will ask where you want to save the file. c:\sysprep\sysprep.inf is the path we’re using in this example.
    • On the completion screen, click Cancel to close setupmgr.exe.

    The process of creating a basic sysprep.inf file is now completed.

  11. Before proceeding to the next step, create a custom hardware drivers directory for any drivers needed for the target system. Usually I use c:\drivers.
  12. Open c:\sysprep\sysprep.inf in Notepad and add the following lines to the relavent sections (if the heading doesn’t exist, create it):

    [Unattended]
    DriverSigningPolicy=Ignore
    UpdateInstalledDrivers=Yes
    OemPNPDriversPath=drivers\hardware_cat\driver_dir\driver_inf;(repeat);

    [SysPrep]
    BuildMassStorageSection=Yes

    [SysprepMassStorage]

  13. Do not close the sysprep.inf yet! OemPNPDriversPath points to the c:\drivers directory created earlier. For organizational purposes, I split up my custom driver files based on category (i.e. hardware_cat in the example above). For example, all video drivers go under c:\drivers\video and network drivers under c:\drivers\network. In each of those directories, the specific driver bundles are placed with their driver inf files (i.e. driver_dir). For example, the latest nVidia drivers would go into c:\drivers\video\nVidia\. The last part is refering to driver_inf is just that, the name of the inf file. For example, for the latest nVidia driver, the path would be c:\drivers\video\nVidia\nv4_disp.inf. In sysprep.inf, the path would be written as OemPNPDriversPath=drivers\video\nVidia\nv4_disp.inf;. Do not forget the semi-colon as a separator. For the next driver, repeat the procedure by placing the path after the semi-colon without leaving a space. Once all the drivers are added, save the file.
  14. Run c:\sysprep\sysprep -bmsd. This will build the Windows XP standard mass storage drivers section.
  15. While editing sysprep.inf there is an option labeled InstallFilesPath which usually points to c:\sysprep\i386. I usually copy the contents of my XP CD’s i386 directory into c:\sysprep\i386. This isn’t necessary.
  16. Add any custom Storage dirvers to the [SysprepMassStorage] section as detailed above.
  17. Now run C:\sysprep\sysprep.exe.
  18. Pick options Mini Setup and Detect non-plug and play hardware. If you don’t have a volume license and plan on just using this image for restoring the computer the image was made on, then pick the option Don’t regenerate security identifiers. If you have a volume license key and will be using this image for multiple machines then leave that option unchecked. Ensure that Shutdown is selected from the Shutdown mode drop-down menu and click Reseal.
  19. If you left the SID option to regenerate, then a pop-up will ask you to confirm. hit OK to continue.
  20. This will take a while and your system will shut down once the process is complete.

Sysprep is now complete. Part 2 discusses imaging.