Have you ever wondered how OEMs deploy Windows 11/10 OS with their own set of apps and drivers? Or how does the recovery partition help you to reinstall everything as if the computer is brand new? This is possible because of a particular Windows 11/10 mode called Audit Mode. Audio mode allows OEMs to preconfigure a System Image, package their software, and then deploy it on thousands of computers. In this post, we will learn about Audit Mode, its benefits, and how to boot into or out of Audio mode.
What is Windows Audit Mode?
There are two modes Windows can choose to boot —
- OOBE and
- Audit Mode.
OOBE or Out-of-box experience is the default mode that allows the consumers to set up Windows on a new machine or when they choose to reset Windows.
Audit Mode, as I said earlier, allows OEMs to deploy a system image consisting of driver packages, applications, and computer-specific updates that are required or planned to be deployed during the installation. While more things are involved that briefly explain the need for Audit mode. Let’s take a look at the benefits of Audio Mode.
Bypass OOBE
There is no Welcome Screen or Setup Screen. It allows you to boot into the desktop using the built-in admin account and set up things. So you do not need to create an account at all.
Install applications, add device drivers, and run scripts
That is the primary goal of using Audit mode. Use a default image, and then customize it based on your business requirements. You can also install additional language packs and device drivers. It is also called the auditSystem configuration pass process.
Test the validity of a Windows installation
Once you are done with the setup, you can test how the setup process will behave when the end-user starts using the OOBE. It is also called the auditUser configuration pass.
Add more customizations to a reference image
It is evident that once you are through a successful audit process, and everything works as expected, the same image can be deployed to multiple computers. If not, you can boot back into Audit mode to configure on per device per se. Many times, the changes are because of the device or consumer request.
How to boot into or out of Audit Mode in Windows 11/10
Microsoft offers an Answer File Unattend.xml. It is an XML-based file that contains setting definitions and values to use during Windows Setup. The file can be created using Windows System Image Manager. Only when Windows 10 Setup files this file does it boot into the Audio mode; otherwise, it will boot into the default OOBE mode. Use any of the following methods to boot into Audit mode.
Boot into Audit Mode in Windows (Automatically or Manually)
- Add the Microsoft-Windows-Deployment | Reseal | Mode = audit answer file setting.
- Keyboard Shortcut: At the OOBE screen, press CTRL+SHIFT+F3.
The System Preparation (Sysprep) tool will appear when the computer reboots into Audit mode. The only drawback of using the keyboard shortcut is that it does not bypass all parts of the OOBE process. That includes running scripts and applying answer file settings in the oobeSystem configuration pass.
Boot into Audit mode using an image which is configured to boot into OOBE
You can use the keyboard shortcut or mount the image, and add the answer file with the audit setting save it as:
C:\test\offline\Windows\Panther\Unattend\Unattend.xml.
Boot to audit mode automatically from an existing image
Create a new answer file, and add Microsoft-Windows-Deployment | Reseal | Mode = audit. Save the file as Unattend.xml.
On an elevated command prompt, execute the command:
Dism /Mount-Image /ImageFile:C:\test\images\MyImage.wim /index: /MountDir:C:\test\offline
The image_index is the number of the selected image on the .wim file.
Just like in the above step, copy the new answer file to this folder:
C:\test\offline\Windows\Panther\Unattend
Finalize the changes by using the DISM tool. Use the following command:
Dism /Unmount-Image /MountDir:C:\test\offline /commit
How do you boot out of Audit Mode in Windows 11/10?
You can delete the Unattend.xml file, and then commit using the DISM tool or simply add the Microsoft-Windows-Deployment | Reseal | Mode = oobe answer file setting.
Audit Mode is not for general consumers. It is either for OEMs or IT departments who must apply the image with the same settings, drivers, and apps to multiple computers.
I hope the post was easy to follow and that you could boot into or out of Audit Mode in Windows 11/10.
