Sysprep problems on WES 7

Would be nice to read you've succeeded! Keep us posted.

That error code in the context of IIS service starting actually means "Access Denied". I'm thinking at this point the sysprep is already partially done, and the machinekeys goo no longer matches the security of the user starting the service, so it fails.

I hate to ask as I know you're working hard on the image and probably have done a lot of pre-req work, but do you really absolutely need to have IIS installed before creating the image? If you're just installing it so that it's there for after the sysprep it would be better to use dism /onlinen to add it post-sysprep. If you absolutely positively MUST have it installed pre-sysprep, we'll have to dig into this. You might be SOL on that image right now though, unfortunately.

MSMQ probably requires IIS because it (as of v3.x) uses HTTP and SOAP messaging on both ends to do messaging, and these components come out of IIS binaries natively. I suppose they could re-write MSMQ to also have that functionality, but that doesn't make much sense.

If you do not have to configure MSMQ or IIS before sysprep'ing (hopefully you can do that unattended afterwards), that is always a better way to do imaging - less is more when it comes to sysprep, at least with inbox services like IIS.

I never ever add applications to my base WIM, so I personally disagree with step 1 - however, there could be good reasons to lock an app into an image, so I won't knock it. I would just say that adding things into an image means you're going to have to recreate it if you need to go and update or change those apps in the future, meaning you have to redo your imaging entirely. I much prefer the MDT or SCCM way of doing things, where you put down an unchanged WIM with your unattend.xml desired changes, inject drivers during WinPE, reboot and then add apps, make settings changes, etc. However, like I said, there are always multiple ways to do imaging with Win7, and there could be a valid reason to do it another way - those ways can be quicker to plunk down an image, but with the tradeoff that they need ongoing maintenance attention.

As to step 2, technically you don't need to do this at all - any deviation from default settings (as would be configured in group policy) are removed and reset via sysprep, so whatever you do here is whacked anyway.

As to step 6, to add features via dism.exe like MSMQ or IIS to Windows Embedded, you should read this blog post on MSDN - basically you're creating an unattend file and config set with ICE, and then Apply-Unattend is run against it with dism later to apply it and install the packages you specified with ICE.


I believe you can install WE7 using MDT 2010, so it is something to look into. It might help you be more flexible and repeatable in your installs, as well as providing a lot of built-in logic for things like patches, drivers, hardware detection, etc., and avoid some of the things you're likely to run into doing it the "prescribed" ways on technet.

Good to hear!