Monday, May 28, 2007

How-To: Image Windows XP with Ghost and Sysprep

How-To: Image Windows XP with Ghost and Sysprep

I tend to install and reinstall operating systems quite frequently on my home system. With my hectic schedule, I don’t have time to sit down to reinstall and configure every last program. Although it is arguably easier to use a backup of my system for day-to-day mishaps, I tend to change out peripherals a lot and restoring a system that does not have certain drivers “cleaned out” tends to wreak havoc on a new configuration. To make this process go a bit faster, two years ago I created a “Ghost Image” of my hard drive after doing a basic install. Now, instead of it taking a few hours of toiling away to reinstall a system, I can do this all in about 15 minutes with only half a dozen quick mouse clicks. The trick is to use Norton Ghost or any other imaging software and Microsoft Sysprep.

Part 1: Install XP and Sysprep

  1. Install Windows XP on a clean hard drive.
  2. Do not install any drivers or other utilities that are hardware specific beyond what Windows itself installs.
    • This is necessary to make sure the image is as portable as possible across different types of systems. However, different storage controllers and different HALs (Hardware Abstraction Layers) make this harder to predict.
    • Most modern computers these days work fine with a standard ACPI HAL, but if this image is to be truly portable across multiple machines then it must be determined which specific HAL will be needed. Refer to Microsoft KB309283 if you are completely lost.
    • It is also important to determine if the target system uses a storage controller that normally requires a driver disc during a regular XP install. If this is the case, then the necessary paths to the drivers must be included in the Sysprep.inf file. These must be added to the [SysprepMassStorage] section in the form PCI\VEN_###&DEV_#### = PATH_TO_DRIVER_ON_IMAGED_DRIVE where VEN_#### should be replaced by the Vendor ID number (i.e. VEN_1234) and the DEV_#### should be replaced by the Device ID number (DEV_1234). This information can usually be found in the specifc driver INF files. Here is an example for adding the VMWare SCSI controller driver to sysprep.inf

….snipped out windows mass storage driver list….


  1. Create a testuser account with administrative privileges. Use this account to install and configure all the software and policies on the system.
  2. Remember to run Windows Update, Office Update and make sure all the rest of the software is up to date. You’ll probably end up rebooting a few times in between but keep going until everything is updated.
  3. Copy all the start menu items from the testuser account to the Administrator start menu. (Note: This is necessary as some installers do not create start menu items in All Users but within the testuser profile only. This leaves some items missing on the Administrator start menu.)
  4. Log out and log back in as the computer Administrator and then copy the testuser profile folder to the default user profile folder. This is done via Control Panel -> System -> Advanced -> User Profile “Settings” then select testuser and click Copy to. Copy all of this to c:\Documents and Settings\Default User. If you don’t understand then refer to Microsoft KB291586.
  5. Delete the testuser account. Make sure that c:\Documents and Settings\testuser has been deleted too.
  6. Download Sysprep for XP SP2.
  7. Extract the files to c:\sysprep.
  8. Create the basic sysprep.inf file by running setupmgr.exe. This a tool Microsoft provides for creating an answer file so the restore doesn’t involving asking the normal setup questions. The basic steps are below:
    • Run setupmgr.exe
    • Click Create New
    • Click Sysprep Setup
    • Then choose whichever product you are using. In our example it would be XP Professional.
    • The next question asks: Do you want to fully automate the install? All this question determines is who is going to accept the EULA, you or the person restoring the image. Also, picking yes means that you must enter your Product Key. I pick no because this is for my own use and I don’t want someone to swipe my Product Key accidentally, but a large company or OEM may choose differently.
    • The next few sets of options are for you to enter in any information like your Name, Organization, Time Zone, Product Key (I leave this blank), Network Settings, etc.
    • I leave the Computer Name option set to Automatically generate computer name.
    • Once completed, a dialog box will ask where you want to save the file. c:\sysprep\sysprep.inf is the path we’re using in this example.
    • On the completion screen, click Cancel to close setupmgr.exe.

The process of creating a basic sysprep.inf file is now completed.

  1. Before proceeding to the next step, create a custom hardware drivers directory for any drivers needed for the target system. Usually I use c:\drivers.
  2. Open c:\sysprep\sysprep.inf in Notepad and add the following lines to the relavent sections (if the heading doesn’t exist, create it):




  1. Do not close the sysprep.inf yet! OemPNPDriversPath points to the c:\drivers directory created earlier. For organizational purposes, I split up my custom driver files based on category (i.e. hardware_cat in the example above). For example, all video drivers go under c:\drivers\video and network drivers under c:\drivers\network. In each of those directories, the specific driver bundles are placed with their driver inf files (i.e. driver_dir). For example, the latest nVidia drivers would go into c:\drivers\video\nVidia\. The last part is refering to driver_inf is just that, the name of the inf file. For example, for the latest nVidia driver, the path would be c:\drivers\video\nVidia\nv4_disp.inf. In sysprep.inf, the path would be written as OemPNPDriversPath=drivers\video\nVidia\nv4_disp.inf;. Do not forget the semi-colon as a separator. For the next driver, repeat the procedure by placing the path after the semi-colon without leaving a space. Once all the drivers are added, save the file.
  2. Run c:\sysprep\sysprep -bmsd. This will build the Windows XP standard mass storage drivers section.
  3. While editing sysprep.inf there is an option labeled InstallFilesPath which usually points to c:\sysprep\i386. I usually copy the contents of my XP CD’s i386 directory into c:\sysprep\i386. This isn’t necessary.
  4. Add any custom Storage dirvers to the [SysprepMassStorage] section as detailed above.
  5. Now run C:\sysprep\sysprep.exe.
  6. Pick options Mini Setup and Detect non-plug and play hardware. If you don’t have a volume license and plan on just using this image for restoring the computer the image was made on, then pick the option Don’t regenerate security identifiers. If you have a volume license key and will be using this image for multiple machines then leave that option unchecked. Ensure that Shutdown is selected from the Shutdown mode drop-down menu and click Reseal.
  7. If you left the SID option to regenerate, then a pop-up will ask you to confirm. hit OK to continue.
  8. This will take a while and your system will shut down once the process is complete.

Sysprep is now complete. Part 2 contains instructions on imaging the partition.

Part 2: Norton Ghost Instructions

I’m using an older version of Ghost because the newer versions are trumped by Acronis True Image in terms of having less bugs and more features. However, DOS based Ghost has worked fine for me for most systems. If Ghost fails on your system for some reason, try imaging with Acronis True Image trial version. The basic idea is boot off a floopy or CD on the source system, start the backup program, backup the entire drive as an image file onto some other device (portable hard drive or another drive in the system) and then restoring (as necessary) from that image file onto a target system.

The basic Ghost process is as follows:

Note: You must do this on another machine that has Ghost installed. If you boot the Sysprep machine accidentally then you must go through the entire Sysprep checklist again. Trust me, I learned the hard way more than once.

  1. A Ghost bootdisk must be created for the target system. In Ghost 2003, start Ghost from the Start Menu -> Programs -> Norton Ghost.
  2. Click Ghost Utilities then click Norton Ghost Boot Wizard.
  3. A wizard comes up. Since I plan on saving my image to a portable USB or Firewire hard drive I pick Standard Ghost Boot Disk. You may have to choose another option if you plan on saving the image to a network Ghost image server.
  4. On the next screen, under External Storage Options click the check boxes for USB 2.0 Support or Firewire Support depending on your target backup device. If you are using an internal secondary hard drive, then you don’t need to pick anything.
  5. On the next screen, click Use PC-DOS.
  6. The next screen asks for the path of ghost.exe. The default path is usually fine.
  7. Finally we are presented with a screen asking for the floppy disk drive letter and formating options. Pick the proper drive letter and leave the format options alone. Click next.
  8. This is the Review screen. Make sure all the options are correct and insert an empty floppy into your drive. A format dialog will pop up with a warning that everything on the floppy will be erased. Hit Okay. Close it once it is completed. Ghost will copy the files over.
  9. If you are using an external hard drive then make sure it is connected to the source machine prior to booting the Ghost floppy on the system. If you are using an internal hard drive (not the same one as the Sysprep’d drive) in the source system then make sure there is enough free space on it. Again, you cannot save the image onto the drive/partition you are imaging for obvious reasons.
  10. Put your shiny new floppy into the Sysprep prepared machine and boot off of it.
  11. Create the image following the on-screen directions.
    1. Click Local.
    2. Click Disk. I’ve assumed that we are imaging a single large NTFS partition encompassing the entire drive throughout this tutorial hence the need for either an external drive or different internal hard drive. This can all be done on a single drive with two paritions but I’ll leave for the end user to explore.
    3. Click To Image. The next screen states Select local source drive by clicking on the drive number. Make sure you select the drive that contains the Sysprep prepared XP deployment! Check and double check this. Click Ok.
    4. The next screen reads File name to copy image to. From the drop-down box pick either the external hard drive or internal drive (different from source drive) and then type a short name in the file name box.
    5. The next screen will ask compression options. I usually pick High.
    6. Ghost will image the drive on its own and alert you when it is done.
  12. If you are sure the image was created successfully, you can now move the image onto a burnable DVD, network share, leave it on the portable or secondary hard drive and restore it as necessary. If there was a problem during the imaging process, then do not boot the source system. Just reimage it after addressing whatever caused the image process to fail.

The steps above are a very quick summary so I recommend that anyone truly interested in doing this to head over to Vernalex’s site for an in-depth Sysprep Guide. Along with a lot more detail of the entire process, he has various tools to make everything a little easier. The best utility on his site has to be the Sysprep Driver Sanner tool. It makes the process of adding hardware drivers much easier than the manual process above. Instructions on using it are on his site.

This completes the imaging process. Part 3 includes miscellaneous notes.

Update (2.24.2006): I’ve gotten some great tips from both the comments at Digg and below. Let me address a few of those.

  • Once Sysprep shuts down the computer, if you are able hook up the drive to another system as a secondary device then delete pagefile.sys and hibernat.sys to save a few hundred megs of space in the final image. Thanks master_of_fm.
  • I forgot to go in-depth on the Ghost process. I’ve included basic steps for Ghost 2003 but once the intial Sysprep deployment is made, any disk imaging program can be used. The basic priciples are the same but let me know if you have problems. Thanks hakujin & definiteform.
  • billyboobs34 asked if it is possible to make an image that is totally hardware independant. The quick answer (to be best of my knowledge) is no. The problem hinges on the HAL (Hardware Abstraction Layer) in Windows XP being different on, for example, a uniprocessor and multiprocessor system. The Microsoft Knowledge Base article is linked above. If the HAL is not the problem then it sounds like there may be more of an issue of finding appropriate chipset and mass storage controller drivers for different motherboards. In the custom drivers section, adding in paths to the necessary drivers for other motherboards may mitigate this problem.

In my opinion, the best solution is to have one basic machine for each HAL to make all of your images from. Follow all the steps above but do not reseal the system. Drop down to Ghost (or whatever backup utility you are using) and create an image of the system. In the future, creating compatible images for newer machines would be as simple is restoring the almost-complete Sysprep image and adding in new drivers for the chipset, mass storage controller and anything else you need. Then resealing the system and imaging it for a viable deployment image. Again, I am not an expert so hopefully the Sysprep gurus can step in to address this one if I went wrong somewhere.

  • If you are presented a blue screen of death after restoring the Sysprep image to a target machine, then chances are that either the HAL is incompatible for the target machine, you forgot to build the mass storage driver section or you forgot to add a third-party mass storage driver. Refer to Microsoft KB309283 to confirm the source machine HAL is compatible with the target machine. Refer to Microsoft KB303786 if a Stop 0×7b blue screen is shown. This means that the mass storage driver section or third-party mass storage driver is missing.

Update (3.8.2006): If after rebooting, the install hangs at mup.sys or agp440.sys then it’s more than likely a HAL problem. Refer to the previous update to change your HAL. For most modern day single-processor machines make sure your HAL is changed from Uniprocessor ACPI to Advanced Configuration and Power Interface (ACPI) PC. You can find this setting in Control Panel -> System -> Hardware tab -> Device Manager -> click (+) next Computer -> right click the HAL shown and pick Update Driver -> Install from a list or specific location (Advanced) -> Don’t search. I will choose the driver to install. -> then pick the proper HAL -> hit next/okay until you finish. Now reboot and run through the Sysprep instructions again.

It took me a few tries to finally make an image that restored properly when I first started but, like riding a bike, it’s second nature now. Be ready to experience frustration but in the end it is worth having this knowledge. Again, read the comments below and at Digg to see how others have achieved this process. I don’t claim to be an expert (I’m just a med student by day) but I certainly hope this helps someone.