Identify systems cloned with the Sysprep utility

Systems cloned with the Sysprep utility can experience specific problems. You
can check the following to determine if a Windows 2000 / XP installation was
created using Sysprep:


  • Sysprep places the date and time the image was prepared for duplication in
    the key HKEY_LOCAL_MACHINE\System\Setup\CloneTag.
  • Look in the HKEY_LOCAL_MACHINE\System\Setup registry
    key for a cmdline that reads Setup -newsetup -mini.
    This places GUI-mode Setup in the Mini-wizard phase.
  • Check for an HKEY_LOCAL_MACHINE\System\SetupOemDuplicatorString value. This
    is added using an answer file (Sysprep.inf) for the Mini-Setup Wizard.
  • Check for the existence of Setupcl.exe. This is the file that changes the
    Security IDs (SIDs) on the system. Look in the %SystemRoot%\System32 folder for
    this file.
For NT

  • Sysprep places the date and time the image was prepared for duplication in
    the key HKEY_LOCAL_MACHINE\System\Setup\CloneTag.
  • Check for the existence of Setupcl.exe. This is the file that changes the
    Security IDs (SIDs) on the system. Look in the %SystemRoot%\System32 folder for
    this file.

Leave a Comment

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top