Audit mode is a special Windows setup mode used by PC manufacturers, IT administrators, and professionals to configure the operating system before the initial user setup. In simple terms, Audit mode lets you configure and customize Windows directly using the built-in administrator account, bypassing the usual setup process.
For instance, when you purchase a new laptop or a pre-built PC and turn it on for the first time, you might have noticed that you are taken directly to the user setup process. Once you are done with that and log in, you will find that all the drivers, additional software, and system settings are pre-configured. This pre-configuration is typically done in Audit mode.
If you are deploying Windows on multiple PCs or simply want to configure your OS before full setup, you can use the Audit mode to get it done. In this tutorial, we’ll show steps to boot into Audit mode and how to exit it. Let’s get started.
Note: The below steps are tested to work on Windows 10 & 11.
Caution: You should always use Audit mode to configure and customize Windows before the usual initial setup process. Using Audit mode on a system that’s already been set up with user accounts can lead to unintended consequences. These might include potential impact on existing user accounts and needing to repeat the setup process.
Steps to Enter Audit Mode on Windows 10 & 11
To boot into Audit mode on Windows 10 and 11, follow the below steps:
First, insert the Windows 10/11 bootable USB drive and start the installation process as you would normally.
Once you see the Region selection screen, press the Ctrl + Shift + F3 shortcut on your keyboard. This action interrupts the setup process and takes you to the audit mode screen.
This action interrupts the setup process, reboots your computer automatically into Audit mode, and signs you in with the built-in administrator account. Once logged in, you will see the System Preparation Tool window on the desktop.
Keep that window aside and configure & customize the OS however you want. For instance, you can install drivers, essential software, etc. Since you can connect to the internet, you can download the software and drivers directory.
It is important to note that any changes made while in Audit mode are generally system-wide and will affect all user profiles created later. So, depending on your deployment requirements, be specific with changes and keep system stability and security in mind.
How to Exit Audit Mode
Once you are done with configuring and customizing Windows, you can exit the Audit mode. To do that, follow the below steps:
First, find the System Preparation Tool window. If you closed it accidentally, you can reopen it by double-clicking on the sysprep.exe file in the C:\Windows\System32\Sysprep folder.
Now, select Enter System Out-of-Box Experience (OOBE) from the System Cleanup Action dropdown, and Shutdown from the Shutdown Options dropdown.
Note: If you want to reboot and start the user setup process immediately, select Reboot from the Shutdown Options dropdown.
If you are deploying this image on multiple PCs, select the Generalize checkbox. You can learn more about this option in the below section.
Click OK to save changes and shutdown.
That’s it, the next user who turns on the PC/laptop will be taken directly to the user setup screen. They can follow the on-screen instructions to set up their user account and start using the computer.
What Does the Generalize Option Do?
So, what does selecting the Generalize checkbox do? It generalizes all the changes so that you can copy, move, and deploy the Windows image across multiple computers. This option is ideal when you want a standardized system image for multiple deployments.
For instance, it resets the SID (Security Identifier) so that the OS can generate new and unique SIDs when creating user accounts, removes drivers and settings specific to the original hardware it’s configured on so that the OS can be installed on other hardware, resets the activation status, and removed system-specific information such file history, hardware info, user profiles, etc.
If you are not deploying the image across multiple systems, you don’t have to use the Generalize option.
Important note: The Generalize option is irreversible. Once you have generalized a Windows installation and shut down the system, you cannot undo the changes made to the image by Sysprep. When you start the computer again, it will boot into the OOBE (Out-of-Box Experience) as if Windows was freshly installed, ready for a new setup.
And there you have it! I hope this tutorial helped understand what the Audit mode is, how to boot into it, and how to exit it properly.
