This week I’ve been making the final updates to the reference image for laptops to the library’s educational program involving Minecraft and other games for kids. However after laying in the last set of Windows updates and other applications, Sysprep failed and logged the error Package was installed for a user, but not provisioned for all users.

From the error log, it appeared that a Store app was causing a blocking failure. This was odd, because I hadn’t once launched the Store nor side-loaded any apps. Further, all the work was done on the builtin account with which the Store cannot even be used.

Sample Sysprep Log: C:\Windows\System32\Sysprep\Panther\setuperr.log

2015-10-14 16:01:20, Error SYSPRP Package Microsoft.Internal.Media.PlayReadyClient_2.3.1678.1_x64__8wekyb3d8bbwe was installed for a user, but not provisioned for all users. This package will not function properly in the sysprep image.
2015-10-14 16:01:20, Error SYSPRP Failed to remove apps for the current user: 0x80073cf2.
2015-10-14 16:01:20, Error SYSPRP Exit code of RemoveAllApps thread was 0x3cf2.
2015-10-14 16:01:20, Error [0x0f0082] SYSPRP ActionPlatform::LaunchModule: Failure occurred while executing 'SysprepGeneralize' from C:\Windows\System32\AppxSysprep.dll; dwRet = 0x3cf2
2015-10-14 16:01:20, Error SYSPRP ActionPlatform::ExecuteAction: Error in executing action; dwRet = 0x3cf2
2015-10-14 16:01:20, Error SYSPRP ActionPlatform::ExecuteActionList: Error in execute actions; dwRet = 0x3cf2
2015-10-14 16:01:20, Error SYSPRP SysprepSession::Execute: Error in executing actions from C:\Windows\System32\Sysprep\ActionFiles\Generalize.xml; dwRet = 0x3cf2
2015-10-14 16:01:20, Error SYSPRP RunPlatformActions:Failed while executing SysprepSession actions; dwRet = 0x3cf2
2015-10-14 16:01:20, Error [0x0f0070] SYSPRP RunExternalDlls:An error occurred while running registry sysprep DLLs, halting sysprep execution. dwRet = 0x3cf2
2015-10-14 16:01:20, Error [0x0f00a8] SYSPRP WinMain:Hit failure while processing sysprep generalize internal providers; hr = 0x80073cf2

In my investigation I poked around at the apps registered to both the local user as well as those staged in the system. The app that was causing the failure was found in both. However, simply removing the app with Remove-AppxPackage -Package NAME wasn’t sufficient to resolve the error as the package also showed in the provisioned list as ‘staged’. Strangely, it was showing as owned by unknown user S-1-5-18, also known as SYSTEM.

So how did this happen? How did SYSTEM wind up with apps installed and why are they preventing use of Sysprep? From my understanding, Windows Update is to blame. According to a little post on StackOverflow, which was also the only useful information I found on this error, Windows Update will pre-stage updates for any installed apps. These staged apps however are different from apps that are installed or side-loaded. These are simply updates to existing apps pre-downloaded so that when the user elects to install an update the experience is as fast as possible. When staged in this manner, the app is registered to SYSTEM.

Fortunately, getting the app out turned out pretty easy. The same post at StackOverflow offers a command with psexec to run Get-AppxPackage | Remove-AppxPackage under the SYSTEM account. Personally, I elected to use Task Scheduler to accomplish the same effect by creating a task without a trigger. This also gave me the ability to easily run the command again later before attempting to capture again after future updates.

The fix didn’t stop here, however, as Sysprep continued to fail. I got the staged app out but it and several other apps with updates from their side-loaded state were applied to the builtin admin. Running the same command, Get-AppxPackage | Remove-AppxPackage in the local user context removed the apps and allowed Sysprep to complete but after deploying the image explorer.exe would crash once on first logon. I ended up reverting the capture and destroying/recreating the builtin admin profile before retrying Sysprep again. This method worked without issue.

As a recap:
Run Get-AppxPackage | Remove-AppxPackage in context of SYSTEM.
Remove any existing profiles, including the builtin admin profile. You may need to temporarily create a second account to do this with.