What is Audit Mode in Windows 10? How to boot into or out of Audit Mode?

Have you ever wondered how OEMs deploy the Windows 10 operating system with their own set of apps and drivers? Or how does the recovery partition help you reinstall everything as if the computer were brand new? It is possible because of a particular mode of Windows 10 called Audit mode. Audio mode allows OEMs to preconfigure a system image, bundle their software, and then deploy it to thousands of their computers. In this article, we will discover the audit mode, the advantages and how to start or start in audio mode.

What is Windows 10 audit mode?

There are two modes that Windows can choose to start –

1. OOBE and
2. Audit mode.

The OOBE or Out-of-box experience is the default mode that allows consumers to configure Windows on a new machine or when they choose to reset Windows 10.

The audit mode, as I said earlier, allows OEMs to deploy a system image consisting of a package of drivers, applications, computer-specific updates that are required or scheduled for be deployed during installation. Although there are more things involved which briefly explain the need for Audit mode. Let’s see the advantages of audio mode.

Bypass OOBE

There is neither home screen nor configuration screen. It lets you get started on the desktop using the built-in administrator account and configure things. So you don’t need to create an account at all.

Install applications, add device drivers, and run scripts

This is the main objective of using Audit mode. Use a default image, and then customize it to suit your business needs. You can also install additional language packs and device drivers. It is also called auditSystem configuration successful process.

Test the validity of a Windows installation.

After configuration is complete, you can test the behavior of the configuration process when the end user starts using the OOBE. It is also called auditUser configuration pass.

Add more customizations to a reference image

It is obvious that once you have completed a successful audit process and everything works as expected, the same image can be deployed on multiple computers. Otherwise, you can restart in Audit mode to configure on per device per se. Often the changes are due to the device or at the request of the consumer.

How to start or exit audit mode in Windows 10

Microsoft offers a response file Unattend.xml. It is an XML file that contains the parameter definitions and values ​​to be used during Windows installation. The file can be created using Windows System Image Manager. It is only when the Windows 10 installer deposits this file that it starts in audio mode, otherwise it will start in OOBE mode by default. Use one of the following methods to start in Audit mode.

Start in audit mode in Windows 10 (automatically or manually)

• Add the Microsoft-Windows deployment | Reseal | Mode = audit response file parameter.
• Keyboard shortcut: on the OOBE screen, press CTRL+OFFSET+F3.

When the computer restarts in Audit mode, system preparation (Sysprep) will appear. The only drawback to using the keyboard shortcut is that it does not bypass all parts of the OOBE process. This includes running scripts and applying the response file settings in the oobeSystem configuration pass.

Start in audit mode using an image configured to start in OOBE

You can use the keyboard shortcut or mount the image and add the response file with the audit setting, save it as:

C:testofflineWindowsPantherUnattendUnattend.xml.

Start in audit mode automatically from an existing image

Create a new response file and add Microsoft-Windows deployment | Reseal | Mode = audit. Save the file as Unattend.xml.

At an elevated command prompt, run the command:

Dism /Mount-Image /ImageFile:C:testimagesMyImage.wim /index: /MountDir:C:testoffline

the image_index is the number of the image selected in the .wim file.

Just like in the step above, copy the new answer file to this folder:

C:testofflineWindowsPantherUnattend

Finalize the modifications using the DISM tool. Use the following command:

Dism /Unmount-Image /MountDir:C:testoffline /commit

How do you get started in audit mode in Windows 10?

You can delete the Unattend.xml file, then validate using the DISM tool or simply add the Microsoft-Windows deployment | Reseal | Fashion = oobe response file parameter.

Audit mode is not intended for consumers in general. This is for OEMs or IT departments who need to apply the image with the same settings, drivers and applications to multiple computers.

I hope the message was easy to follow and that you were able to start or exit audit mode in Windows 10.