Sysprep SkipRearm = 1

Question

Hi,
MY CURRENT SITUATION: I have setup a reference machine running Windows 7 with all drivers and software installed and configured correctly.
I then Sysprep my reference PC (I have previous experience of Sysprep in Windows 2000 and XP environments) and have created a unattended answer file in System Image Manager (SIM) and run the following command:
sysprep /generalize /oobe /shutdown /unattend:e:\sysprep.xml
The system goes through the Sysprep process and shuts down. I then boot into Symantec Ghost 11.5 and take an image of the machine which I can then GhostCast my other PCs. On the first boot the machines go through the Sysprep process and only asks
for a PC name to be entered, which is just what I wanted.
NOW THE PROBLEM: I can only run Sysprep on the reference machine 3 times and this is a big problem. However if I alter the unattended answer file and add
SkipRearm=1 to the generalize section I can Sysprep the machine as many times as I like.
MY QUESTION: What does this SkipRearm setting do? What consequences will it have? Will I have more problems later?
Thanks for looking!
Best wishes,
Matt Courtman, UK

Answer 1

SkipRearm prevents the device SID from changing when the system reboots. It also prevents the rearm counter from decreasing.
In general you can image a bunch of machines with the same SID but it can cause problems where the machine SID (basically a serial number intended to uniquely identify a computer) is used to authorize access to something from Active Directory.
I believe it works like this: you install access to some service in Active Directory for machine #1, but because it is sharing the same machine SID with a bunch of other machines, you've now also inadvertently given all those machines access to the same
resource whether you wanted them to all have access or not.
Also if you routinely image all machines with SkipRearm enabled, and then you eventually switch from MAK to KMS down the road, when computers with the same SID try to register with KMS, the licensing server sees all registration attempts as coming from a
single source, so 50 machines with the same SID look like 1 machine to KMS.
Since you need at least 25 individual computers to get KMS to work correctly, all these machines won't go towards that activation count, unless you in-place re-sysprep them with SkipRearm disabled to give them unique SIDs. (Yeah, I learned this the hard
way..)
You don't ever need to mess with enabling skiprearm if you use KMS activation. Using the generic KMS client activation keys, the rearm count changes from 5 or 4 or whatever to 1. After sysprep it goes down to zero, but when the KMS client sees the KMS server
after rebooting and setting up again, it will join and the rearm count jumps back up to 1 again.
The rearm count jumping around with KMS client keys is poorly documented and not really explained anywhere, and I only figured it out after repeatedly doing slmgr /dlv while switching from MAK to KMS, and rechecking it again before and after activation after
sysprepping in KMS with skiprearm disabled.
In essence by buying into Microsoft Volume Licensing with KMS, you get the ability to use Vista, 7, 8, etc as if they were like XP, allowing unlimited syspreps and re-re-re-re-imaging.
For the people who say "build a clean image every time", yeah sure whatever guys. Like I have a day or more to kill waiting for the Windows 7 2010 RTM to download and install 2 gigabytes of Windows/Microsoft updates from the last five years and
reboot itself 20 times to apply all those updates, every time I just want to change a few things in the deployment image.
It's FAR simpler to just load up the source image every couple months, update Adobe Reader, Flash, Firefox, Chrome, Java, and apply the next 50 new Windows updates in the last 6 months, then resysprep it, and upload it back to WDS again. This takes about
1/10th the time vs building the source image from scratch every time.
The whole Microsoft reasoning behind the 5 rearm count is apparently just to create grief for the people who try to steal Windows, and use the same image to move Windows from one computer to the next.
Use of skiprearm to apply updates to a source image that you keep reusing as a Master Image and hold it forever at rearm 3 or so, is sort of an obscure back door thing which nobody is really supposed to be doing, and seems the reasoning that the official
line from Microsoft employees is to try to cajole you into "making a clean image every time".
This is also apparently why skiprearm is a poorly documented option buried in the special XML options for sysprep, is not directly a command line switch for sysprep itself, and why actually learning about it has to come from the forums and people like me
who've suffered through it the last 5 years, rather than the actual product documentation.
And here I am with a storebought Lenovo ThinkPad which came with Windows 7 Professional Retail preinstalled and a rearm count of 2. I simply want to make a backup copy of it to WDS so that if it crashes and burns I can quickly get it up and running again.
WDS deduplicates all the files in images, so it's very efficient to upload a backup of it into WDS, but I cannot do the WDS image upload unless it has been sysprepped, and I don't want to burn up those 2 remaining rearms.
So it seems that creating a tiny XML with skiprearm in it so I can temporarily sysprep and upload it, seems my only option.
(Thanks for making this process annoyingly difficult just to try to make life miserable for pirates, Microsoft.)