auditUser (Standard 7 SP1)


The auditUser pass processes Image Builder unattended settings in user context in audit mode. The auditUser pass runs after the auditSystem pass that is used to apply settings in system context.

Typically, auditUser is used to execute RunSynchronous or RunAsynchronous commands. These commands are used to run scripts, applications, or other executables during audit mode.

Audit mode enables OEMs and corporations to install additional device drivers, applications, and other updates. When Windows Embedded Standard 7 starts in audit mode, the auditSystem and auditUser settings for Image Builder in unattended mode are processed.

By using audit mode, you can maintain fewer Standard 7 images, because you can create a reference image with a minimal set of drivers. The image can be updated with additional drivers during audit mode. You can then test and resolve any issues related to malfunctioning or incorrectly installed devices on the Standard 7 image.

The following illustration shows the audit mode process.


auditUser runs only when you configure Image Builder to start in audit mode. You can start in audit mode by using sysprep /audit, or sysprep /generalize /audit. For more information, see Standard 7 Packages Technical Reference.

Audit mode is optional.