none
Audit Mode Shutdown RRS feed

  • Question

  • Hi

    If I shutdown a system in Audit mode it locks me out of that system. When it starts up again it says the "Administrator account is disabled" and it won't log in. I'm also unable to restart the system as I could on Windows 8.1 to resolve this.

    Wednesday, July 29, 2015 10:48 AM

Answers

  • We are also experiencing the same exact issue; has anyone found a resolution to this problem?   The only work around I found is to remove the battery to cut the power to the system.  After that, the unit will boot into audit mode OK.  However, I'm sure that isn't helping my hard drives health to be pulling the battery as they are running....
    Try the Feb 2016 1511 build. It should give you the power button on the lock screen in that build, allowing you restart the system even when the account is "locked out". After the restart it will auto-login to the admin account again.
    • Marked as answer by jason_chillyb Tuesday, June 21, 2016 10:36 AM
    Friday, April 1, 2016 1:47 PM

All replies

  • Deleted
    Wednesday, July 29, 2015 10:49 AM
  • I think this was something to do with "Fast Start" in the power settings.

    I remember I had to turn that off to get audit mode working properly.

    Not really an option when we're using Audit mode on hundreds of systems each day.

    Unless you know an automated method to Disable and Enable "Fast Start"?

    Update: - pulling power completely from the system and letting it discharge resets this and it boots on the next boot
    • Edited by jason_chillyb Wednesday, July 29, 2015 10:58 AM update
    Wednesday, July 29, 2015 10:51 AM
  • I posted about this in the (locked) Preview forums. The problem is the Restart option is missing from the Logon Screen in audit mode. So if the computer goes to sleep, you can't get back in without removing power to the system. If the system is a tablet without a removable battery, you're doomed.

    Wednesday, July 29, 2015 7:00 PM
  • Hi Jason and Tripredacus,

    I just got the Evaluation copy to test this with Virtual Machine.

    And It seems to be not available for me to press Ctrl + Shift + F3, so I just take use of the sysprep Tool listed at

    C:\Windows\System32\Sysprep,

    Only choose enter system audit mode at the system cleanup action part and restart on the shutdown options part.

    previously the built-in admin account is disabled.

    After the system restart, I was automatically logged on using the Administrator account:

    So, what the methods that you have been used to enter audit mode?

    Regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Thursday, July 30, 2015 2:58 AM
    Moderator
  • Ctrl + Shift + F3 does work but I actually deploy straight from a Windows Deployment Server into Audit mode using an autounattend file. It doesn't matter which method you use, same result.

    Once in Audit mode please click "Shutdown" and then start the system up again (without removing power) and you will get the same experience as us.

    Thursday, July 30, 2015 7:40 AM
  • So, what the methods that you have been used to enter audit mode?


    If you are in audit mode and the computer goes to sleep either due to default power setting, closing notebook lid, accident, etc... on resume the computer will be locked. Lock screen does not have the restart button and the account is disabled so you can't log in.

    I believe the default power setting for a mobile device (notebook) is set to put the computer to sleep after 15 or 30 minutes. This is part of the problem. The power button default option is to put the computer to sleep, so you can't hold power button either.

    If it happens on a notebook, you must remove power and battery. Then plug in again and when you turn on it will not be resuming from hibernate. It may give you the "improper shutdown" message but when it comes back up it will log in normally.

    If this happens on a mobile device where the battery is not removable, a person would have to wait until the battery fully dies in order to get the system to cold boot and be able to log back into Audit Mode or enter "BIOS" Setup.


    • Edited by Tripredacus Thursday, July 30, 2015 8:13 PM
    Thursday, July 30, 2015 8:12 PM
  • Well,

    Finally I got you guys point. And I received the message when sign-in with the built-in admin account:

    Your account has been disabled, please see your system administrator.

    What I should mention is that, when I click OK I could come to the screen below:

    There would be available to switch user, or click the power button to shutdown or restart.

    Further, I should mention that after the second sysprep /generalize /Auditmode /restart, the start menu won't work, and when I try to wake up the settings through the desktop right click ->personalization, the following error popped out:

    Regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Friday, July 31, 2015 8:30 AM
    Moderator
  • Well,

    Finally I got you guys point. And I received the message when sign-in with the built-in admin account:

    Your account has been disabled, please see your system administrator.

    What I should mention is that, when I click OK I could come to the screen below:

    There would be available to switch user, or click the power button to shutdown or restart.

    Further, I should mention that after the second sysprep /generalize /Auditmode /restart, the start menu won't work, and when I try to wake up the settings through the desktop right click ->personalization, the following error popped out:

    Regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Yes! Exactly that!

    Only difference is that I don't get that second page after clicking OK. I get the same page but the Bottom Left & Right elements aren't there. When I click Sign In i see them for a split second and they disappear again. Almost as if the GUI is bugging out and hiding them.

    Friday, July 31, 2015 8:41 AM
  • Same here. Got to the first screen with "Administrator" Your account is dissabled.... OK. No other icons or buttons, only OK. Pressing OK results short blink of some screen (maybe the next one with "sight in" button and other icons) and then return back to same screen.
    Friday, July 31, 2015 9:00 AM
  • Well jason, Tripredacus and MariusK,

    I will help to collect this at my side.

    Thank you for your sharing and patience.

    Regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Sunday, August 2, 2015 2:02 AM
    Moderator
  • An update. After adding ZDP.5 (KB3074663) to my images, I have a Restart button on the lock screen in Audit Mode.
    Friday, August 7, 2015 3:58 PM
  • An update. After adding ZDP.5 (KB3074663) to my images, I have a Restart button on the lock screen in Audit Mode.
    Agreed, the Lock Screen has it but it's the same situation if you shut down and then start it up again. There are no buttons on that screen.
    Friday, August 7, 2015 4:54 PM
  • Hmmm, same problem here except pulling main power does not get me back in. Must be fast boot bios feature. I have to do the unthinkable and hit reset button. Hope this something MS can fix along with the generalize audit start menu bug.

    P.S.  Posted this in partner forum, but they can't reproduce those problems.  It must be my environment they say ;-)


    • Edited by kthane Friday, August 7, 2015 9:52 PM spell
    Friday, August 7, 2015 9:46 PM
  • Up to KB3074683 now and still not seeing the Lock screen without the power/restart options like you describe.

    In relation to the Start Menu not working, also the Bluetooth menus do not work either.


    • Edited by Tripredacus Wednesday, August 12, 2015 4:33 PM
    Monday, August 10, 2015 3:49 PM
  • Don't think the problem is lock screen is missing anything, the problem the way I see it is there is no lock screen.  Once you click okay, it tries immediately to log in as administrator and fails again, you hit okay and it immediately tries to log in again and fails and so on forever and ever...
    Monday, August 10, 2015 3:56 PM
  • OK wait, I think there are two issues here.

    1. In RTM release of Windows 10, there was no restart/power option on the Lock Screen as there was in Windows 7-8.1. This is required for Audit Mode because of the next point:

    2. When you put the computer to sleep, while in Audit Mode, when you wake you can't log in.

    EDIT: I'm seeing different behaviour using different models of notebook. On one, it works as I described, yes the shutdown puts the computer to sleep, but upon wake I get the restart option. On another, I get what kthane and others are reporting, where you don't get the option to get to the buttons, which do flash in the background.

    I will do some real testing on this and get back with results if it hasn't been solved by then.

    • Edited by Tripredacus Monday, August 10, 2015 6:31 PM did testing.
    Monday, August 10, 2015 4:53 PM
  • Update: I have tested on 3 systems so far and found 3 different experiences.

    However in all 3, this command is a workaround.

    powercfg -h off

    That command disabled hibernation. It does not solve the issue with the 2 locks screens overlapping each other!

    I can provide full details of my testing if needed.

    Monday, August 10, 2015 9:06 PM
  • Good to know - I can try disabling Hibernate during Audit Mode and then Re-enabling it when the system is Sysprep'd. I'll report back what I find :)
    Tuesday, August 11, 2015 7:44 AM
  • I think this might be a workaround:

        <settings pass="auditSystem">
            <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                <AutoLogon>
                    <Password />
                    <Username>Administrator</Username>
                    <Enabled>true</Enabled>
                </AutoLogon>
                <UserAccounts>
                    <AdministratorPassword>
                        <Value>QQBkAG0AaQBuAGkAcwB0AHIAYQB0AG8AcgBQAGEAcwBzAHcAbwByAGQA</Value>
                        <PlainText>false</PlainText>
                    </AdministratorPassword>
                </UserAccounts>
            </component>
        </settings>
    Enables the administrator account with a blank password. After a shutdown and bootup sysprep isn't started but after a reboot it's there again (and you can of course start it manually)

    Tuesday, August 11, 2015 2:23 PM
  • Workaround is not valid for those who are OEM/System Builder. The built-in Administrator account is not allowed to be enabled.
    Tuesday, August 11, 2015 2:47 PM
  • Yeah I would need to know the impact to the end user.

    i.e. if it's notable after Sysprep to OOBE mode that this has been done it will cause issues

    Tuesday, August 11, 2015 3:30 PM
  • Sysprep/OOBE takes care of it. In my test setup the Administrator account was disabled after running sysprep and going through OOBE.
    Wednesday, August 12, 2015 6:38 AM
  • HI just wanted to mention that had gone into safe mode to do a scan and I noticed when I restarted my windows 10 desktop it immediately went to the same administrator account as shown above with the message your administrator has been disabled.  Please contact your system administrator.  I was just wondering can I keep pushing the ok button on the administrator lock screen.  The administrator lock screen never has any icons in the right of he screen at all.  Is their anything I can do to get pass this screen or even get my desktop to start my usb drive automatically.  Thanks any help appreciated.

    Windows 10 home

    64 bit operating system

    Thanks everyone

    Friday, March 4, 2016 6:17 AM
  • Your issue is unrelated to this thread.

    Create a new topic about it if you still have this issue.

    Friday, March 4, 2016 10:09 PM
  • We are also experiencing the same exact issue; has anyone found a resolution to this problem?   The only work around I found is to remove the battery to cut the power to the system.  After that, the unit will boot into audit mode OK.  However, I'm sure that isn't helping my hard drives health to be pulling the battery as they are running....
    Friday, April 1, 2016 1:24 PM
  • We are also experiencing the same exact issue; has anyone found a resolution to this problem?   The only work around I found is to remove the battery to cut the power to the system.  After that, the unit will boot into audit mode OK.  However, I'm sure that isn't helping my hard drives health to be pulling the battery as they are running....
    Try the Feb 2016 1511 build. It should give you the power button on the lock screen in that build, allowing you restart the system even when the account is "locked out". After the restart it will auto-login to the admin account again.
    • Marked as answer by jason_chillyb Tuesday, June 21, 2016 10:36 AM
    Friday, April 1, 2016 1:47 PM
  • Yes, no problem with 10586/1511 build.

    Also concerning removing battery. If on a notebook, leave AC in, remove battery then remove AC. It is safer to remove power to the system by the power cord than the battery. YMMV.

    Friday, April 1, 2016 7:06 PM
  • The solution for me was to disable fast boot in the BIOS (setup).  Nothing else worked. 
    Tuesday, May 31, 2016 3:02 PM
  • This is an old thread but I just experienced this and noticed there isn't a definite answer.

    Boot into winpe environment. Run regedit. navigate to HKLM\System\Setup\

    on the right edit the RestartSetup entry and set it to 1.

    Shutdown winpe. remove usb stick or dvd. start system.

    Saturday, June 18, 2016 3:43 PM
  • I should have set this as answered ages ago. Ever since the Feb build of Windows 10 1511 the lock screen has had the required buttons. This includes the April build as well. Both builds are available on MSDN.

    What does the "RestartSetup" registry Entry actually do?

    Tuesday, June 21, 2016 10:37 AM
  • I am using  the 1511 build from April and when I get the lock out message it has an OK button. I am not seeing a power button on the screen just the OK button and the message that I am locked out. At that point I hit the physical power button on my reference box and the system immediately shuts down as if it were in the BIOS. Next I insert the winpe usb and boot to it and use regedit as above. When I reboot into the image it logs in automatically and prompts me with the sysprep UI. I cancel that and continue to make changes in the default Administrator profile as needed.

    Alternatively - sometimes after that power off I can just restart the system and it boots into Windows and start the sysprep UI.

    Wednesday, June 22, 2016 3:10 PM
  • What worked for me is turning off POP (password on power) in Bios, which was by default set to require a password after a shutdown (not after restart, that was off). This is a Lenovo I was having the problem with, but has everything to do with a BIOS setting which is what people have been alluding to with saying turning off fast boot worked for them.
    Thursday, July 14, 2016 4:28 PM
  • I have one system here where the hybrid shutdown was used. The restart or power buttons were not available. I had to reset the system.
    Friday, July 15, 2016 6:55 PM
  • Hi,

    One year after, here is my contribution.

    I've been working on a vm in audit mode. After several manipulations and a mistake I guess, I 've been kicked out at the Logon Screen : Administrator Disabled, and none of the previous solutions seen here worked.

    So, at start up, I entered Setup (F8) and selected the command line console. Once log in, I wrote sysprep /audit, and that was it.

    If this could help...

    Bye

    Sunday, October 9, 2016 9:12 PM
  • From the account disabled screen click on the power button icon to shut down while holding the shift key, click Shutdown.  This will do a full shutdown instead of a hybrid shutdown.

    https://support.microsoft.com/en-us/help/3141410/your-account-has-been-disabled-message-after-you-turn-off-a-windows-10


    Wednesday, March 20, 2019 8:41 PM