You could do that. Personally, I don't allow my "build" task sequences to capture an image. I deploy the "bare" OS from source files and go through the patching process (which should include any reboots required for installation of said
patches). After the machine is fully patched, I shutdown and snapshot the VM.
There are plenty of folks who go through the full process when building an image - deploy bare OS, patch, layer applications, sysprep and capture image, all within a single TS. I find that process to be too unwieldy considering some of the legacy apps I
need to install, which require a certain level of TLC.
I've never had need to boot into Audit Mode, so I can't speak to that. I have what I've always called "hybrid" images, which are about 80% thick and 20% thin, i.e. most of my apps are installed on the image itself; some of them are installed at
the time of deployment.
Keep in mind what we're talking about is a Base OS image with all applicable Windows Updates. You would typically deploy that Base OS image in order to build a custom image that will be deployed to end-use devices.
Example:
1. Deploy from source files, patch fully, shutdown and take snapshot.
2. Boot up from snapshot and run sysprep and capture TS to capture an image.
3. Deploy Base OS image to a new VM, install applications (manually or, preferably, with MDT), patch, capture customized (Thick/Hybrid) image.4. Deploy customized (thick/hybrid) image.
You can just as easily leave step 2 as a VM snapshot and not actually capture the image. I simply like having the WIM file in case of <insert scenario here>.
If you are concerned about leaving an end-user device with the Administrator logged on, you can add a logoff or reboot finish action to your rules file. (CustomSettings.ini.) Search the MDT documentation for "Property Definitions" to get a list of
all the thing you can set with the rules file, such as skipping Wizard panes and setting finish actions.
-Nick O.
