SYSPREP Unattend file [C:\Windows\Panther\unattend.xml] has already been processed.

Hi Ralf Geglin,

Thanks for bringing this up. The error you're encountering:

UnattendFindAnswerFile: Unattend file [C:\Windows\Panther\unattend.xml] has already been processed

typically means that Sysprep has already run on this system, and Windows is blocking a second execution using the same unattend.xml file. This is often triggered by certain agents or software installations that modify system state in ways that conflict with Sysprep.

Why It Happens

When Sysprep runs, it logs its activity and marks the system as processed. If the unattend.xml file is reused without resetting the system state, Sysprep will refuse to run again. Some third-party agents (monitoring tools, antivirus, domain join scripts, etc.) can also leave traces that interfere with Sysprep.

1. How to Fix It Here are steps you can take to resolve the issue:
   • Delete Sysprep History
   Navigate to: C:\Windows\System32\Sysprep\Panther
   • Delete or rename the following files:
   setupact.log setuperr.log
   • unattend.xml (if present)
   • Clean Registry Entries
   Open Registry Editor (regedit) Go to: HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus Set CleanupState to 2
   • Set GeneralizationState to 7
   • Remove Problematic Agents
   Some agents (e.g., SCCM, antivirus, backup tools) can prevent Sysprep from completing.
   • Try running Sysprep before installing these agents, or use a post-deployment script to install them after imaging.
   • Use Audit Mode (Optional)
   • Boot into Audit Mode before installing agents:

      C:\Windows\System32\Sysprep\Sysprep.exe /audit /reboot
   

   • Install your agents
   • Then run Sysprep with generalize and shutdown:

           Sysprep.exe /generalize /oobe /shutdown /unattend:C:\Path\To\unattend.xml
           
     

                                                ```
     

I hope my answer is useful for you.

Best regards,

Quinnie Quoc.