Select Page
This entry has been published on 2017-11-22 and may be out of date.

Last Updated on 2017-11-22.

[:en]Just tried to sysprep a Windows 10 image which had been upgraded from 1703 to 1709.

In general, sysprep does not like Win10’s modern apps. It tries to remove most of them, but this does not always succeed.

After the first try, %windir%\system32\sysprep\panther setupact.log and setuperr.log show:

package xxxx was installed for a user but not provisioned for all users

This is quite simple to solve. Remove unneeded apps e.g. with this command:

$apps = (Get-AppxPackage -AllUsers | where-object {$ –notlike "*store*" -And $ -notlike "*calc*" -And $ -notlike "*photos*" } ).name
foreach ($app in $apps) {
   Get-AppxPackage -Name $app -AllUsers | Remove-AppxPackage -AllUsers

The second issue I’d like to describe seems to be very rare and might only happen on Win10 machines which were upgraded multiple times (or other unknown reasons).

In my special case, “Get-AppxPackage -AllUsers” showed two different versions of Microsoft.WindowsAlarms. Sysprep tries to delete both versions but can’t, because the older version does not really exist any more. It exits with an error, leaving your VM half-sysprep’d, so absolutely make snapshots after every single step!

Setuperr.log shows:

… sysprep could not remove staged package … (0x80070002) – FileNotFoundException

Unfortunately, it does not tell us what file is exactly missing. Testing with Process Monitor, it seems to be a registry entry, but creating it manually does not help.

Anyway, we have to get rid of the app’s old versioned duplicated entry for sysprep to succeed, so we need to edit the Appx SQLite DB.

This post on SU shows a very good explanation of how you can access the database.

In short, you need 2 applications (both have portable versions):

(Instead of ProcessHacker, you can also use PsTools (psexec) to start DB Browser as system user: psexec -i -s -d cmd)


  1. Open ProcessHacker as Admin
  2. Select one of the vshost.exe processes -> Misc -> Run as this user
  3. Choose DB Browser’s .exe file
  4. Open file with DB Browser: C:\ProgramData\Microsoft\Windows\AppRepository\StateRepository-Machine.srd
  5. Open tab “Brows data”, then select table Package
  6. Look for the apps to be removed, then delete the whole line(s) (button)
  7. Finally, let DB Browser write the changes to the file

To see if it worked, test it e.g. by calling

Get-AppxPackage -AllUsers *alarm*

If it worked (i.e. if the old version does not show up any more), run sysprep again and it should work -> system will finally shut down.


Update 2018-12: Solving Sysprep Error 0x80070003

The Panther setupact.log might come up with this error if you upgraded from a previous version.

See the following registry edit script:

Windows Registry Editor Version 5.00



; Adapt following key to the one actually present in your registry
[-HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on 8/16/2015 11:36:09)]
; Maybe more... (all of those keys will and should be deleted)
[-HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on 8/16/2017 11:36:09)]
[-HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on 8/16/2018 11:36:09)]

Run it on the machine where you run sysprep afterwards.