Sysprepping Windows 10 may fail after installing Microsoft Security Update KB4056892

After installing the security update KB4056892 from Microsoft to address the Meltdown and Spectre issues, you may experience a problem with Sysprep halting when creating a Windows 10 Fall Creators Update image for deployment. This article provides more information on the issue as well as steps to take to resolve it.

Sysprep halts when creating Windows 10 Fall Creators Update image

When creating a Windows 10 Fall Creators Update image for deployment, several Windows Store Apps (Figure 1) will be installed for the "current user" and will cause sysprep to halt as the apps are only provisioned for one user.

Figure 1: Example screenshot of Windows Store Apps from Start Menu

The issue with Sysprep halting only occurs after the Microsoft security update KB4056892 for the Meltdown/Spectre issue (Figure 2). The Sysprep process will not halt if the KB4056892 update has not been installed.

Figure 2: Microsoft KB4056892 update

Once the KB4056892 update is installed and Sysprep is run on the system, you will see the following error (Figure 3):

Figure 3: Sysprep error after KB4056892 update

Upon examining the setupact.log you, will find the following error for the first Appx that was encountered: "was installed for a user, but not provisioned for all users...This package will not function properly in the sysprep image" (Figure 4). Running Sysprep repeatedly will halt until all improperly provisioned Appx packages are removed.

Figure 4: Sysprep appx error

The setupact.log will show that some apps, such as those in the list below, removed successfully:

• SYSPRP Package microsoft.windowscommunicationsapps_17.8241.41275.0_x64__8wekyb3d8bbwe was removed
• SYSPRP Package Microsoft.Windows.Photos_2017.37071.16410.0_x64__8wekyb3d8bbwe was removed
• SYSPRP Package Microsoft.WindowsStore_11706.1002.9.0_x64__8wekyb3d8bbwe was removed
• SYSPRP Package Microsoft.WindowsCamera_2017.727.20.0_x64__8wekyb3d8bbwe was removed

If you still see the error in Sysprep, keep checking the setupact.log for the latest app to cause the halt and remove it manually in Windows PowerShell. You will need to open PowerShell as an Administrator (Figure 5) by clicking on Start and typing powershell in the search box, then right-click the menu entry that appears for PowerShell and choose to Run as administrator.

Figure 5: Open PowerShell as Administrator

Change the PowerShell script as shown in the examples below to include the apps that fail to be removed (Figure 6):

Figure 6: PowerShell app removal script

List of apps removed using above PowerShell script:

• SYSPRP Package 89006A2E.AutodeskSketchBook_1.7.0.0_x64__tf1gferkr813w
• SYSPRP Package A278AB0D.MarchofEmpires_2.9.2.1_x86__h6adky7gbf63m
• SYSPRP Package A278AB0D.DisneyMagicKingdoms_2.7.0.11_x86__h6adky7gbf63m
• SYSPRP Package Microsoft.BingNews_4.22.3254.0_x64__8wekyb3d8bbwe

NOTE: You may need to disable Internet Access briefly to prevent some of the applications from reinstalling.

Keep monitoring the setupact.log file until all of the halting apps are removed.

Appx Removal PowerShell Script:

Import‐Module AppX
Import‐Module Dism

PowerShell script for removing Microsoft Apps:
Get‐AppxPackage *Microsoft.3DBuilder* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.BingTranslator* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.FreshPaint* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.Getstarted* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.Messaging* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.MicrosoftOfficeHub* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.MicrosoftSolitaireCollection* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.NetworkSpeedTest* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.Office.OneNote* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.OneConnect* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.People* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.SkypeApp* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.MicrosoftStickyNotes* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.WindowsCalculator* | Remove‐AppxPackage
Get‐AppxPackage *microsoft.windowscommunicationsapps* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.WindowsFeedbackHub* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.WindowsMaps* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.XboxApp* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.XboxIdentityProvider* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.ZuneMusic* | Remove‐AppxPackage
Get‐AppxPackage *Microsoft.ZuneVideo* | Remove‐AppxPackage

PowerShell script for removing Sponsored Apps:

NOTE: You may have to manually uninstall some Sponsored Apps from the Start Menu. And some Sponsored Apps may need to be removed twice using the PowerShell script.

Get‐AppxPackage *Duolingo* | Remove‐AppxPackage
Get‐AppxPackage *EclipseManager* | Remove‐AppxPackage
Get‐AppxPackage *Flipboard* | Remove‐AppxPackage
Get‐AppxPackage *Wunderlist* | Remove‐AppxPackage
Get‐Appxpackage *autodesk* | Remove‐Appxpackage
Get‐Appxpackage *MarchofE* | Remove‐Appxpackage
Get‐Appxpackage *Disney* | Remove‐Appxpackage
Get‐Appxpackage *Bingnews* | Remove‐Appxpackage
Get‐Appxpackage *Disney* | Remove‐Appxpackage
Get‐Appxpackage *bubble* | Remove‐appxpackage
Get‐Appxpackage *soda* | Remove‐appxpackage
Get‐Appxpackage *Spotify* | Remove‐appxpackage
Get‐Appxpackage *Bingnews* | Remove‐Appxpackage