Original Article… http://www.blogit.nu/content-15.html
A while ago I was trying to work out how to change the preferences for sysprep outside the Vmware wizard so that I could put more complex items in there, the following explains the customisation process:
I was under the impression that the virtual center customisation part of the cloning process was done using Microsoft’s sysprep utility. My impression was correct with one exception … configuring the IP settings of the network cards.
On a thread there was an instance of whenever a client clone a virtual machine and tell it to join to the domain it fails ..!!
Having a look on the community it turns out that in order to make this work you need to have DHCP enabled on your network which was not the case for this client.
While most companies probably have DHCP enabled, I could not believe that vmware would make an assumption like this,
so I decided to dig a bit deeper and find out how it really works.
You may have already looked in the %program files%\Vmware\Virtual Center\Scripts directory, what you will find there are a bunch of visual basic scripts, when you open them they are encrypted using the vbscript encoder.
I decrypted the scripts, and here are my findings:
At a high level, the customisation process is as following:
Before the actual cloning of the disks start, Virtual Center will call the autoprep.wsf script. The first time it runs, it runs in a probe only mode. In Probe only mode it will validate the steps (which I will describe later) but it does not commit it any changes and deletes the files generated at the end of the process. When the validation passed succesully it will start cloning the disks and when this process is finished it will re-call the autoprep.wsf script:
- re-creates the neccesary files (sysprep,inf, cmdlines.txt, …)
- mounts the new disk
- assigns a drive letter to the mounted disk
- copies all files to the new disk
- dismount the disk
- and powers on the new virtual machine for the first time
What happens next depends (I will explain later) but either way eventually it will start the sysprep mini wizard. The mini-wizard will use the sysprep.inf as the answer file and if you have requested a join to domain (vmware will use the sysprep.inf file to do this), the mini-wizard will join the new Virtual Machine to the domain or .. at least it tries. As I initially expected vmware does not use the sysprep.inf file to set the static IP addresses for the NICs, so unless you have DHCP enabled the join will fail. After you clicked the error away, the mini-wizard will continue and executes the commands specified in the cmdlines.txt, it reboots virtual machine, and runs its final script to set the IP address information for each NIC!!
The process the described above counts for windows XP and Windows 2003, for Windows 2000 it does not use the sysprep.inf file to join it to the domain, instead it running an extra script joindom.bat but either way it runs it before setting the IP addresses.
Now that we have a high level overview of the process let’s have a look at the scripts and see if we can alter the process so the customization will even work for an environment where DHCP is not allowed.
As I have mentioned above at some point in the process, Virtual Center calls the autprep.wsf script to start the its customization and as I explained, it will first validate the parameters given and next it will prepare the Windows system. This is the part where it all happens:
- It will generate a custom sysprep.inf, cmdlines.txt, setnet.cmd (used to call the setnet.wsf in order to set the IP configuration on the NICs), ..
- Next In order to start the sysprep mini-wizards it has to copy some files and modify the registry so the virtual machine will boot the mini-wizard.
To do this, there are two different approaches possible (I do not really know which one is used in what situation).
- The first approach it editing the registry by mounting the hives of the image.
- The other approach is using a trojan horse vmprep.exe.
In the last option the %systemroot%\autochk.exe will be renamed to vmprep.cfg and copy their own %systemroot%\vmprep.exe to autochk.exe, next they will mark the image volume as dirty to make sure on its first boot the autochk.exe will get executed. This provides the process the chance to make whatever modification on the new system, more specific it will read the vmprep.dat which describes what actions it should execute, by default:
- reset the NIC to DHCP
- process the %systemroot%\minisetup.inf file for the registry modifications required for sysprep.
- reboot the virtual machine
- Next it will mount the image as a disk volume and assign it a drive letter
- Then it will copy the following files to the new disk:
- vmprep.exe – driveletter:\Windows\System32\autochk.exe
- vmprep.dat – driveletter:\Windows\system32
- minisetup.inf – driveletter:\Windows
- vmprep.exe – driveletter:\Windows\system32
- setupcl.exe – driveletter:\Windows\System32
- setnet.wsf – driveletter:\Windows\vmware_imc
- imc_final.bat – driveletter:\Windows
- bootrun.exe – driveletter:\Windows\vmware_imc
- setnet.bat – driveletter:\Windows\vmware_imc
- sysprep.inf – driveletter:\Sysprep
- cmdlines.txt – driveletter:\Sysprep\i386\$oem$
- setguestinfo.wsf – driveletter:\Windows\vmware_imc
- Power on the Virtual machine
While this process can work perfectly, it does not work if you do not allow DHCP and you have specified that you would like to join the vm to the domain, because it uses the sysprep to join the vm domain, but it only sets the IP Addresses as a post action (setnet.cmd) when the new virtual machine it completely ready .. !!