In a recent article, we explained how to uninstall Windows 8 apps. In today’s post, I will show you what things you have to consider if you plan to remove all Windows 8 apps before you run sysprep to prepare a reference image for OS deployment. Even if you don’t plan to uninstall built-in apps, you have to know that sysprep in Windows 8 works differently than in previous Windows versions.
Profile gravatar of Michael Pietroforte

Michael Pietroforte

Michael Pietroforte is the founder and editor of 4sysops. He is a Microsoft Most Valuable Professional (MVP) with more than 30 years of experience in IT management and system administration.
Profile gravatar of Michael Pietroforte

Please notice that I will use the Windows 8 app terminology I introduced in a previous article.

Why you should remove unnecessary apps ^

Most of the built-in Windows 8 apps are not really needed in business environments. In my view, the only applications and apps that should be deployed in corporate networks are those that employees need to get their work done. It is not just that people waste time playing with apps; this is also about security because every additional program is a potential security risk.

In large organizations, unnecessary apps can also result in significant cost if users call the help desk to inquire about the apps. For instance, a user who logs on to a Windows 8 machine for the first time might think that the mail app is, well, for accessing his mails. Yeah, users can be quite smart sometimes. I mean, how could he know that his admins have tricked him by putting a mail icon right in front of his nose that he is not supposed to click if he wants to read his mail?

When you prepare your reference image, you should uninstall all unnecessary built-in apps. In the vast majority of cases, this will be all apps. Unfortunately, uninstalling apps is a bit more complicated than removing applications; most of the problems are related to the fact that apps are installed per user, not per machine as with applications.

Sysprep – A fatal error occurred ^

If you don’t heed the advice given here, you might run into the following error message:

Sysprep fatal error

System Preparation Tool 3.14 – A fatal error occurred while trying to sysprep the machine

Microsoft published a comprehensive KB article about the mistakes that can cause the error. The article can be summarized in three points:

  1. You installed a new app for an account other than the one that runs sysprep (I will call this the sysprep user).
  2. You manually updated a built-in app for an account other than the sysprep user.
  3. You unprovisioned an app (removed a provisioned app) but did not uninstall it for all users.

I don’t cover sideloaded apps here because most admins don’t have to deal with them at the moment.

The main point here is that you had better not install apps on your reference image before you run sysprep. Unlike applications, you can’t deploy Windows Store apps with the OS image by just installing them for the sysprep user. For this, you have to provision Windows Store apps, which is a topic for another post. Although you can install apps and updates for the sysprep user, sysprep will remove these added apps anyway.

If you created other users and logged on with their accounts, you already have a problem even if you never touched the Windows Store app. Whenever a new user logs on the first time, Windows 8 will install all provisioned apps for this user. If you then uninstall the apps for the sysprep user and remove all provisioned apps, the apps are still installed for the second user, and sysprep will run into the error mentioned above. Essentially, the error occurs because the Windows 8 sysprep tool can’t clean out installed and updated apps for users other than the one who runs sysprep.

Thus, if you want to deploy Windows 8 with user accounts, you must not log on with these accounts before you run sysprep. If you already did, and you want to remove provisioned apps, you have to log on with each user and uninstall those apps. (See the PowerShell command below.)

If you don’t need these local accounts in your reference image, the KB article recommends deleting these user accounts. However, what the KB article doesn’t mention is how to delete them. If you remove these users in the wrong way, your problem won’t be solved. It is essential that you delete the users through the Control Panel user application because only this tool allows you to delete all files associated with the account. For instance, if you delete the users through the Computer Management application and then delete the user profiles manually, sysprep will still fail because the installed Windows 8 apps for these users are still on the system.

Staged updates and sysprep ^

Rick Claus recommends in a blog post to not connect the Windows 8 computer with your reference image to the Internet because automatic updates of Windows 8 apps can cause issues for sysprep. However, according to my tests, sysprep doesn’t have problems with those updates.

Updates of Windows 8 apps are available

Updates of Windows 8 apps are available

If you expose a Windows 8 machine to the Internet for some time, Windows will stage updates. That is, it will download updates without installing them. This is useful because, when a user manually updates the app through the Windows Store app, the update files are already on the machine and don’t have to be downloaded. You can see available updates if you right-click on empty space in the Windows Store app and then click My Apps (see screenshot above). You might have to wait a while until the updates appear. You can also view the staged updates with this PowerShell command:

List staged updates

List staged updates

These staged updates will still be on the machine after you uninstalled all apps and removed all provisioned apps. However, since these updates are not assigned to any user on the system, sysprep has no problem with cleaning them out. If you want to get rid of staged updates anyway, you have to download the free PsExec tool and then run this command:

Remove staged updates

Remove staged updates

I guess this works because PsExec is impersonating the PowerShell commands.

Anyway, I don’t think staged updates cause problems for sysprep. In my tests, the staged updates always disappeared after I sysprepped the machine.

Remove all built-in Windows 8 apps ^

If you want to remove all built-in apps, follow these steps:

  1. Remove all user accounts (other than the sysprep account) that have been logged on before through the Control Panel. Ensure that you tell the Control Panel application to also remove all files.
    Delete user account with all files
  2. Run this PowerShell command to uninstall all apps for your sysprep user:

    Deployment operation progress
  3. Run this PowerShell command to remove all provisioned apps:

    Remove provisioned Windows 8 apps

Note: The if statement in step 2 ensure that only apps that can be uninstalled are listed. Frameworks can’t be removed because other apps depend on them. You also can’t uninstall apps with the PublisherId cw5n1h2txyewy (Windows Store and the Immersive Control Panel).

Remove particular apps ^

If you only want to remove some apps, follow these steps:

  1. Remove all users who logged on before through the Control Panel user application, along with their associated files.
  2. To get a list of the installed package names, run:

    List installed Windows 8 apps
  3. To uninstall a particular app, run:
  4. To get the names of the provisioned packages, run:

    List provisioned packages
  5. To remove a particular provisioned app, run:

Note: You have to ensure in step 5 that you only unprovision apps that you uninstalled for all users in step 3.

Uninstall apps for all users with one PowerShell command? ^

The Get-AppXPackage cmdlet allows you to view the installed apps of all users on the computer buy using the –AllUser parameter. Unfortunately, the Remove-AppXPackage cmdlet doesn’t support this parameter, which is why it is not possible to use just one PowerShell command to uninstall apps of users other than the one you have logged on with.

Just in case you think that you use the PsExec command mentioned above, along with the impersonating trick, to remove all apps for all users on the machine, this does not work either. You really have to remove these users (and their associated files) in the Control Panel, or uninstall the apps for each user separately before you sysprep the machine.

Prevent users from installing apps ^

All your efforts to remove the built-in apps are futile if you allow users to install apps, which is the default setting in Windows 8. As noted above, the procedures above don’t allow you to remove the Windows Store app.

If I learned something in 30 years of administering computers, it’s that one should avoid (at all costs) allowing users to manage their own computers.

Having users install apps might seem like a way to lighten an admin’s load. However, in my experience, this only leads to chaos over time. Sooner or later, your users will run into problems with all kinds of apps, and you will be the one who has to fix these problems for them. You will be responsible for apps you have never heard of, and often these apps are not really required to get the work done.

I think we agree that, with regard to security, it is disastrous to allow end users to install software. Tim Warner explained how you can prevent users from installing Windows 8 apps.

Take part in our competition and win $100!

Share
0

Related Posts

11 Comments
  1. avatar
    Fernando Ribeiro 4 years ago

    Michael, I am having the same problem, but in my case there were no local users created, the only thing is that the machine joined Active Directory, then a domain admin account logged on, then after the sysprep the machine was returned to local Workgroup (removed from AD) and the profile folder for the domain admin account was manually removed. So how can I uninstall Windows 8 APPS for the "now unexistant" domain account?

    0
  2. avatar
    Fernando Ribeiro 4 years ago

    [CORRECTION]
    ... then before the sysprep the machine was returned to local Workgroup (removed from AD)....

    0
  3. Profile gravatar of Michael Pietroforte
    Michael Pietroforte 4 years ago

    Fernando, I don't understand your problem. The procedure above doesn't create any users and it is not for domain joined computers. Why did you run sysprep?

    0
  4. avatar
    Fernando Ribeiro 4 years ago

    First of all, thanks for answering Michael!

    I am creating an Windows 8 image for deployment along my company's desktops, that's why I am running sysprep.

    Regarding user accounts, the procedure considers that user accounts were created, see:

    " The article can be summarized in three points:
    1. You installed a new app for an account other than the one that runs sysprep (I will call this the sysprep user).
    2. You manually updated a built-in app for an account other than the sysprep user.
    3. You unprovisioned an app (removed a provisioned app) but did not uninstall it for all users."

    What I am telling is that differently from what the procedure considers, local user accounts other than the sysprep user never existed in my scenario, yet I get the same error message "A fatal error occurred while trying to sysprep the machine" and the setupact.log has this line:
    "Error SYSPRP Package Microsoft.WinJS.2.0.Preview_1.0.9431.0_neutral__8wekyb3d8bbwe was installed for a user, but not provisioned for all users. This package will not function properly in the sysprep image."

    What I did have on my scenario, different from the procedure above, is that a domain user logged on to my Windows 8 machine, but before running sysprep the machine was removed from the domain as well as the user profile was removed.

    So my question is:
    1. My problem seems to be that there were APP's installed for the domain user?
    2. How do I remove these APP's for the domain user?

    Hope that clarified things!

    0
  5. Profile gravatar of Michael Pietroforte
    Michael Pietroforte 4 years ago

    I see the problem now. It is interesting. The apps were installed for the domain user and are still on the system which is why sysprep fails. I will have a closer look at it these days. In the meanwhile you could post your question in the 4sysops forum. Some of the moderators are familiar with Windows 8 app issues.

    0
  6. avatar
    Robert 2 years ago

    I too have the above issue but with creating a Windows 10 image.
    Did you ever manage to find out the issue with apps installed for domain users?

    0
  7. avatar
    Enakyn 1 year ago

    Hello Michael!

    Big thanks for helpful information.

    0
  8. avatar
    Robbie 1 year ago

    You can delete the domain profiles off the machine cleanly by right-clicking This PC>Properties>Advanced System Settings, under User Profiles select Settings, and delete any unused or old domain accounts. Don't obviously delete Default Profile or your sysprep/admin account. That should help with the Windows Store Apps issue, I was able to sysprep after all this.

    1+
  9. avatar
    zack 7 months ago

    your instructions to remove non framework apps say to run:

    but this is incorrect as this removes frameworks, not excludes them as your where clause is returning $true. The correct code is:

    0
  10. avatar
    zack 7 months ago

    .....actually I made a mistake too. On the framework where clause it should be -eq $false not -ne... So...

    So the above EXCLUDES frameworks and the store app.

    0
  11. Profile gravatar of Michael Pietroforte Author
    Michael Pietroforte 7 months ago

    Did you see the not operator?

    0

Leave a reply

Your email address will not be published. Required fields are marked *

*

CONTACT US

Please ask IT administration questions in the forum. Any other messages are welcome.

Sending
© 4sysops 2006 - 2017

Log in with your credentials

or    

Forgot your details?

Create Account