Sysprep was not able to validate your Windows installation: how to fix it

Applies to: Windows 11 and Windows 10 when you run sysprep.exe (for example with Generalize and OOBE) to prepare a reference image, a virtual machine template or a PC for a new owner.

What the error means

Before Sysprep removes PC-specific data, it checks that the installation can be safely generalized. If any check fails, it stops with this message and changes nothing:

Sysprep was not able to validate your Windows installation.
Review the log file at
%WINDIR%\System32\Sysprep\Panther\setupact.log for details.
After resolving the issue, use Sysprep to validate your installation again.

The message itself never says which check failed. The log does, so start there.

Step 1: Find the cause in setupact.log

1. Close the Sysprep window.
2. Open Command Prompt as administrator.
3. Show only the error lines from the log:

findstr /i /c:"Error" C:\Windows\System32\Sysprep\Panther\setupact.log

Look for the first error near the end of the file and match it to this table:

Line in the log	Cause	Fix
SYSPRP Package <name> was installed for a user, but not provisioned for all users	A Store app was added or updated for one account	Fix 1
BitLocker-Sysprep: BitLocker is on for the OS volume	BitLocker or automatic device encryption is on	Fix 2
Mentions an upgrade, or Sysprep can’t run on an upgraded OS	Windows was upgraded in place from an earlier version	Fix 3
Anything else	Pending updates, a removed user profile, or a third-party tool	Other causes

You can also open the log in Notepad (notepad C:\Windows\System32\Sysprep\Panther\setupact.log) and press Ctrl + End to jump to the latest entries.

Fix 1: Remove the app that isn’t provisioned for all users

This is the most common cause. Sysprep fails when an app package exists for a user account but isn’t part of the image for all users. It usually happens after the Microsoft Store updates a built-in app, after you install a Store app, or after removing a built-in app for one user only. Note the package name in the log line, for example Microsoft.LanguageExperiencePackfr-FR_... or Microsoft.BingWeather_....

1. Disconnect the PC from the internet so the Store can’t update apps again while you work.
2. Open Windows PowerShell or Terminal as administrator.
3. Find the full package name, replacing BingWeather with part of the name from your log:

Get-AppxPackage -AllUsers *BingWeather* | Select Name, PackageFullName

Then remove it for all users, pasting the PackageFullName value:

Remove-AppxPackage -Package <PackageFullName> -AllUsers

If you also want it gone from the image for new users, remove the provisioned copy too:

Get-AppxProvisionedPackage -Online | Where DisplayName -like "*BingWeather*" | Remove-AppxProvisionedPackage -Online

Run Sysprep again. If the log now names a different package, repeat the steps for that one; several apps can be affected at once. If the app belongs to a user account you’ve already deleted, sign in as that user (or delete the leftover profile in System Properties > Advanced > User Profiles) and remove it there.

Fix 2: Turn off BitLocker or device encryption

Sysprep won’t generalize a system drive that is encrypted. Many Windows 11 laptops turn on Device encryption automatically when you sign in with a Microsoft account, so this can happen even if you never set up BitLocker.

Check the status in an administrator Command Prompt:

manage-bde -status C:

If Conversion Status shows anything other than Fully Decrypted, turn it off:

manage-bde -off C:

Decryption runs in the background and can take a while. Run manage-bde -status C: until it shows Fully Decrypted, then run Sysprep. You can also turn it off in Settings > Privacy & security > Device encryption or in Manage BitLocker in Control Panel. If you only paused it, see BitLocker suspended: what it means; suspending isn’t enough for Sysprep.

Fix 3: Upgraded installations

Sysprep is designed for clean installations. On a PC upgraded in place from an earlier version (for example Windows 10 upgraded to Windows 11), it can refuse to validate. If your log points to an upgrade, the reliable fix is to build the reference image from a clean install. Use the Windows installation media and set the PC up again before running Sysprep.

You’ll find registry workarounds online that hide the upgrade flag. They aren’t a supported fix, and an image made that way can fail later, so avoid them for anything you’ll deploy to other PCs.

Other causes and tips

• Pending updates: if Windows Update is installing or waiting for a restart, finish the updates and restart before running Sysprep. See how to run Windows Update from the command line.
• Run Sysprep from its own folder: start it as administrator from C:\Windows\System32\Sysprep\sysprep.exe, not from a copy.
• Build images in Audit mode: customizing in Audit mode with the built-in Administrator account, offline, avoids most Store app problems in the first place.
• Third-party security or cleanup tools: some block Sysprep. If the log names one, uninstall it, run Sysprep, and reinstall it on the deployed PCs.

If you only want to give a PC to someone else rather than build an image, Reset this PC with Remove everything is simpler than Sysprep. See how to reinstall Windows.

Related guides

• BitLocker suspended: what it means and how to resume it
• Windows 10 installation media: how to create a bootable USB
• How to reinstall Windows 10: reset, repair install or clean install
• Microsoft Store missing: how to get it back

Official sources: for more detail, see Microsoft’s own pages:

• Microsoft Learn: Sysprep fails after you remove or update Microsoft Store apps
• Microsoft Learn: Sysprep (Generalize) a Windows installation

Frequently asked questions

Where is the Sysprep log file?

The main log is C:\Windows\System32\Sysprep\Panther\setupact.log. Errors are also written to setuperr.log in the same folder.

Does removing the app break anything?

No. You can reinstall Store apps from the Microsoft Store after deployment, and new users get the provisioned apps that remain in the image.

Can I run Sysprep on a PC that’s joined to a domain?

Yes, but generalizing removes it from the domain, so you’ll need to join it again afterwards. Many admins build the image on a PC that isn’t domain-joined.

Why does the error come back after I fix it?

Usually because the Store updated another app in the meantime. Keep the PC offline, or pause Store app updates, until Sysprep finishes.