Windows answer files (unattend.xml): configuration passes and where Setup looks for them

What it is

Microsoft Learn describes configuration passes as "the phases of a Windows installation during which you can customize an image." An unattend.xml file is organized by pass, and the same setting can behave differently depending on the pass it sits in. The seven passes are windowsPE, offlineServicing, generalize, specialize, auditSystem, auditUser and oobeSystem; the ones provisioning touches most are:

• windowsPE: runs when Setup boots from media or starts from a previous installation (image selection, disk configuration, boot-critical drivers). Removable media and \Sources are only searched for a file named Autounattend.xml in this pass.
• generalize: runs only when you execute sysprep /generalize; it removes the SID and hardware-specific settings.
• specialize: runs once on the first boot of an image, and again on the next boot after each sysprep /generalize. New SIDs are created here, and network, international and domain-join settings belong here.
• oobeSystem: applied before Windows Welcome (OOBE) starts — typically user accounts, shell options, language and locale.
• auditSystem/auditUser: run only when booting into audit mode.

Windows System Image Manager (WSIM), part of the Windows Assessment and Deployment Kit, authors these files against a specific image's catalog instead of hand-edited XML.

Setup searches at the start of every pass, uses the highest-precedence file that contains settings for that pass, and caches it to %WINDIR%\Panther. The implicit order is: the registry value HKLM\System\Setup\UnattendFile; %WINDIR%\Panther\Unattend (downlevel installs only); the cache in %WINDIR%\Panther; the root of removable read/write, then read-only media (Autounattend.xml); \Sources on the distribution for windowsPE/offlineServicing, otherwise %WINDIR%\System32\Sysprep (Unattend.xml); %SYSTEMDRIVE%; and the root of the drive Setup runs from. A file passed explicitly with setup /unattend: or sysprep /unattend: overwrites the cached copy.

Why it matters

Setup annotates passes it has already processed in the cached file. After sysprep /generalize without a new answer file, specialize-pass RunSynchronous commands from the original install do not run again, and an Unattend.xml dropped into System32\Sysprep loses to the higher-precedence cache — pass the file explicitly instead.

How to apply

• Choose the pass deliberately: per-machine identity and domain join in specialize, accounts and locale in oobeSystem.
• Author and validate the file in WSIM against the same image (.wim) it will be applied to.
• Use WSIM's Tools > Hide Sensitive Data before saving. It only hides the AutoLogon, AdministratorPassword and LocalAccount passwords; Microsoft states it "does not provide encryption", and domain passwords and product keys stay in clear text.
• Setup removes sensitive data from the cached file at the end of each pass, but Microsoft still says to delete the cached answer file in %WINDIR%\Panther before handing the machine over (for example from SetupComplete.cmd), together with any copy you placed elsewhere.

Pitfalls

• Treating "hidden" passwords as encrypted: the value is only encoded, so any file that held a real password is sensitive.
• Embedding a file at a higher-precedence path such as %WINDIR%\Panther\Unattend: it replaces the cache at every pass, so sensitive data from earlier passes is no longer cleared.
• Expecting later passes to change what windowsPE already did: disk layout decisions made there cannot be undone.