PC System Imaging

What should be cleaned up from snapshots before creating system images?
REGISTRY KEYS
From: http://seer.support.veritas.com/docs/235555.htm
In the list of Registry values below, the specific data for each value may be different than what exists in any given package. However, the Registry key and the value name will be the same.
1. If the entire key is shown below without a value, delete the entire key from the .REG file.
Before: [HKEY\Path]
After:
2. If a Registry key is shown below with a specific value, remove only the value name and data. Do not remove the key.
Before: [HKEY\Path] "Valuename"=data
After: [HKEY\Path]
Common registry entries to remove:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer]
[HKEY_CURRENT_USER\Volatile Environment]
[HKEY_LOCAL_MACHINE\SOFTWARE\Description\Microsoft\Rpc\UuidTemporaryData]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList]
Note: There may be more than one Security Identifier (SID) under the ProfileList key in the Registry. Remove the keys for any SIDs, which will also remove any values under these keys.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_LOCAL_MACHINE\SOFTWARE\Novell]
Note: There may be various keys and values under the Novell key. If they do not relate to the package in question, the entire Novell key should be removed. If any of the login or networking options are changed between snapshots, these types of settings will be picked up,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\El90x1\Parameters\Tcpip]
Note: The line above is an example for a machine with the 3Com Fast EtherLink XL PCI 10/100Mb Adapter (3C905). "EL09x1" represents the network card's short name, specifically the "ServiceName" of the card. Replace "EL09x1" in the above line with the actual ServiceName value.
This value can be found in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\1
"ServiceName"=EL90x1
The number indicated after NetworkCards depends on the number of NIC cards in the system. The example shows the ServiceName for the 3Com Fast EtherLink card.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NWCWorkstation]
Note: There may be various keys and values under the NWCWorkstation key. If they do not relate to the package in question, they should be removed.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VxD\DHCP]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VxD\VCACHE]
[HKEY_LOCAL_MACHINE\SYSTEM\Select]

FILES
from:http://www.wise.com/displayArticle.asp?articleno=1029&bhcp=1
The following files should not be included in your installation package. These files are flagged by Microsoft and should not be modified, replaced, or moved. They can and will produce unexpected and undesirable results:

Win16 .dll files:
USER.DLL, KERNEL.DLL, SHELL.DLL, TOOLHELP.DLL, VER.DLL, LZEXPAND.DLL, GDI.DLL, KEYBOARD.DLL, COMMDLG.DLL, WIN87EM.DLL, DDEML.DLL
Win32 .dll files:
COMCTL32.DLL, COMDLG32.DLL, USER32.DLL, KERNEL32.DLL, ADVAPI32.DLL, GDI32.DLL, DSKAPI32.DLL, ICM32.DLL, IMM32.DLL, LZ32.DLL, RICHED32.DLL, SHELL32.DLL, SAGE.DLL, VERSION.DLL, WINSPOOL.DRV, WINMM.DLL, URL.DLL, LINKINFO.DLL, SHLWAPI.DLL, SHDOCVW.DLL, SHFOLDER.DLL, WSOCK.DLL, WININET.DLL,
Also, you should not include the WININIT.INI file in your installation.

Additionally, the following files have been reported to cause problems:
ATL.DLL, COMCAT.DLL, CTL3D32.DLL exist in different versions for 9x platforms and NT/2000 platforms. When installing the wrong file different and varied problems may occur.

ATL.DLL and CTL3D32.DLL may prevent Windows from booting, and COMCAT.DLL will damage Visual Basic.

MSIMG32.DLL exists in different versions for 98/NT4 and ME/2000.

Windows 2000::PC System Imaging::INACCESSIBLE_BOOT_DEVICE

Problem:
INACCESSIBLE_BOOT_DEVICE after imaging a machine.
Additional Information:
This error may be from imaging a Windows 2000 disk to a different size drive or different drive location.
Or the drive could be incorrectly configured to use DMA access. Turning off DMA access in PC BIOS may resolve the problem.
Most likely, Windows 2000 cannot access the hard drive due, probably a different device driver on target computer from the model system image.
The target computer may have a hard drive controller that didn't exist on the model imaged system. Windows 2000 loads the old drivers, but cannot find the hardware.
If the original and target computers use the same drivers, but the target system partition is on a different IDE channel than the original model computer - Windows will try to get to the drive, but fails because drivers are not installed for that IDE channel.
To resolve this issue, configure the target machines hardware to match the model machine - this is probably not convenient.
Try editing the SysPrep.inf file and using SysPrep prior to creating the image.
1. Install SysPrep on the source computer.
2. Edit the SysPrep.inf file using notepad or other text editor:
- If the problem is due to which IDE channel is in use, type the following two lines under the [SysprepMassStorage] section:
Primary_IDE_Channel = %windir%\inf\mshdc.inf
Secondary_IDE_Channel = %windir%\inf\mshdc.inf
- If the problem is due to a new hard drive controller, add an entry for that controller to the [SysprepMassStorage] section. Required info will be different for each controller.
3. Save the file
4. Run SysPrep
5. Create and image of the disk

Windows 2000::PC System Imaging

To image from from one type of hardware to another, you can setup the driver for your drive controller to a standard one (not controller-specific). Before uploading image:

In Device Manager > IDE ATA/ATAPI controllers, update the hardware-specific driver labeled PCI Bus Master IDE Controller with a standard/generic driver.
Do not reboot after doing this or Windows will change it back.

Link::Application Deployment

Excellent resource for application deployment tools, tips, etc.
AppDeploy

Windows 2000::Group Policy::Refresh Interval

"The interval at which a group policy is refreshed is defined by a refresh interval value and an offset interval value. The refresh interval is an amount of time between 0 (zero) and 64800 minutes (45 days), which is used to determine when the group policy should be applied next. By default, if the administrator does not modify the default setting, Windows 2000-based computers use 90-minute intervals. For domain controllers, the default is 5 minutes. This default for domain controllers is used because when a change to domain policy or rights is made, this reduces the latency in applying the change to domain controllers as replication occurs. If 0 (zero) is specified for the refresh interval, the refresh occurs in 7-second intervals.

To avoid the performance degradation that can occur if many Windows 2000-based computers request a group policy refresh from domain controllers at one time, a random offset interval is added to the refresh interval to determine the total amount of time between group policy application cycles. The valid range for the offset interval can be 0 (zero) to 1,440 minutes (24 hours). The default for Windows 2000-based computers is 30 minutes, while the default for domain controllers is 0 (zero) minutes."

"HOW TO: How to Modify the Default Group Policy Refresh Interval" MS KB 203607

Windows NT/2000::Elevated Privileges Application Launcher

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windows2000serv/downloads/epal.asp
"With EPAL the network administrator now has the ability of only giving the user local user privileges on their systems and have the application execute and some higher privilege level on the local system that they are currently logged on with. "