Audit Mode Overview

When Windows boots, it starts in either Out-Of-Box Experience (OOBE) mode or in audit mode. OOBE is the default out-of-box experience that allows end users to enter their account information, select language, accept the Microsoft Terms of Service, and set up networking.

You can configure Windows to boot to audit mode instead. In audit mode, you can make additional changes to the Windows installation before you send the computer to a customer or capture the image for reuse in your organization. For example, you can install drivers included in a driver package, install applications, or make other updates that require the Windows installation to be running. When you use an answer file, Windows processes settings in the auditSystem and auditUser configuration passes.

Modify an image online: Start with an image file (either .wim or .ffu format). Apply it to a reference device. Modify it in Windows. Generalize it to prepare it for capturing. Capture the image into a new image file (either .wim or .ffu format). Apply it to new devices.

When you boot to audit mode, you log into the system using the built-in administrator account. After you log on to the system, the built-in administrator account is immediately disabled during the auditUser configuration pass. The next time that the computer reboots, the built-in administrator account remains disabled. For more information, see Enable and Disable the Built-in Administrator Account.


  • If you are in audit mode and a password-protected screen saver starts, you cannot log back on to the system. The built-in administrator account that was used to log on to audit mode is immediately disabled after logon.

    To disable the screen saver, either change the power plan through Control Panel or configure and deploy a custom plan. For more information, see Create a Custom Power Plan.

  • Settings in an unattended answer file from the oobeSystem configuration pass do not appear in audit mode.

  • If you're running scripts, installers, and diagnostic tools on Windows 10 S in Audit Mode, you may have to enable manufacturing mode for Windows 10 S. See Manufacturing mode for details.

Benefits of using Audit Mode

In audit mode, you can do the following:

  • Bypass OOBE. You can access the desktop as quickly as possible. You do not have to configure default settings such as a user account, location, and time zone.

  • Install applications, add device drivers, and run scripts. You can connect to a network and access additional installation files and scripts. You can also install additional language packs and device drivers. For more information, see Add a Driver Online in Audit Mode.

  • Test the validity of a Windows installation. Before you deploy the system to end users, you can perform tests on the system without creating a user account. Then you can prepare the system to start in OOBE on the next boot.

  • Add more customizations to a reference image. This reduces the number of images that you have to manage. For example, you can create a single reference image that contains the basic customizations that you want to apply to all Windows images. You can then boot the reference image to audit mode and make additional changes that are specific to the computer. These changes can be customer-requested applications or specific device drivers.

Boot to Audit Mode

You can boot to audit mode on a new or existing Windows installation. For more information, see Boot Windows to Audit Mode or OOBE.

Understanding Servicing Strategies

Windows Setup Configuration Passes

How Configuration Passes Work

Windows Setup Scenarios and Best Practices

Windows Setup Installation Process

Windows Setup Automation Overview

Windows Setup Supported Platforms and Cross-Platform Deployments

Windows 10 S manufacturing mode