I have done a lot of searching on this issue and I have seen a lot of similar posts but most of what I have come across contains the specific section the specialize pass fails on (i.e. Microsoft-Windows-Shell-Setup) and the error log points directly to a particular setting in the answer file. I am not seeing the same type of information.
Let me provide some background. I'm deploying images for my organization via WDS with answer files generated with WSIM. My problem pertains to my Windows 10 image. About every 3 months I revisit the image to apply Windows updates and install software as needed. My process goes as such, I have installed W10 on a Hyper-V VM and from there I make the necessary changes, sysprep and pull it up to WDS via a capture image. The image was created in March 2016 and I refreshed it in June and September without any issues. This time everything continued to work correctly until after WDS installs the image and the system reboots, the install fails with "Windows could not apply unattend settings during pass [specialize]."
The image is W10 Pro x64. The only changes to the image/answer file from the previous refresh are as follows.
-C++ installed (2008, 2010, 2012, 2013, vNext) - Requested in the image from the systems admin
-A handful of Windows security updates
-only change to the answer file is a different initial admin password which is in the OOBE pass.
Everything else remains the same from the image and answer file as it was in September.
I'm attaching the specialize portion of my answer file and the unattend section of the setupact log. Any guidance would be greatly appreciated. If this is posted in an incorrect location or the solution to my particular problem exists in another thread I apologize. I do want to re-iterate though that I have searched through quite a few forums with very similar issues but without the log information I am seeing or more specific information to particular answer file settings.
I have tried the following.
-I have used the new answer file with the September image, no issues.
-I have used the old answer file with the new image, same issue with the specialize pass.
-I tried changing and removing the DisableAntiSpyware setting as that is the only thing I saw in the logs that is mentioned the answer file.
-I tried changing and removing CopyProfile since that seems to have been a problem source for others.
-I reverted my VM several times and made sure to only install C++ and Windows updates with no other changes.
-I checked all the settings from the specialize pass that I could to make sure they weren't already set like they are in answer file.
It would seem that something else has changed in the image that I am not aware of but I'll be darned if I know what that might be.
<?xml version="1.0" encoding="utf-8"?><unattend xmlns="urn:schemas-microsoft-com:unattend"><settings pass="specialize"><component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><SkipAutoActivation>false</SkipAutoActivation></component><component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><RunSynchronous><RunSynchronousCommand wcm:action="add"><Order>1</Order><Path>net user administrator /active:yes</Path></RunSynchronousCommand></RunSynchronous></component><component name="Microsoft-Windows-ErrorReportingCore" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><DisableWER>1</DisableWER></component><component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><SearchScopes><Scope wcm:action="add"><ScopeDefault>true</ScopeDefault><ScopeDisplayName>Google Search</ScopeDisplayName><ScopeUrl>https://www.google.com/?gws_rd=ssl#q={searchTerms}</ScopeUrl><ScopeKey>SearchProvider1</ScopeKey><FaviconURL>http://www.google.com/favicon.ico</FaviconURL></Scope></SearchScopes><Home_Page>http://www.test.com/</Home_Page><DisableFirstRunWizard>true</DisableFirstRunWizard></component><component name="Microsoft-Windows-Printing-Spooler-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><RemoveMPDW>1</RemoveMPDW><RemoveMXDW>1</RemoveMXDW></component><component name="Microsoft-Windows-SQMApi" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><CEIPEnabled>0</CEIPEnabled></component><component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><DisableSR>1</DisableSR></component><component name="Security-Malware-Windows-Defender" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><DisableAntiSpyware>true</DisableAntiSpyware></component><component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><BluetoothTaskbarIconEnabled>false</BluetoothTaskbarIconEnabled><RegisteredOwner /><CopyProfile>true</CopyProfile><ShowWindowsLive>false</ShowWindowsLive></component></settings>2017-01-13 06:15:42, Info [setup.exe] UnattendSearchExplicitPath: Found unattend file at [C:\Windows\Panther\unattend.xml]; examining for applicability.
2017-01-13 06:15:42, Info [setup.exe] UnattendSearchExplicitPath: Found usable unattend file for pass [specialize] at [C:\Windows\Panther\unattend.xml].
2017-01-13 06:15:42, Info IBS Callback_Unattend_InitEngine:Using unattend file found at [C:\Windows\Panther\unattend.xml].
2017-01-13 06:15:42, Info [setup.exe] ValidateSMIPass: serialized settings stream; status 0x00000000
2017-01-13 06:15:42, Info [setup.exe] ValidateSMIPass: construct settings context; status 0x00000000
2017-01-13 06:15:42, Info [setup.exe] ValidateSMIPass: load SMI settings; status 0x00000000
2017-01-13 06:15:42, Info [0x0600c0] IBS Callback_Unattend_InitEngine:Successfully deserialized and validated unattend file [C:\Windows\Panther\unattend.xml].
2017-01-13 06:15:42, Info [0x0604d4] IBS Callback_ConfigSetProcessUnattend: UseConfigurationSet is false.
2017-01-13 06:15:42, Info DIAG Callback_Diagnostic_Unattend: Setup was started from Phase 4. Disabling Diagnostics [ ProcessUnattend ] in this scenario
2017-01-13 06:15:42, Info [0x064047] IBSLIB MarkUnattendSettingAsProcessed: Marking unattend setting [ProductKey\ProductKey] as processed.
2017-01-13 06:15:42, Info [0x064047] IBSLIB MarkUnattendSettingAsProcessed: Marking unattend setting [UserData\ComputerName] as processed.
2017-01-13 06:15:42, Info [0x064047] IBSLIB MarkUnattendSettingAsProcessed: Marking unattend setting [SetupUI\SkipEula] as processed.
2017-01-13 06:15:42, Info [0x064047] IBSLIB MarkUnattendSettingAsProcessed: Marking unattend setting [PrepareDisks] as processed.
2017-01-13 06:15:42, Info [0x064047] IBSLIB MarkUnattendSettingAsProcessed: Marking unattend setting [LangPacks] as processed.
2017-01-13 06:15:42, Info [0x060590] IBS CallBack_LanguagePacks_Unattend:Unattend already processed.
2017-01-13 06:15:42, Info PnPIBS: Entering PnP callback to validate unattend.xml settings for component Microsoft-Windows-PnPCustomizationsWinPE ...
2017-01-13 06:15:42, Info PnPIBS: Unattend settings need not be processed. Nothing more to be done here!
2017-01-13 06:15:42, Info [0x064047] IBSLIB MarkUnattendSettingAsProcessed: Marking unattend setting [SetupComplianceCheck] as processed.
2017-01-13 06:15:42, Info [0x064047] IBSLIB MarkUnattendSettingAsProcessed: Marking unattend setting [RegionalSettings] as processed.
2017-01-13 06:15:42, Info [0x0605fb] IBS Callback_Locale_ProcessUnattendSettings: Layered Driver from downlevel system [1]
2017-01-13 06:15:42, Info IBS CallBack_Unattend_InitiatePass: Initiating unattend settings pass [specialize]
2017-01-13 06:15:42, Info [setup.exe] Current pass status for [specialize] is [0x0]
2017-01-13 06:15:42, Info [setup.exe] Applying data-only settings overrides using SMI...
2017-01-13 06:15:43, Info CSI 00000001@2017/1/13:14:15:43.208 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7fff6e1546d9 @0x7fff6e4c8a75 @0x7fff6e4e3f03 @0x7fff6e4b75db @0x7fff6e4b6092 @0x7fff79e43fff)
2017-01-13 06:15:43, Error CSI 00000001 (F) HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) #836# from CRegHand::PutValue(item = DisableAntiSpyware, type = 11 (0x0000000b), legacyType = REG_DWORD, legacyFormat = (null), value = {l:1 b:01})
[gle=0x80004005]
2017-01-13 06:15:43, Error CSI 00000002 (F) HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) #827# from CWcmScalarInstanceCore::PutCurrentValue(options = 0, value = { type: 11 (0x0000000b), bytes ( 1 ): 01 })
[gle=0x80004005]
2017-01-13 06:15:43, Error CSI 00000003 (F) HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) #821# from CChildContextStore::ApplyToNamespace(namespace = @0x1b874d43900)[gle=0x80004005]
2017-01-13 06:15:43, Error [setup.exe] Failed to apply data-only settings overrides; hr = 0x80070005
2017-01-13 06:15:43, Info [0x0606cc] IBS Flushing registry to disk...
2017-01-13 06:15:43, Info [0x0606cc] IBS Flush took 312 ms.
2017-01-13 06:15:43, Error [0x060431] IBS Callback_UnattendInitiatePass: An error occurred while initiating unattend passes; hr = 0x80070005
2017-01-13 06:15:43, Info IBSLIB PublishCriticalError: Publishing critical error message [Windows could not apply unattend settings during pass [specialize].]
2017-01-13 06:15:57, Info [0x070042] DIAG CallBack_DiagnosticDataSend: Called with notification for Error published by ErrorHandler
2017-01-13 06:15:57, Info DIAG CallBack_DiagnosticDataSend: Setup was started from Phase 4. Disabling Diagnostics [DiagnosticDataSend] in this scenario
2017-01-13 06:15:57, Info [0x090095] PANTHR WdsExitImmediate called! Execution will stop, and the queue won't be saved.
2017-01-13 06:15:57, Info [0x09008c] PANTHR SeqExecute -- stopping, since WdsExitImmediate() was called
2017-01-13 06:15:57, Info [0x090086] PANTHR pWorkerThreadFunc -- Stopping
2017-01-13 06:15:57, Info [0x090086] PANTHR pWorkerThreadFunc -- Stopping
2017-01-13 06:15:57, Info [0x090086] PANTHR pWorkerThreadFunc -- Stopping
2017-01-13 06:15:57, Info PANTHR DeleteCriticalSection for pExecQueue->csLock;
2017-01-13 06:15:57, Info [0x0605a6] IBS Requested UI to hide the language and locale selection pages.
2017-01-13 06:15:58, Info [0x090081] PANTHR Destroying any unreferenced modules! (SEQ6)
2017-01-13 06:15:58, Info [0x0601d7] IBS InstallWindows:Error Type = 3211266
2017-01-13 06:15:58, Info [0x090009] PANTHR CBlackboard::Close: c:\windows\panther\setupinfo.