Fixes common Windows sysprep failures: removes WidgetsPlatformRuntime (0x80073cf2), reinstalls MSDTC (0x80070424), disables reserved storage, and resets generalization state registry keys.

README.md

Sysprep Fix

Fixes common sysprep failures on Windows 10/11 before running sysprep /generalize.

Problems fixed

Error	Cause	Fix applied
0x80073cf2	Microsoft.Winget.Source installed per-user, not provisioned system-wide	Removes package and provisioned package for all users
0x80073cf2	WidgetsPlatformRuntime installed per-user, not provisioned system-wide	Removes package and provisioned package for all users
0x80070424	MSDTC service missing or misconfigured	Uninstalls and reinstalls MSDTC; falls back to sc.exe create if reinstall fails
0x800f0975	Reserved storage in use	Disables reserved storage via DISM (warns if a servicing operation is blocking it)
0x80310039	BitLocker enabled or volume still encrypted	Prompts to fully decrypt C: via Disable-BitLocker; detects protection-on, decryption-in-progress, and encrypted-with-protection-off states separately
Sysprep rearm loop	GeneralizationState / SkipRearm registry values wrong	Resets both registry keys

Requirements

• Windows 10 or 11
• Must be run as Administrator

Usage

& 'Fix-sysprep.ps1'

Run this script, confirm all steps report success, then launch sysprep.

Notes

• Reserved storage: If the DISM step warns it could not be disabled, wait for Windows Update to finish and re-run the script before proceeding.
• BitLocker: If decryption is started, wait for it to complete before running sysprep. Check progress with:

  (Get-BitLockerVolume -MountPoint C:).EncryptionPercentage

  Sysprep is safe to run once this reaches 0.

Fix-sysprep.ps1

#Requires -RunAsAdministrator

Clear-Host
Write-Host "=== Sysprep Fix ===" -ForegroundColor Cyan
Write-Host ""

# -- Registry fixes ---
Write-Host ""
Write-Host "Applying registry fixes..." -ForegroundColor Yellow
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v SkipRearm /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus" /v GeneralizationState /t REG_DWORD /d 2 /f
Write-Host "Registry fixes applied." -ForegroundColor Green

# -- Disable reserved storage ---
Write-Host ""
Write-Host "Disabling reserved storage..." -ForegroundColor Yellow
DISM /Online /Set-ReservedStorageState /State:Disabled | Out-Null
if ($LASTEXITCODE -eq 0) {
    Write-Host "Reserved storage disabled." -ForegroundColor Green
} else {
    Write-Host "WARNING: Could not disable reserved storage (exit code $LASTEXITCODE). A servicing operation may be in progress - run this script again once Windows Update is idle." -ForegroundColor Red
}

# -- MSDTC reinstall ---
Write-Host ""
Write-Host "Reinstalling MSDTC..." -ForegroundColor Yellow
net stop msdtc 2>$null | Out-Null
msdtc -uninstall
Start-Sleep -Seconds 2
msdtc -install
Start-Sleep -Seconds 3
$msdtcSvc = Get-Service -Name MSDTC -ErrorAction SilentlyContinue
if ($msdtcSvc) {
    if ($msdtcSvc.Status -ne 'Running') {
        Start-Service -Name MSDTC -ErrorAction SilentlyContinue
    }
    Write-Host "MSDTC reinstalled." -ForegroundColor Green
} else {
    Write-Host "WARNING: MSDTC service not found after reinstall - registering manually..." -ForegroundColor Yellow
    sc.exe create MSDTC binPath= "$env:SystemRoot\system32\msdtc.exe" start= demand DisplayName= "Distributed Transaction Coordinator" | Out-Null
    sc.exe description MSDTC "Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems." | Out-Null
    Start-Service -Name MSDTC -ErrorAction SilentlyContinue
    if ((Get-Service -Name MSDTC -ErrorAction SilentlyContinue).Status -eq 'Running') {
        Write-Host "MSDTC registered and started." -ForegroundColor Green
    } else {
        Write-Host "ERROR: MSDTC could not be started. Sysprep DTC cleanup will likely fail." -ForegroundColor Red
    }
}

# -- Remove Winget.Source (user-installed, not provisioned - blocks sysprep) ---
Write-Host ""
Write-Host "Removing Microsoft.Winget.Source..." -ForegroundColor Yellow
Get-AppxPackage -AllUsers *Winget.Source* | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue
Get-AppxProvisionedPackage -Online | Where-Object { $_.DisplayName -like "*Winget.Source*" } | Remove-AppxProvisionedPackage -Online -ErrorAction SilentlyContinue
Write-Host "Microsoft.Winget.Source removed." -ForegroundColor Green

# -- Remove WidgetsPlatformRuntime ---
Write-Host ""
Write-Host "Removing WidgetsPlatformRuntime..." -ForegroundColor Yellow
Get-AppxPackage -AllUsers *WidgetsPlatformRuntime* | Remove-AppxPackage -AllUsers
Get-AppxProvisionedPackage -Online | Where-Object { $_.DisplayName -like "*WidgetsPlatformRuntime*" } | Remove-AppxProvisionedPackage -Online
Write-Host "WidgetsPlatformRuntime removed." -ForegroundColor Green

# -- BitLocker ---
Write-Host ""
Write-Host "Checking BitLocker status..." -ForegroundColor Yellow
$blv = Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue
if ($blv -and $blv.ProtectionStatus -eq 'On') {
    Write-Host "BitLocker is ON. Sysprep requires BitLocker to be disabled." -ForegroundColor Yellow
    $response = Read-Host "Disable BitLocker on C: now? Decryption will run in the background. (y/n)"
    if ($response -eq 'y') {
        Disable-BitLocker -MountPoint "C:" -ErrorAction Stop | Out-Null
        Write-Host "BitLocker decryption started. Wait for decryption to complete before running Sysprep." -ForegroundColor Yellow
        Write-Host "Check progress with: (Get-BitLockerVolume -MountPoint C:).EncryptionPercentage" -ForegroundColor Cyan
    } else {
        Write-Host "Skipped. Sysprep will fail until BitLocker is disabled." -ForegroundColor Red
    }
} elseif ($blv -and $blv.VolumeStatus -eq 'DecryptionInProgress') {
    Write-Host "BitLocker is already decrypting - wait for it to finish before running Sysprep." -ForegroundColor Yellow
    Write-Host "Check progress with: (Get-BitLockerVolume -MountPoint C:).EncryptionPercentage" -ForegroundColor Cyan
} elseif ($blv -and $blv.VolumeStatus -eq 'FullyEncrypted' -and $blv.ProtectionStatus -eq 'Off') {
    Write-Host "BitLocker protection is off but the volume is still encrypted." -ForegroundColor Yellow
    $response = Read-Host "Fully decrypt C: now? (y/n)"
    if ($response -eq 'y') {
        Disable-BitLocker -MountPoint "C:" -ErrorAction Stop | Out-Null
        Write-Host "BitLocker decryption started. Wait for it to complete before running Sysprep." -ForegroundColor Yellow
        Write-Host "Check progress with: (Get-BitLockerVolume -MountPoint C:).EncryptionPercentage" -ForegroundColor Cyan
    } else {
        Write-Host "Skipped. Sysprep may still fail if the validation checks encryption status." -ForegroundColor Red
    }
} else {
    Write-Host "BitLocker is not active on C: - no action needed." -ForegroundColor Green
}

Write-Host ""
Write-Host "=== All done ===" -ForegroundColor Cyan
Write-Host ""