Question

Background

OEMS, Sys Admins etc. often use OPK or WAIK for mass installation. During this they often ship some pre-installed applications. The installations of such applications happen when Windows installation enters in Audit Mode

Question

Using c#, how do I detect that Windows is currently in Audit Mode?

Answer 1

You need to check the registry:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State
  
  for something other than IMAGE_STATE_COMPLETE
• HKEY_LOCAL_MACHINE\System\Setup for AuditInProgress

EDIT – as per comment:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE could provide some information in this regard too…

For details see see

• http://technet.microsoft.com/en-us/library/cc721913%28v=ws.10%29.aspx
• http://msdn.microsoft.com/en-us/library/dd450713.aspx
• http://technet.microsoft.com/en-us/library/dd349350%28v=ws.10%29.aspx
• http://msdn.microsoft.com/en-us/library/ff794046%28v=winembedded.60%29.aspx