I've been battling with this issue for a week now. I'm hoping someone can help. Here is the backstory: Starting with a base Windows 10 image at build 1703, I updated to Windows 10 20H2. Everything went fine. In fact we have updated 200 of these systems the same way and using the same ISO with no issues. The PC is HP EliteDesk 800 G2 SFF
Prior to the 20H2 update, I am able to successfully sysprep and deploy the image without issues. After the 20H2 update, sysprep runs fine and shuts down the system, ready to capture the new image. The problem occurs during the first boot after sysprep. Windows setup stops with the error "Windows setup could not configure Windows to run on this computer's hardware" I have tried all kinds of things based on searching this issue, including:
- running sysyprep without specifying and answer file, sysprep /generalize /oobe
- starting sysprep both from audit mode and then not from audit mode
- checking device manager for any errors before running sysprep
- updating the storage drivers, chipset drivers, and video drivers
- removing all user accounts except for the built-in accounts
- assigning a password to the built-in administrator account
- enabling (and disabling) the built-in administrator account
- disabling Windows defender (no other AV is on the system)
- running system file checker (sfc /scannow) and checkdisk (chkdsk /f)
- removing the group policy folders from windows/system32
- probably several other things that I have forgot to mention
Here are is the relevant part of setupact.log:
2021-02-12 07:16:04, Info SYSPRP ActionPlatform::LaunchModule: Executing method 'CryptoSysPrep_Specialize' from C:\Windows\system32\capisp.dll
2021-02-12 07:16:04, Info capisp.dll::CheckIFCryptoSysPrepSpecialized: returning 0
2021-02-12 07:16:04, Info CBS TI: --- Initializing Trusted Installer ---
2021-02-12 07:16:04, Info CBS TI: Last boot time: 2021-02-12 07:15:45.500
2021-02-12 07:16:04, Info CBS Starting TrustedInstaller initialization.
2021-02-12 07:16:04, Info CBS Lock: New lock added: CCbsPublicSessionClassFactory, level: 30, total lock:4
2021-02-12 07:16:04, Info CBS Lock: New lock added: CCbsPublicSessionClassFactory, level: 30, total lock:5
2021-02-12 07:16:04, Info CBS Lock: New lock added: WinlogonNotifyLock, level: 8, total lock:6
2021-02-12 07:16:04, Info CBS Ending TrustedInstaller initialization.
2021-02-12 07:16:04, Info CBS Starting the TrustedInstaller main loop.
2021-02-12 07:16:04, Info CBS Running under Setup's First boot, setting idle time to 30 minutes
2021-02-12 07:16:04, Info CBS TrustedInstaller service starts successfully.
2021-02-12 07:16:04, Info CBS Setup in progress, aborting startup processing checks.
2021-02-12 07:16:04, Info CBS Startup processing thread terminated normally
2021-02-12 07:16:04, Info CBS TI: Startup Processing completes, release startup processing lock.
2021-02-12 07:16:49, Info capisp.dll::CryptoSysPrep_Specialize: assigned CAPI machine guid "124eee6a-4493-4872-a69b-378a55ab51d8"
2021-02-12 07:16:49, Info capisp.dll::LsaOpenPolicy failed: c0020003
2021-02-12 07:16:49, Info capisp.dll::CryptoSysPrep_Specialize: DisableAdministratorIfApplicable failed
2021-02-12 07:16:49, Info capisp.dll::CryptoSysPrep_Specialize: returning 65b
2021-02-12 07:16:49, Error SYSPRP ActionPlatform::LaunchModule: Failure occurred while executing 'CryptoSysPrep_Specialize' from C:\Windows\system32\capisp.dll; dwRet = 0x65b
2021-02-12 07:16:49, Error SYSPRP SysprepSession::ExecuteAction: Failed during sysprepModule operation; dwRet = 0x65b
2021-02-12 07:16:49, Error SYSPRP SysprepSession::ExecuteInternal: Error in executing action for Microsoft-Windows-Cryptography; dwRet = 0x65b
2021-02-12 07:16:49, Error SYSPRP SysprepSession::Execute: Error in executing actions from C:\Windows\System32\Sysprep\ActionFiles\Specialize.xml; dwRet = 0x65b
2021-02-12 07:16:49, Info SYSPRP SysprepSession::Execute: Sysprep mode was not specified, deleting it from registry
2021-02-12 07:16:49, Error SYSPRP RunPlatformActions:Failed while executing Sysprep session actions; dwRet = 0x65b
2021-02-12 07:16:49, Info SYSPRP Callback_Specialize: Internal Providers Specialized Failed. System can't proceed to handle Internal Providers
2021-02-12 07:16:49, Info SYSPRP Callback_Specialize: Specialize return: [1627]
2021-02-12 07:16:49, Error [0x0f0435] SYSPRP Callback_Specialize: An error occurred while either deciding if we need to specialize or while specializing; dwRet = 0x65b[gle=0x00000002]
2021-02-12 07:16:49, Info [0x0640ae] IBSLIB PublishMessage: Publishing message [Windows Setup could not configure Windows to run on this computer's hardware.]
Despite everything I have tried, it stops at the same point every time with the same message and the same logged errors. I did some research on the code c0020003 generated from the LsaOpenPolicy function and it appears to be an HRESULT code that maps to RPC_NT_INVALID_BINDING and the purpose of LsaOpenPolicy is to get a handle on the Windows policy object. Based on that, I'm guessing that for some reason, the LsaOpenPolicy function is not able to get get a handle on the policy object which might explain why the attempt to disable the administrator account on the next line also fails.
I have completely ran out of ideas, so I am hoping someone can provide some other suggestions to try