Hi there! It's BOB.
Here's a fun fact about home labs: you will install Windows Server a lot. Domain controllers, file servers, a certificate authority, that test box you broke on purpose, that other test box you broke not on purpose…
Each install takes time: Setup, drivers, guest agent, updates, more updates, the update that installs after the updates. By the fifth one, you'll wish you could just make copies.
You can! Today we'll Sysprep a Windows VM, turn it into a Proxmox template, and stamp out new servers like cookies. 🍪
What Is Sysprep, and Why Can't I Just Copy the VM?
You could clone a regular VM. Proxmox will happily do it. But you'd end up with two Windows installs that think they're the same computer: same computer name, same machine identity, same everything. Join both to a domain and things get confusing fast.
Sysprep (System Preparation Tool) is Microsoft's built-in fix. Its generalize step strips out everything that makes an installation unique, so each copy gets a fresh identity on first boot. Microsoft only supports cloning Windows installs that have been through Sysprep, so it's the right habit to build.
💡 BOB's tip: You might hear that "duplicate SIDs don't really matter." Sysinternals' Mark Russinovich famously wrote about that back in 2009. True or not, Microsoft's support policy still says: Sysprep before you clone. It takes five minutes. Just do it.
1. Build the "Golden" VM
Start with a Windows Server VM set up the way you like it. (My last article covers the best Proxmox settings and the VirtIO drivers.) Then:
- ✅ Install the VirtIO drivers and the QEMU Guest Agent.
- ✅ Run Windows Update until there's nothing left.
- ✅ Add anything every server should have: your favorite tools, PowerShell modules, settings.
- ❌ Don't join it to a domain. Join the clones instead.
- ❌ Don't install server roles like AD DS or AD CS. Those belong to individual servers.
- ❌ Never Sysprep a domain controller. It isn't supported, and it won't end well.
Eject the ISOs from the CD drives while you're at it.
2. Run Sysprep
Inside the VM, open an elevated prompt:
C:\Windows\System32\Sysprep\sysprep.exe /generalize /oobe /shutdown
What each switch does:
| Switch | What it does |
|---|---|
/generalize |
Removes the unique stuff (identity, computer name, activation state) |
/oobe |
On next boot, shows the "out-of-box experience": the setup screens for region, keyboard and admin password |
/shutdown |
Turns the VM off when done, instead of rebooting into setup |
Wait for the VM to power off on its own. Don't start it again! If it boots, it runs the OOBE and personalizes itself, and you'd have to Sysprep again.
⚠️ Heads up: If Sysprep fails, the reason is in
C:\Windows\System32\Sysprep\Panther\setupact.log(andsetuperr.log). On Windows 11 clients, a common cause is a Store app that was updated for one user but not for the whole system. Server is usually much better behaved.
3. Convert It to a Template
In the Proxmox web interface, right-click the VM and choose Convert to template. Or from the host's shell:
qm template 9000 # 9000 = your VM's ID
The icon changes, and the VM can't be started anymore. It's now a read-only master copy.
💡 BOB's tip: Give templates high VM IDs (like 9000 and up) and clear names like
tpl-win2025-std. They sort to the bottom of the list and nobody starts them by accident.
4. Clone Away!
Right-click the template → Clone. Give it a new VM ID and name, and pick a mode:
| Linked clone | Full clone | |
|---|---|---|
| Speed | Nearly instant | Copies the whole disk |
| Disk space | Only stores changes | A full copy |
| Depends on the template? | Yes. You can't delete the template while linked clones exist | No, it's completely independent |
| Good for | Quick throwaway test VMs | Servers you'll keep |
From the shell:
qm clone 9000 201 --name dc01 --full # a full, independent copy
qm clone 9000 202 --name test01 # a linked clone (needs storage that supports it)
Proxmox gives every clone a new MAC address, so you won't get network conflicts. Start the clone, walk through the short OOBE screens, set the admin password, rename the computer, and you've got a brand-new server in a couple of minutes.
5. Keep the Template Fresh
Templates get stale. Every few months:
- Clone the template to a regular VM.
- Boot it, patch it, add anything new.
- Sysprep it again with the same command.
- Convert it to a new template (
tpl-win2025-std-2026-10, for example), and delete the old one once nothing depends on it.
⚠️ Heads up: Windows limits how many times one installation can be generalized and still keep its activation timer happy. Updating by cloning from the template (rather than re-Sysprepping the same disk over and over) keeps you well clear of that.
Extra Credit: Skip the OOBE Screens
Clicking through region and password screens on every clone gets old. Sysprep can take an answer file (unattend.xml) that fills them in for you:
sysprep.exe /generalize /oobe /shutdown /unattend:C:\Windows\Panther\unattend.xml
You build answer files with Windows System Image Manager, part of the free Windows ADK. It's a fun weekend project, but completely optional. The plain OOBE is only four screens.
Wrapping Up
- Build one golden VM: drivers, guest agent, updates, tools. No domain, no roles.
- Sysprep it:
/generalize /oobe /shutdown, then don't boot it. - Convert to template, then clone: linked for quick tests, full for keepers.
- Refresh the template every few months so new clones don't start with a mountain of updates.
Now go stamp out some servers! 🍪
See you next time!
— BOB
Sources
- Microsoft Learn: Sysprep (Generalize) a Windows installation
- Microsoft Learn: Sysprep command-line options
- Microsoft Learn: Sysprep support for server roles
- Microsoft Learn: Microsoft policy for disk duplication of Windows installations
- Mark Russinovich: The Machine SID Duplication Myth
- Proxmox VE Administration Guide: VM Templates and Clones