startup questions

Hi there,
… still learning …
Here’s new question that you can hopefully help me with.

There’s a programme called “AuditMode” (C:\sysprep\factory.exe -logon) which loads at startup. EasyCleaner tells me that the entry is not valid. Also, the process is not shown in the Task Manager (unless it has another name).
I’ve done quite a bit of research with google but -honestly - didn’t understand what I found.
Can anyone tell me what this programme does, if it’s necessary, I can safely disable it, what restrictions I might encounter when I disable it? Why is it not a valid entry? Etc…

Thanks in advance for all your help.

It seems to me that this was a part of the pre-installation process. This is commonly booted up when you started up your computer for the first time. Sysprep is a Windows application for quickly installing the OS from image and is then (normally) deleted after use. Not sure why it is still on your drive though. Have you contacted the computer manufacturer about this?

When you do a fresh install on a computer it will be given a SID number. If you then image that computer and then put that image on another computer it will have the same SID number. Now this doesn’t hurt until you connect both of those computers to the same network. Having 2 or more PC’s on the same network with the same SID number can bring down the DNS server for that network.

What sysprep mainly does is once a PC has been imaged then you run sysprep and it changes the SID number to a different SID thus keeping the sys admin from having a heart attack.


thanks for the quick and informative replies. However, this leads me to ask two more questions:

  1. I only have 2 recovery cds (images) for Windows xp and no full version. If I disable factory.exe, will they still work. What about the hidden recovery partition? (Sorry, I forgot to mention that inmy first post)

  2. What is a SID number??? (I understood your explanation as it is very well written. However, I don’t know exactly what a SID number is or does.)

Thank you ever so much for helping me.

Here is a web page that explains what a SID is for:


Thanks for the quick answer and that excellent link, jasper2408.
I’m a bit wiser now. :smiley: As soon as I get an answer to the otehr question, I’ll have gained ultimate wisdom ;D

You guys too!!!

I think the application you mention is indeed for that recovery partition. Unsure if you can delete it or not. My personal opinion is yes, but check with your hardware manufacturer for this. Some OEM (Original Equipment Manufacturer) doesn’t allow you to remove this partition…

Normally the recovery CD’s are all that is needed, but some manufacturer like to make a recovery partition for support issues.

Hope this helps

Thanks triplejolt,
I didn’t want to delete anything. Just wanted to disable factory.exe (using “msconfig” and uncheck box).


Never seen this before, so can’t really say for sure. But probably not.
Write down the string and it’s location before deleting it, and try a reboot. Should be OK

Just remember to insert it again if you need to start the recovery process :slight_smile:

Thanks for all your help,
I disabled (not deleted) factory.exe in the startup menu, rebooted, and everything seems to work fine. IMO I even don’t need to enable it for the recovery process, as the file is still on the computer, it’s just not loaded on startup. As the recovery process is initialzied before the boot process begins, disableing the programme in startup should not affect the recovery process.
Or am I totally wrong???

You seem to be right as far as I know. Please feel free to post again if not :slight_smile: