Last Updated on August 7, 2025 by Arnav Sharma
Welcome to our quick guide on Sysprepping and capturing a Windows VM in Azure. Whether you’re a cloud pro or just starting out, we’ll walk you through the essentials of creating a VM image that has been successfully created from a generalized standard, perfect for scalable deployments. Alright, let’s get started on creating an image!
Prepare the Windows VM:
- Start the VM in Azure if it’s not already running.
- Connect to the VM using Remote Desktop Protocol (RDP) and then preview its status.
- Once connected, ensure all the latest updates are installed and any required software is configured.
Run Sysprep on the VM:
- Open the Windows Command Prompt on your local machine as an admin.
- Navigate to the sysprep folder using the command:
cd %WINDIR%system32sysprep - Run sysprep with the following command:
sysprep /oobe /generalize /shutdown - This command will generalize your VM, prepare it for OOBE (Out-of-Box Experience), and then shut it down, proving the provision was a success.
Deallocate the VM:
- Return to the Microsoft Azure portal.
- Navigate to your VM and click on the “Stop” button to deallocate the VM. Using the ‘e.g’ command, it is important to preview the VM status because you can’t capture a VM that is running or suspended.
Capture the VM Image:
- In the Azure portal, navigate to your VM.
- Select the option “Capture” from the top menu.
- Provide a name for the captured image.
- You can choose to delete the VM after capture if it’s no longer needed.
- Select the resource group where you want to store the image.
- Click the “Create” button to start the capture process.
Using the Captured Image:
- Once the image is captured, it will be available in the specified resource group.
- You can use this image to create new VMs.
- To create a new VM from the captured image, navigate to the image in the Azure portal and select “Create VM”.
I help organisations secure their cloud infrastructure and stay ahead of evolving cyber threats. Microsoft MVP and Certified Trainer, author of Mastering Azure Security, and founder of arnav.au — a platform for practical Cloud, Cybersecurity, DevOps and AI content.
Frequently Asked Questions
Sysprep is a Windows system preparation tool that generalizes your VM by removing machine-specific information like SID and hardware identifiers. Running Sysprep is essential before capturing a VM image because it ensures the image can be used to create multiple new VMs without conflicts or duplicated system identifiers.
This command performs three actions: /generalize removes machine-specific data, /oobe prepares the VM for Out-of-Box Experience setup, and /shutdown automatically shuts down the VM after completion. This ensures your VM is properly prepared and safely powered down before capture.
Azure requires that the VM be in a deallocated (stopped) state before you can capture its image because a running or suspended VM cannot be reliably captured. Deallocating ensures the VM's state is consistent and ready for image creation.
Yes, you can delete the original VM after capturing its image if you no longer need it. Azure provides an option to automatically delete the VM during the capture process, or you can do it manually afterward since the image now contains all the necessary data.
After your image is captured and stored in a resource group, navigate to the image in the Azure portal and select the 'Create VM' option. You can then configure the new VM settings, and Azure will create a new instance based on your captured image.