Sysprep W11 24H2 with updates failed with ShellHost.exe - System Error

[woodle]

Hi all,

I hope someone can help me solving the following issue:

When I deploy a new Virtual Machine from an Template with Windows 11 24h2 newer than Build 26100.1742 and a VM Customization Specification which creates a new SID, change name, etc sysprep fails with the following message:

This is also written in 

Windows 11 24H2 Guest OS Customization Fails with ShellHost.exe Error

Broadcom		remove preview
Windows 11 24H2 Guest OS Customization Fails with ShellHost.exe Error VMware engineering has been collaborating with Microsoft on this issue. In the meantime, the following workarounds have been confirmed to work around the issue: Workaround Option 1: Use an Earlier Windows Build Use Windows 11 24H2 GA build 26100.1742 image without any updates to deploy Windows. Apply guest customization to this clean build. View this on Broadcom >

and

https://community.omnissa.com/forums/topic/68871-windows-error-message-after-upgrade/

As we need to keep our templates "up to date", especially when joining the domain, we need a solution for this.

Broadcom points to Microsoft, Microsoft points to Broadcom who need to solve this issue - bad for all customers.

Did someone find a solution to sysprep updated Windows 11 machines with vSphere Customization Preperation Templates?

Any help is welcome.

Michael

[Pengpeng Sun]

Hi Michael,

You may have to keep your templates as Build 26100.1742 and do the customization to join domain, then update Windows in day2. For now, this is only solution I have until this issue is resolved.

[JohanFredr]

Can confirm this exact issue happens on Windows Server 2025 aswell - sysprep is broken on Windows 24H2.19 (30560_2026-04) and also on 24H2.20 (31272_2026-05)

I'm using packer to build my golden images and you need to go back to 2026-03 image from MS and exclude KB5087539 in your builds and unfortunately (as Pengpeng Sun wrote) handle that in Day-2 (which is not really an option i ephermal VDI's).

In my case it only breaks the local built in administrator accounts ability to show desktop. Creating a new profile works as intended does not show the symptom (but probably would if I were to use copy-profile).

Another workaround for Omnissa VDIs might be to not use OSOT Sysprep but rely on ClonePrep instead for new-sid-generation.

[Pengpeng Sun]

Hi JohanFredr,

Microsoft published a KB5072911 on this issue. To automate the workaround provided by Microsoft in Day1, please follow this Broadcom KB 400708 to add the PowerShell command to the Run Once command of Windows customization specification.