Installing Windows from ISO for every new VM takes a long time. A Windows Server Sysprep template lets you clone ready-made VMs in minutes, each with its own SID, computer name and admin password. This is how VPS providers build their Windows templates.
Before you start
- A KVM or Proxmox host and a base Windows Server VM installed with VirtIO drivers; see install a Windows VM on KVM.
- Appropriate Windows licensing for every VM you deploy.
- Do not join the template to a domain.
Prepare the base VM
- Install all Windows updates and reboot until none remain.
- Install virtio-win guest tools (drivers + QEMU guest agent).
- Enable Remote Desktop and set the firewall rules you want every VM to have.
- Apply your baseline: power plan, time zone, disabled unneeded features. See Windows on KVM tuning.
- Clean up: empty temp folders, run Disk Cleanup, remove extra user profiles.
Optional: install cloudbase-init
cloudbase-init is the Windows equivalent of cloud-init. It can set the hostname, admin password, SSH keys and network from a config drive, which works with Proxmox's cloud-init options. Install it from the official installer and choose to run Sysprep at the end of setup, or continue below.
Generalize with Sysprep
Open an elevated command prompt and run:
C:\Windows\System32\Sysprep\sysprep.exe /generalize /oobe /shutdown /mode:vm/generalizeremoves the SID and machine-specific data./oobeshows the setup screens on next boot (or is driven by an unattend file)./mode:vmspeeds up first boot on the same virtual hardware.
Do not start the VM again after it shuts down, or you must Sysprep again.
Add an unattend file (optional)
An unattend.xml passed with /unattend:C:\unattend.xml can accept the licence terms, set locale and skip prompts so clones boot straight to a usable state. Never leave plain-text production passwords inside templates.
Convert to a template and clone
- Proxmox: right-click the VM → Convert to template, then Clone (full clone recommended).
- libvirt: keep the disk as a base image and use
virt-clone --original win-tpl --name win01 --auto-clone.
Start the clone, finish OOBE (or let cloudbase-init configure it), and set a unique admin password.
Troubleshooting
- "Sysprep was not able to validate your Windows installation": often a Store app installed per user; check
C:\Windows\System32\Sysprep\Panther\setupact.logand remove the offending app. - Clone has no network: NetKVM driver not installed in the template.
- Duplicate computer names: the unattend file hard-codes a name; use
*or let cloudbase-init set it.
Frequently asked questions
How many times can I Sysprep an image?
Windows limits rearms; rebuild the template from the base VM rather than Sysprepping clones repeatedly.
Do I need Sysprep for a single VM copy?
For domain-joined or networked machines, yes: duplicate SIDs cause problems with some tools and domains.
Does this activate Windows?
No. Activate each VM with your licensing method.