Preserve Azure's provisioning media path in a generalized Windows image

Source facts

Azure mounts an ISO through the DVD-ROM when creating a Windows VM from a generalized image; disabling that device can leave the guest stuck in the out-of-box experience. Microsoft also directs image authors to check for policies denying removable-storage access. Generalization is irreversible, and the source says not to restart the VM after Sysprep. Installed applications must support the preparation process, as must the server roles. Microsoft Learn.

Applicability

Use this check for a Windows image intended to be generalized, not a specialized image retaining its existing machine state. Identify policies and hardening settings applied to the image, including those inherited from another environment. Review the complete Sysprep prerequisites before scheduling the preparation.

DSE recommendation

Check DVD-ROM availability and removable-storage restrictions on the image copy before running Sysprep. Have the image and security owners agree on a preparation configuration that permits Azure provisioning. Review application-specific preparation requirements rather than assuming every installed agent supports cloning. Preserve an approved working source and perform the irreversible operation only on the designated image-production copy.

Verification

Deploy a representative new VM from the resulting generalized image and confirm that initial provisioning finishes. Test expected application startup and the intended post-provisioning security configuration. Retain the image version, preparation settings, and first-boot outcome together. If the guest stalls during initial setup, compare the media-access path and policies with the documented prerequisites before repeatedly rebuilding or restarting the generalized source VM.

Official references

Microsoft Learn: Deprovision or generalize a VM before creating an image. Source reviewed September 9, 2026.