detect windows 7 audit mode

Question

Background

OEMS, Sys Admins etc. often use OPK or WAIK for mass installation. During this they often ship some pre-installed applications. The installations of such applications happen when Windows installation enters in Audit Mode

Question

Using c#, how do I detect that Windows is currently in Audit Mode?

Answer 1

You need to check the registry:

• HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State
  for something other than IMAGE_STATE_COMPLETE
• HKEY_LOCAL_MACHINE\\System\\Setup for AuditInProgress

EDIT - as per comment:

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE could provide some information in this regard too...

For details see see

• http://technet.microsoft.com/en-us/library/cc721913%28v=ws.10%29.aspx
• http://msdn.microsoft.com/en-us/library/dd450713.aspx
• http://technet.microsoft.com/en-us/library/dd349350%28v=ws.10%29.aspx
• http://msdn.microsoft.com/en-us/library/ff794046%28v=winembedded.60%29.aspx