I know I'm not the only one, but I have a big issue since upgrading the 3.6 and that issue is that once the build gets to 'Set Engine Run Key', it hangs there and does not progress the build until I logon. It does seem my experience is slightly different in that I can logon and the build will continue.


Pre-installation tasks run OK (disk is formatted, Get Computer Name etc all run). Mid-level tasks all run OK (Image is applied, drivers install). Post installation tasks DO NOT RUN due to being stuck on 'Set Engine Run Key' which shows as 'In Progress' for all eternity.

Logging onto the PC will continue the build, i.e. all post-installation tasks run and complete and the PC can then be used.

KACE has a an answer for this issue and that is that the network drivers are not installed. However this solution is wrong. I don't think KACE tested anything, they just said "typically this means the PC can't communicate with the K2000 and it's because network drivers aren't installed).

However, I can remotely view event logs, services, and whatever else I want so the network drivers are installed and working fine.

What I do believe is that KACE attempts to logon (but with what account I don't know) but I think it tries too soon or something, the PC doesn't logon and that KACE does not try to logon again. It will then just sit there until you logon and once logon is successful, it will carry on as if nothing happened.

Any guidance on what this might be is highly appreciated, but also this is just to highlight that this is an issue and KACE's answer is not acceptable.


Someone who's team now has to logon to all PC's being built to complete the imaging process.

Answer Summary:
11 Comments   [ + ] Show Comments


  • Here, here. Having this same issue. Was on my project list starting next week to look into it...

    I don't see how it can be the network driver in my case either. If it's the driver wouldn't I have to manually install it after logging in? The network drivers for the models I've tested are definitely in my image and the driver feed is enabled. I can also access the systems remotely while they are stuck at this stage. Nothing has changed in that regards since I updated to 3.6.
  • Hi jegolf. Yeah, it's not the drivers, that's just a convenient excuse for KACE until they figure out what's really going on. In the meantime support has actually taken a copy of my .wim to test in their own lab so I'll put up the results of that here once they get back to me.
  • I've submitted a ticket through to support as well so it is logged with them. I'll report back any findings on my end too. I see another post that states they rebuilt a fresh image and aren't having any issues...but I don't want to have to do that right now. I build my yearly images each summer and it takes time and focus. Plus I like to build it on our new hardware which we don't have yet. But here I am preaching to the choir...
  • You're not the only one. Unfortunately there is zero help with support on this one. I'm guessing if you want it resolved, you'll probably have to spend time re-creating all of your images.

  • How they release something to us which clearly has a major flaw is so bad though. Do they not do UAT before release? I bet they tested it on brand new images captured in 3.6...although in saying that I captured a new image just to test and I still had the problem so I probably wouldn't waste your time there either.
  • I tried an image re-cap as well. The issues remains. Setting an auto-logon in your sysprep answer file should take care of this - but it's annoying that is the case as this is a built-in post-install task we have no control over...

    I will probably just end up setting an autologon count so I can image without having to manually intervene in the meantime. Going to test that next...
  • So I did some more investigation and as the build stops where we all know it stops, I was able to browse the files on the PC while the build was paused. In the C:\KACE folder I found the post-install task for 'Set Engine Run Key' and what it does is simply add a value to the Run or RunOnce registry key under HKLM. The RunOnce is to kick off C:\Kace\Engine\KaceEngine.exe. KaceEngine.exe simply initiates all the remaining post-install tasks. The problem with both the Run and RunOnce reg keys is they are designed to run at user logon, hence this completely explains why the build continues after we logon.

    What I can't figure out is why this works for anyone or why KACE expects it to work at all, seeing though, as mentioned, those registry keys are executed at logon, and never before.

    What I have done, and am testing now, is create a startup script with a .bat file that says IF C:\Kace\Engine\KaceEngine.exe exists, Run C:\KACE\Engine\KaceEngine.exe.

    I know the build can complete without logon as I also deployed the KACE client to the PC while the build was stuck and sitting at the logon screen. I then ran a script via KACE to do the same (run KaceEngine.exe) and sure enough, all remaining post-install tasks ran while the PC sat at the logon screen.

    This is far from an ideal workaround but until KACE realise their mistake, it might have to do (if it works, which as mentioned, testing now).

    • Twit, were you successful in creating a script that runs KaceEngine.exe before the first logon? If so, would you be able to share that with me and where you placed it? If I could do this all my issues would go away. Thank you!
  • I added one autologon count to our sysprep unattend file and the imaging process completed without incident. This is what I'm going to do as a solution for now. Just FYI this can be done easily by browsing the image and updating the unattend.xml file located in the c:\windows\panther directory.
    • Good to know. Do you mean you mount your wim image, make changes then commit?
  • I'm actually using K-images...you can browse the image, makes changes, and commit directly from the System Image Detail screen.
    • Oh right. I'm using WIM's. Makes it that bit harder. Not the new built-in WIM method though, that implementation by KACE is another dogs breakfast because you can't edit the WIM offline. Basically with each release lately, they do something to annoy me haha. Cheers, at least we have our workarounds.
  • jegolf, I just built an auto-logon into my answer file, same as you but I have a problem. The auto-logon enters Ctrl-Alt-Del but we have a legal dialog that appears before entering username and password and it does not automatically get past that legal dialog. This seems silly, surely Microsoft would plan for this event? Do you know if I can force it past so that the logon can continue?
  • Oh my gosh, I am so happy I found this thread. I've had a case in with support for a couple of weeks now and I'm not getting anywhere. They think I'm crazy because of how things used to work before I upgraded to 3.6, and I'm SO HAPPY to see I'm not the only one with the issue.

    My issue is that on my images I had a post-install task that would join the domain. Then, in my sysprep config I had the auto-logon set to log in as a domain user. I need this because I have another script that runs on first login that requires domain priveleges. It worked flawless for me before the upgrade because the post-install tasks would run BEFORE the first logon. Now, since the "set Engine Run Key" and post-install tasks don't complete until you login, my imaging process fails. I can auto-logon as a local account and everything "works", but I have to manually log in as a domain user when it's done to run my script. That is NOT how it worked before.

    Support doesn't even believe me when I tell them that on the previous versions that post-install tasks ran before the first logon.

    It is NOT a problem with my image. It is NOT a problem with my sysprep config. It is NOT a problem with my network drivers. It is NOT a problem with my post-install tasks. It's an issue with "Set System Run Key" not running until a user logs in.
    • Hi MisterVertigo. You posted 2 replies but I'll comment on both here. First thing if you can be bothered is to show KACE this thread. They are always very reluctant to hear about major issues but I will happily confirm that up to 3.5 I was the same as you, all post-install tasks ran before the logon screen appeared.

      Next thing, unfortunately my idea of running KaceEngine.exe before logon was never 100% successful. I got the idea in theory to work in that the file can be initiated without logging on but that was only once the KACE agent was deployed and for the purpose of testing. In practice, the idea didn't work. Also, by running it manually it tends to leave files behind and could potentially run a 2nd time when a user does finally logon, attempting to re-install applications again so that was too big a risk.

      My recommendation to you is to do what I had to do. It's a pain in the... leg but in the end it works. If your answer file joins the domain, take that out. Don't join the domain. Also, get your answer file to create a local admin account rather than a domain account and then get your auto-logon to logon using the local account. If you need help updating the answer file by mounting a WIM, let me know.

      Ok so you update the answer file as above and the PC logs on automatically, allowing KaceEngine.exe to run and process post-install tasks. The other thing you need to do is join the domain using the K2000 task (they provide an example job, just duplicate it and edit the details). Run this task very last and then the PC will restart and it will be on the domain.

      Finally, regarding your script that runs. Without knowing what it does I can't really comment. However, our antivirus install relies on being on the domain so what I did was create a startup script using Group Policy. Startup scripts are run, as the name suggests, during startup and not after the user logs on (that would be a logon script). So if you're script is not user dependant, you could maybe make it a startup script instead.
      The only 'Gotchya' here is that a startup script runs at every startup so you would need to edit your script to say that if it's already run, or if a file is present, something like that, don't run again, i.e. Go to end.

      Hope all this helps. If you need anything more, let me know. Only too happy to help because I know what a pain this issue is.

      • Thank you so much for the reply, and I apologize for posting in two different places! As soon as I found this thread I updated my support ticket with a link to this thread and I directly quoted your posts. Thank you!

        My answer file is already set up to create a local admin account, and I do not join the domain in it either. What I kept telling support is that I have a post install task that joins the domain, and then in my answer file I had it set up to auto-logon as a domain user. It worked because the join domain task would run before the first logon, so the domain logon would be successful. I then had my .vbs script set up to run on the first logon and delete itself and all was great. Then they changed it so the post-install tasks ran AFTER the first logon and my whole setup fell apart because I can only auto-logon as a local account.

        I was going to try running the KaceEngine.exe file from the SetupComplete.cmd since those run before logon and see what happened. I deploy my Kace agent from a post-install task though, so it would not be installed yet when SetupComplete.cmd would run. Is this the method you tried? If you aren't familiar with SetupComplete.cmd, here is a good article I found that explains it pretty well: http://blog.unidesk.com/using-setupcompletecmd-windows-7-post-build-unattended-configurations-and-actions

        Just FYI, the script I'm trying to run takes the current computer's computer account in AD and adds it to a specific AD group. That is why it requires domain priveleges. I may be able to do a startup script, but like you said I need to be sure that it will only run once.

        Again, thank you for your response!
    • Weird, no reply link on your latest comment. I've not heard of SetupComplete.cmd before but if it relies on the KACE agent then you're stuck again because as you know, Post-install task won't run, including the KACE agent job.

      I do believe an answer file can be set to auto-logon as a domain account, why do think otherwise? If logging on as a domain account will resolve most of your issues, just do that. The issue I had here was I use the Ctrl-Alt-Del prompt and the auto-logon cannot get past that. So I had to not join the domain so that the group policy to set the Ctrl-Alt-Del didn't run and the auto-logon would work.

      I guess this just shows that each of us does things that little bit different and this issue is having a varied range of impacts.
      • SetupComplete.cmd does not rely on the KACE agent, it's a feature of Windows. I was just thinking about what you said about running KaceEngine.exe before the agent was installed. SetupComplete.cmd is basically a last script that runs after all the sysprep stuff runs, but before the computer logs on for the first time. One way a lot of people use it is to delete the sysprep answer file so it's not sitting on the drive after deployment.

        As far as setting auto-logon to a domain account, that is exactly what I did in the previous version. It just doesn't work now because the logon fails because it's not joined to a domain yet because the post-install tasks haven't ran yet. Hence, my problem! :)

        I just had a thought though. I could use the the SetupComplete.cmd command to join the domain. That would run before the first logon, and then I could set up my answer file to auto-logon as a domain user just like I always used to. Hmm...

        I will give this a try and see what happens. Thanks again, this conversation has given me new hope that I'll get a work around for this issue!
      • I think that could work, but you can even build the domain join into the answer file if SetupComplete.cmd doesn't work for you. It does sound like you might be able to get around this issue without too much effort now. Let me know how you get on.

      • Well, the SetupComplete.cmd does not work. I tested it out and it did not run my join domain script. After everything was done I started to do some digging and I found out why. Somewhere along the line KACE replaced the SetupComplete.cmd I created with their own, so mine never ran. Their version puts the KACEEngine.exe file in the RunOnce registry key. That is how that registry key gets set. This is also why the post-install tasks do not run until a user logs in. WIth the way this is set up it is 100% impossible to image a machine without using auto-logon in the sysprep config.

        I can do the domain join in the answer file and that may help, but then I will lose the ability to pick a computer name and that is unacceptable to me as well. I've been down that road before; that is why I have a post-install task to join the domain in the first place.

        I know it sounds like I'm being picky and stubborn, but I wouldn't be asking about it if it hadn't worked in the previous versions.

        At this point there are two options:

        1. KACE can fix the SetupComplete.cmd file to execute the KACEEngine.exe directly instead of putting it in the registry's RunOnce key.
        2. Give me the ability to add a command line to the SetupComplete.cmd file instead of just writing over the top of mine.

        I can't do either of these without help from support, and at this point they don't even understand my issue let alone how to help me. I'm going to try and escalate my ticket.

        Thanks again!
      • And also those things you're asking for would take some engineering so I'm not too positive about your chances. There is the pre and mid-level tasks "Get/Set Computer name" which will prompt for a computer name as a pre-install task then apply the computer name (by inserting into the answer file) as a mid-level task. That could get around your PC naming issue if you put a domain join into your answer file.
Please log in to comment

Community Chosen Answer


I had the same issue and after some troubleshooting I assumed it was related to my image. Note I also tried to apply image without inject unattend.xml just to see if was related to that. Still nothing. So I applied the image letting Windows doing the setup. When I tried to re-run sysprep on it I had the error described here: http://support.microsoft.com/kb/929828 then I realized that something was broken with sysprep procedure. I rebuilt from scratch the image installing fresh Windows and running sysprep again. Now post install tasks work like a charm. I still don't know why the very same image worked with 3.5 but I would give a try. btw, this articles http://www.kace.com/uk/support/resources/kb/solutiondetail?sol=SOL118913 explain how you should change post install tasks to work with 3.6. It has nothing to do with issue described but maybe you need to take a look as well.


Answered 04/07/2014 by: avisintini
Senior Yellow Belt

  • Hi, for me the issue was finally resolved by building in an auto-logon to the answer file. This allowed the RunOnce key in the registry to be processed, which is where there is a value which tells KaceEngine.exe to run, which is responsible for kicking off all post-installation tasks.
    • ok - in my case I had Autologon already settled into unattend.xml. When the process stucked Windows was already logged in so nothing prevented RunOnce to do its job. A question, did you have it in 3.5? I think the mechanism was more or less the same so at least one logon was needed.
      • Hi, no in 3.5 I did not have an auto logon. I even joined the domain as part of my answer file and all the post-install tasks ran before the Windows logon screen ever appeared. Therefore, a logon was not necessary. It definitely caught me off guard. So for the 3.6 upgrade I had to do all the post-install modifications KACE did let us know about, but also then had to have the auto logon added, remove the join domain from answer file, and re-package a couple of app installs that relied on being on the domain. I feel the KACE team's information on exactly what was going to change in 3.6 was lacking quite badly.
Please log in to comment



Hi, for me the issue was finally resolved by building in an auto-logon to the answer file. This allowed the RunOnce key in the registry to be processed, which is where there is a value which tells KaceEngine.exe to run, which is responsible for kicking off all post-installation tasks.

Answered 04/07/2014 by: twit
Fourth Degree Green Belt

  • Could you elaborate on your auto-logon answer file in detail.
    • Hi Tim, I'll assume you know how to mount the image and edit the answer file in an existing WIM because it saves me a lot of typing, but if not let me know and I'll try and explain.

      You need to edit your answer file and 1) Create a local account and 2) Set the auto-logon.

      To create the local account, add this to the answer file (I have put it under the OOBE pass):

      <LocalAccount wcm:action="add">

      *NOTE: Because I've set it to plain text, i.e. the password is visible in the answer file on imaged PC's, I have created a computer GPO to delete the answer file from all locations it gets stored so that it's deleted at first boot once on the domain and no user can therefore access it.

      Next you need to add the auto-logon like this (my auto-logon is directly beneath the local account creation mentioned above):


      *NOTE: I have ONE auto logon but you can have as many as you need (say if one of your post-install tasks triggers a reboot and you need to logon again to continue to remainder. Just change the LogonCount value. Once all post-install tasks have run, the PC reboots so you don't need to account for that.

      Hope this helps.
      • Ok thanks for the answer, I thought you had a script you ran besides the answer file. Also if you use the microsoft WAIK you can check the hide password.
      • You don't have to edit wim each time use a mid level task to replace unattend file into wimdows/panther
      • TimHR, I think I mentioned the possibility of using a script but it didn't really work, plus the auto-logon method is more of an "official" or maybe Kace-supported method if you like so I went with that in the end. For the hiding of the password using WAIK, for some reason in the early days of my SOE for some reason with that option selected, passwords in answer files were not working. This would be something I was doing wrong I'm sure but at the time I just went plain text. It may be something I should re-visit. Cheers.

        avisintini, thanks for the tip, but I'm not editing the answer file regularly and am comfortable with mounting the WIM. However if the mid-level task is an option and some people prefer it, then good to know there is an alternative to my way. Thanks.
Please log in to comment

I put in a ticket with Kace 3 weeks ago and nobody has gotton back to me.   Thank you for posting this.   Our Images are WIM images,  does anyone have any guidance on how to build an auto logon to the answer file? Or woulld we just need to build a new image?



Answered 04/11/2014 by: Jabeni
White Belt

  • I suggest to use scripted installation to deploy a fresh windows and then capture the image from that. The answer file made using the scripted installation wizard can be used as unattend file for sysprep. Trough the wizard you can easily add autlogon.
Please log in to comment
This content is currently hidden from public view.
Reason: Removed by member request
For more information, visit our FAQ's.

Answer this question or Comment on this question for clarity