If you have created and image you like and deployed it, oobe and generalization runs. If you then decide you would like to go back and edit or update the image is it possible? Everytime I've tried to go back into audit mode the machine just re-runs oobe and re-generalizes itself. I can't seem to get back into audit mode to re-capture the image. Has anyone else run into this? If so is there a way to get around OOBE re-generalizing the image?
If your working on machine that had the image (or an earlier image) pushed to it, you most likely still have the unattend.xml file on the root of C:\ that is messing with you. Delete that and you should be fine.
Thanks, this along with deleting c:\windows\panther\unattend.xml allowed us to get back into Audit mode successfully.