Ok so I understand how sysprep works a little better. when you run sysprep with the /unattend switch it actually caches the file passed to it and puts the file into
When sysprep starts up for the first time it checks several locations in a certain order, the first being a reg key and 2nd or 3rd is the cache'd unattend.xml in panther and lastly it checks c:\unattend.xml
if it finds something in the Panther folder it runs that, it doesnt matter what changes you make to c:\unattend.xml if you have one sitting in the Panther directory it will always use that first. I mounted the image using
imagex.exe /mountrw myimagefile 1 c:\mount
and went into the image and removed the unattend.xml from the panther location and did a unmount and commit and it was all fine. Remember to commit though.
Hope this helps anyone else struggling with the /unattend switch.