I'm looking for a/the way to tell if a given WIM was captured from a machine that was sysprep'd with the (equivalent of the) /generalize parameter. Interested in Server 2003 R2 as the source platform (x86 and amd64 architectures).
Server 2008 seems to do something with the Registry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State
Such that we can detect that at WIM mount. However, 2003 does not seem to have this or an equivalent that I can determine.
HKEY_LOCAL_MACHINE\System\Setup key
If you see a multi-string name of CloneTag then you know its been sysprepped with the /generalized tag. Under the Data you will see the date this was done.
sidenote:// Are you concerned about this in relation to KMS by any chance? If so there also ways to get CMID data from the KMS host, sort, and identify how many computers at your site haven't been generalized.