JSI Tip 6930. Sysprep does NOT change ACLs on registry keys?

When you use the System Preparation tool (Sysprep.exe) to clone a system, Access Control Lists (ACLs) applied to registry keys are NOT changed during the mini-Setup wizard. When you inspect the permissions on the keys that should have their ACLs modified, you see the old Security ID or you receive an Account unknown error.

NOTE: If you create a local group and apply ACLs to it before running Sysprep.exe, the ACLs are NOT modified.

Microsoft is aware that the current versions of Sysprep do NOT change the ACL list applied to the registry.