Checking to see if a PC was “cloned / ghosted”

Q. How can I check whether my installation was a fresh installation or was created via a Sysprep image?

A. To determine whether an installation was created via a Sysprep disk image, perform these steps (on Windows NT 4.0 or later):

1. Start the registry editor (regedit.exe).
2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\Setup registry subkey.
3. If the CloneTag subkey exists, your machine was created from a Sysprep image. The value of the CloneTag subkey is the date and time that the image was created.
4. You’ll also see a CmdLine subkey, which is the command that runs on the machine’s first start-up (e.g., “setup.exe -newsetup – mini,” which tells the setup to perform a mini, GUI-based setup).

Curiously enough, under Vista it does show a CloneTag subkey.

(information originally from Windows Tips & Tricks UPDATE–February 14, 2005, maybe)