Solved: Misleading azure-arm: IMAGE_STATE_COMPLETE Loop When Building Windows Images with Packer

When building Windows images in Azure using the HashiCorp Packer Azure ARM builder, you may encounter a frustrating scenario:

• The Packer build completes provisioning
• Azure reports the image as IMAGE_STATE_COMPLETE
• But instead of finalizing, the build loops, hangs, or never completes

This error is misleading. Even though Packer reports the image state as complete, Sysprep has actually failed inside the Windows VM, and the build is stuck waiting for sysprep to finish.

This guide will show you:

• Why this happens
• How to access the underlying VM even during a running Packer build
• Where to find the real sysprep failure logs
• How to diagnose and fix the issue quickly

Why “IMAGE_STATE_COMPLETE” Is Misleading

The Azure ARM builder relies on Windows Sysprep to seal the image for capture.
If sysprep fails because of:

• Installed applications that block sysprep
• Pending Windows updates
• Domain-join artifacts
• Windows Store apps
• Incorrect unattend.xml entries
• Generalize failures
• Provisioning agent conflicts

Packer does NOT immediately fail.
Instead, Packer sees Azure return an “image state complete” status… even though sysprep is stuck and never finishes.

The result is an infinite or long-running loop:

==> azure-arm: IMAGE_STATE_COMPLETE
==> azure-arm: IMAGE_STATE_COMPLETE
==> azure-arm: IMAGE_STATE_COMPLETE

This tells you nothing about the real underlying failure.

The Real Issue Is Inside Windows: Sysprep Failed

To discover the actual reason, you must inspect the Windows logs inside the temporary VM Packer created.

Step 1: Access the Running VM (Reset the Admin Password)

Even though Packer hasn’t finished, Azure has already created the VM in your resource group.

Azure allows you to reset the admin credentials of any running VM including temporary Packer builder VMs.

In Azure Portal:

1. Go to Virtual Machines
2. Locate the Packer build VM (usually the name starts with pkr-)
3. In the left menu, select
   Support + Troubleshooting → Reset password
4. Choose:
   • Mode: Reset password
   • Username: Administrator
   • Password: (enter a strong temporary password)

Click Update.

You can now RDP into the VM while Packer is still running.

Step 2: RDP into the VM

Using RDP Connect using the admin credentials you just reset.

You are now inside the machine that Packer is trying to sysprep.

Step 3: Open the Sysprep Logs

The critical logs are in the Panther directory:

C:\Windows\System32\Sysprep\Panther\setupact.log

This log contains detailed sysprep errors such as:

• Application blocking sysprep
• Provisioning package issues
• SetupComplete.cmd failures
• Unattend.xml errors
• Windows Store/UWP app conflicts
• “Sysprep was not able to validate…”
• “Package XYZ was installed for a user but not provisioned”
• “Failed to remove staging package”

Other useful logs include:

C:\Windows\System32\Sysprep\Panther\setuperr.log
C:\Windows\Panther\UnattendGC\setupact.log
C:\Windows\Panther\setupact.log

These logs will reveal the exact reason Sysprep failed — something Packer does not surface.

Common Sysprep Failures You’ll See

Typical entries inside setupact.log include:

1. Windows Update Pending

SYSPRP Failed to remove apps for the current user

2. Provisioned App Block

Failed to remove provisioned package Microsoft.ZuneMusic

3. Third-party software preventing generalization

Antivirus, agents, or monitoring tools often cause:

SYSPRP SysprepInternalCleanup: Error in removing package

4. Unattend Configuration Errors

Failed to process Unattend settings

5. Domain Join Artifacts

Leftover domain membership or directories.

Once you know the exact failure, you can create a fix inside your Packer provisioners.

Step 4: Fix the Issue and Rebuild the Image

Based on the error you find:

Examples of fixes:

Remove Windows Store apps before sysprep

Get-AppxPackage -AllUsers | Remove-AppxPackage
Get-AppxProvisionedPackage -Online | Remove-AppxProvisionedPackage -Online

Remove blocked packages

Remove-AppxPackage -Package <package-name>

Apply pending updates

Install-WindowsUpdate -AcceptAll -IgnoreReboot

Ensure no reboot pending

Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending

Clean staged apps

dism /online /cleanup-image /startcomponentcleanup /resetbase

After applying the fix, rebuild using Packer:

packer build windows.json

Conclusion

The azure-arm: IMAGE_STATE_COMPLETE loop is one of the most misleading errors when building Windows images with Packer. It suggests the image is complete but in reality, sysprep has failed silently inside the VM.

To fix the issue:

1. Reset VM admin password in Azure
2. RDP into the VM
3. Inspect C:\Windows\System32\Sysprep\Panther\setupact.log
4. Fix root cause
5. Rebuild image

Once you understand how to access the VM and read the Panther logs, diagnosing Packer Windows build failures becomes dramatically easier.