image the os w/o the need to logout from windows

It varies but some will run as system and most take a snapshot so it can still copy the snapshot files

cactus9 said:

....what do you mean by snapshot?

This....

Shadow Copy (also known as Volume Snapshot Service,^[1] Volume Shadow Copy Service^[2] or VSS^[2]) is a technology included in Microsoft Windows that can create backup copies or snapshots of computer files or volumes, even when they are in use. It is implemented as a Windows service called the Volume Shadow Copy service.

Shadow Copy - Wikipedia

If you create an image with Macrium Reflect, you will see a screen similar to this:


- and you will see it tells you it's creating a snapshot.

Once done, you can use your PC whilst the image is being created.

Shadow Copy - Wikipedia

- and a little insight from Macrium (advanced):

The shadow copy storage area

Windows creates VSS snapshots at various points, as does Reflect as part of the backup process. While the snapshot is live, the copy on write process intercepts all writes to the disk, storing the data that is about to be over-written in the shadow copy storage area (also known as the diff area). The size of this diff area can be considerable. This is why pre-restore system restore points are not available in a restored system.

The diff area data is not excluded from image backups created in the Macrium rescue environment. The exclusion of the diff area is orchestrated by the VSS system optimisation writer, however the Windows snapshot subsystem is not available in Windows PE or RE. Therefore, you will find that image backups taken in the rescue environment will be larger.²