When does plug and play detection occur in the sysprep process?

Question

I am working on a Windows 7 image for my organization. We use a Token based activation package which requires installation during audit mode. Here is my process

On my Master computer:

1. Using our base image disc, install OS. [I cannot boot to Audit mode during setup, I must install the OS in its entirety first]
2. Install all software updates
3. Sysprep /generalize /audit /shutdown /unattend:unattend.xml
4. Install Token based activation
5. Sysprep /oobe /shutdown /unattend:unattend.xml
6. Capture image

When testing the image, however, it seems that plug and play detection was done too early in the process, I'm assuming during the specialize phase, which would occur in between step 3 and 4. In reality, I need it to occur after step 6.

The token based activation MUST be executed AFTER the generalize phase. The generalize phase will wipe out the certificates I install.

What it boils down to:

1. When does the plug and play detection occur?
2. If it occurs in the wrong spot, is it possible to make it occur AGAIN?