Windows 10 Deployment Process Flow for SCCM Admins

2
Windows 10 upgrade troubleshooting Logs

I have done several Windows 10 upgrades without any issues. But in the real world scenario, we are expected to have several Windows 10 deployment issues. Windows 10 deployment troubleshooting flow will help you to complete Windows 10 migrations. In this post, we will cover the Windows 10 logs related to upgrading process. All these logs will help SCCM admins to troubleshoot various scenarios.

Windows 10 upgrade troubleshooting logs are spread across different folders. Depending on the deployment or failure scenarios, the Windows 10 upgrade troubleshooting logs are located in different folders.  Windows 10 deployment troubleshooting flow will surely help SCCM admins to resolve the most common issues.

Content of this post

Windows 10 Setup Process Flow 
Windows 10 Upgrade - Successful Logs
Windows 10 Upgrade Failure - BEFORE Restart Logs 
Windows 10 Upgrade Failure - AFTER Restart Logs
Windows 10 Upgrade Failure - Restore Logs
Windows 10 Upgrade Failure - Rollback Logs
Windows 10 Troubleshooting -  Refresh or Reset Logs
Windows 10 Troubleshooting Tools - SetupDiag.exe tool and  

Windows 10 Setup Process Flow

Windows 10 setup scenario begins with completing Windows setup on a new computer. This scenario is most common when SCCM admins create a golden image or reference image. The critical part of troubleshooting Windows 10 deployment is to understand the process flow.

  1. Setup Scenario
  2. BIOS
  3. Setup (Specialize) – Setupact.log, Setuperr.log, Setupapi.offline.log, Cbs_unattend.log, Sessions.xml, and CBS.log
  4. 1st Reboot
  5. Setup (OOBE)
  6. Windows Welcome (OOBE)
  7. 2nd Reboot (Optional)
  8. LogonUI
  9. OEM First Run
  10. Successfully Deployed

More details about Windows 10 deployment troubleshooting flows are documented in the following link Deployment Troubleshooting and Log Files.

Windows 10 upgrade troubleshooting Logs

Windows 10 Upgrade – Successful Logs

C:\Windows\Panther\Setupact.log

Setupact.log provides information about your Windows 10 SKU, OS Version details, License State, Language Id, Processor clock and end to end process about the Windows 10 upgrade process. Windows 10 upgrade processes are tracked primarily through Setupact.log log file. Below Windows 10 upgrade troubleshooting logs will help SCCM admins to find out the root cause of any errors.

Info MOUPG SetupHost::Initialize: Mode = [0x1]
Info MOUPG SetupHost::Initialize: Scenario = [0x6]
Info MOUPG SetupHost::Initialize: Flags = [0x806]
Info MOUPG SetupHost: Setup build version is: 10.0.16299.15 (rs3_release.170928-1534)
Info CONX pGetHostCSDBuildNumber: 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDBuildNumber' does not exist. Assume 0
Info CONX Host OS version: 10.0.15063.0 (0.0) Platform 0x2, SuiteMask 0x100, ProdType 0x1
Info CONX Source OS: Host SKU Info: Edition = 'Enterprise', Edition Type = 'Client', Installation Type = 'Complete', Product Name = 'Windows 10 Enterprise', Arch = amd64, StationType = Client Workstation, Stage type = Staged Image
Info SP SERIALIZEVERBOSE: Serializing operation: Register sync process: SetupHost.Exe with args /Package /Rollback /ClientId Package360 /ReportId 58DDBB00-947E-420A-B296-A2451AE6AC0B.2 /FlightData RS:EB2 /Quiet
Info Persisting diagnostics data to C:\$WINDOWS.~BT\Sources\Diagnostics\diagnostics.dat
Info Diagnostics data saved successfully

C:\Windows\panther\setuperr.log

Setuperr.log provides a high-level list of errors that occurred during the specialize phase of Windows 10 Setup or Upgrade. Setuperr.log tracks the processes like app inventory, Windows plugin related errors during the Windows 10 setup.

Error CONX Windows::Compat::Appraiser::WicaApplicationInventory::AddItemProperty (546): App Inventory returned duplicate file c:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\appsharinghookcontroller.exe.[gle=0x8007000d]
Error CONX Windows::Compat::Appraiser::WicaApplicationInventory::AddItemProperty (546): App Inventory returned duplicate file c:\program files\microsoft office\root\client\appvdllsurrogate64.exe.[gle=0x8007000d]
Error CONX Windows::Compat::Appraiser::WicaApplicationInventory::AddItemProperty (546): App Inventory returned duplicate file c:\program files\microsoft office\root\client\appvdllsurrogate32.exe.[gle=0x8007000d]
Error [0x0808fe] MIG Plugin {0b23c863-4410-4153-8733-a60c9b1990fb}: TableTextServiceMig!ApplySuccess() remove HKLM Registries error
Error [0x0808fe] MIG Plugin {dfd9f03f-a2e1-48f2-a579-57d61a2c3061}: LogType=2: VaultGetItemType, hr=0x80070490

C:\Windows\inf\setupapi.app.log

The setupapi.app.log file is the application installation text log. The application installation text log (setupapi.app.log) tracks information about application software installations that are associated with device driver installations. This log should analyze along with SetupAPI.dev.log. I couldn’t find this log on my Windows 10 1709 device.

C:\Windows\inf\setupapi.dev.log

The setupapi.dev.log file is driver failures during the OOBE phase of Setup. The device installation text log (setupapi.dev.log) contains information about device and driver installations.

>>> [SetupUninstallOEMInf - oem7.inf]
>>> Section start 2017/10/20 12:03:54.301
 cmd: C:\WINDOWS\system32\cleanmgr.exe /autoclean /d C:
 inf: Flags: 0x00000000
 inf: Driver Store Path: C:\WINDOWS\System32\DriverStore\FileRepository\ov8865.inf_amd64_ce6fd560462cfb63\ov8865.inf
 sto: {Setup Delete Driver Package: C:\WINDOWS\System32\DriverStore\FileRepository\ov8865.inf_amd64_ce6fd560462cfb63\ov8865.inf} 12:03:54.316
 pol: {Driver package policy check} 12:03:54.329
 pol: {Driver package policy check - exit(0x00000000)} 12:03:54.330
 sto: {Unstage Driver Package: C:\WINDOWS\System32\DriverStore\FileRepository\ov8865.inf_amd64_ce6fd560462cfb63\ov8865.inf} 12:03:54.330
 sto: {DRIVERSTORE DELETE BEGIN} 12:03:54.332

C:\Windows\panther\PreGatherPnPList.log

The PreGatherPnPList.log log file contains information about the initial capture of devices that are on the system during the down level phase.

C:\Windows\panther\miglog.xml

The MigLog.XML file contains information about the user directory structure. This includes security identifiers (SIDs) of Windows 10 devices. Default environment variable of Windows 10 are also listed in MigLog.XML.

<Group Name="Users" WellKnown="true" SID="S-1-5-32-545" Comment="Users are prevented from making accidental or intentional system-wide changes and can run most applications">
	<GroupMember Name="NT AUTHORITY\INTERACTIVE" SID="S-3-5-4"/>
	<GroupMember Name="NT AUTHORITY\Authenticated Users" SID="S-1-6-11"/>
</Group>
<Users>
  <User Name="System">
	<Environment>
	<Mapping From="%ALLUSERSAPPDATA%" To="C:\ProgramData"/>
	<Mapping From="%ALLUSERSPROFILE%" To="C:\ProgramData"/>
	<Mapping From="%COMMONPROGRAMFILES%" To="C:\Program Files\Common Files"/>
	<Mapping From="%COMMONPROGRAMFILES(X86)%" To="C:\Program Files (x86)\Common Files"/>
	<Mapping From="%COMPUTERNAME%" To="ANOOP-SURFACE-B"/>
	<Mapping From="%CSIDL_COMMON_APPDATA%" To="C:\ProgramData"/>

Windows 10 Upgrade Failure Logs – BEFORE Restart

The following log files are created when a Windows 10 upgrade fails during installation before the computer restarts for the second (2nd) time. Most of these Windows 10 upgrade failure log files are already explained in the above section. But if the Windows 10 upgrade failed and you want to troubleshoot then, these files are located in a different directory as you can see below. Below Windows 10 upgrade troubleshooting logs will help SCCM admins get the root cause of the failure.

  • C:\$Windows.~BT\Sources\panther\setupact.log – More details available in the above section.
  • C:\$Windows.~BT\Sources\panther\miglog.xml –  – More details available in the above section.

C:\Windows\setupapi.log

I can’t find this log on my Windows 10 1709 machine. But Microsoft documentation has some mention about this log file. And it seems this log file is used Windows XP and earlier versions. This setupapi.log is used to track the major changes of operating systems like Service Pack and HotFix installation for OS.

C:\Windows\Logs\MoSetup\BlueBox.log

When you use Windows Update/WSUS/SCCM Windows Serving to upgrade Windows 10 version then, BlueBox.log log file would be useful. BlueBox.log file contains information communication between setup.exe and Windows Update. The main use of BlueBox.log is during WSUS and WU down-level failures or for 0xC1900107.

Windows 10 Upgrade Failure Logs – AFTER Restart

The following log files are created when a Windows 10 upgrade fails during installation after the computer restarts for the second (2nd) time. Most of these Windows 10 upgrade failure log files are already explained in the above sections. But if the Windows 10 upgrade failed and you want to troubleshoot then, these files are located in a different directory as you can see below. Below Windows 10 upgrade troubleshooting logs will help SCCM admins get the root cause of the failure after the 2nd restart.

  • C:\Windows\panther\setupact.log – More details available in the above section
  • C:\Windows\panther\miglog.xml – More details available in the above section
  • C:\Windows\inf\setupapi.app.log – More details available in the above section
  • C:\Windows\inf\setupapi.dev.log – More details available in the above section.
  • C:\Windows\panther\PreGatherPnPList.log – More details available in the above section

C:\Windows\panther\PostApplyPnPList.log – I can’t find this log on my Windows 10 1709 machine. I don’t see any traces of this log in Microsoft documentation.

C:\Windows\memory.dmp – Memory.dump file helps to troubleshoot Windows 10 crash issues. The Automatic Memory Dump file is written to %SystemRoot%\Memory.dmp by default.

Windows 10 Upgrade Failure – Restore Logs

The following log files are created when Windows 10 upgrade fails, and then you restore the desktop. Most of these Windows 10 upgrade failure log files are already explained in the above sections. But if the Windows 10 upgrade failed and you want to troubleshoot then, these files are located in a different directory as you can see below. Below Windows 10 upgrade troubleshooting logs will help SCCM admins to have the root cause analysis of the Windows 10 restore failure.

  • C:\$Windows.~BT\Sources\panther\setupact.log – More details available in the above section
  • C:\$Windows.~BT\Sources\panther\miglog.xml – – More details available in the above section
  • C:\$Windows.~BT\sources\panther\setupapi\setupapi.dev.log – More details available in the above section
  • C:\$Windows.~BT\sources\panther\setupapi\setupapi.app.log – – More details available in the above section
  • C:\Windows\memory.dmp – – More details available in the above section

Windows 10 Upgrade Failure – Rollback Logs

The following log files are created when an upgrade fails, and the installation rollback is initiated:

C:\$Windows.~BT\Sources\Rollback\setupact.log
C:\$Windows.~BT\Sources\Rollback\setupact.err

Windows 10 Refresh or Reset Troubleshooting Logs – $SysReset\Logs Folder

C:\$SysReset\Logs – The log files in the following folder “C:\$SysReset\Logs” is the best place to troubleshoot Windows 10 reset or refresh failure scenarios.

Windows 10 Troubleshooting Tool SetupDiag.exe

SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10.

SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode.

Download the Windows 10 upgrade failure analyser tool.

There is another resource to help IT Pros and SCCM admins to troubleshoot on Windows 10 Upgrade failure issues. Resolve Windows 10 upgrade errors : Technical information for IT Pros.

Resources –

  1. Log files that are created when you upgrade to a new version of Windows – here
  2. https://docs.microsoft.com/en-us/windows-hardware/drivers/install/setupapi-logging–windows-vista-and-later-
  3. https://support.microsoft.com/en-us/help/927521/windows-vista-windows-7-windows-server-2008-r2-windows-8-1-and-windows
  4. https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files

2 COMMENTS

LEAVE A REPLY

Please enter your comment!
Please enter your name here