Windows Upgrade Troubleshooting Logs

Let’s discuss Windows Upgrade Troubleshooting Logs in this post. I have done several Windows upgrades without any issues. However, we are expected to have several Windows 10 deployment issues in the real-world scenario.

Let’s check the Windows 10 Deployment Upgrade Process Logs. These log files are also relevant to the Windows 11 Upgrade Process.

The Windows 11 deployment troubleshooting flow will help you complete Windows 10 migrations. In this post, we will cover the Windows 11 logs related to the upgrading process. All these logs will help SCCM admins troubleshoot various scenarios.

I have a new blog post about the SCCM Logs or SCCM log files in the following post. I would recommend reading that post to get more details about SCCM Log Files or SCCM Logs. This will surely help you with SCCM troubleshooting.

Windows Upgrade Troubleshooting Logs are spread across different folders. Depending on the deployment or failure scenarios, the logs are located in different folders. The Windows 10 deployment troubleshooting flow will surely help SCCM admins resolve the most common issues.

Windows 10 Setup Process Flow – Windows Upgrade Troubleshooting Logs

A Windows 10 setup scenario begins with completing a Windows setup on a new computer. This scenario is most common when SCCM admins create a golden image or reference image. Understanding the process flow is critical to troubleshooting Windows 10 deployment.

Windows 10 Setup Process Flow
Setup Scenario
BIOS
Setup (Specialize) – Setupact.log, Setuperr.log, Setupapi.offline.log, Cbs_unattend.log, Sessions.xml, and CBS.log
1st Reboot
Setup (OOBE)
Windows Welcome (OOBE)
2nd Reboot (Optional)
LogonUI
OEM First Run
Successfully Deployed

• SCCM Logs Files List Of ConfigMgr Logs Files MEMCM Logs
• Fix: Windows Update Issues For Windows 11 Errors Troubleshooting Tips

Windows 10 Deployment Upgrade Process Logs

C:\Windows\Panther\Setupact.log

Setupact.log provides information about your Windows 10 SKU, OS Version details, License State, Language ID, Processor clock, and the end-to-end process of the Windows 10 upgrade process.

Windows 10 upgrade processes are tracked primarily through the Setupact.log log file. The below Windows 10 upgrade troubleshooting logs will help SCCM admins find the root cause of any errors.

Info MOUPG SetupHost::Initialize: Mode = [0x1]
Info MOUPG SetupHost::Initialize: Scenario = [0x6]
Info MOUPG SetupHost::Initialize: Flags = [0x806]
Info MOUPG SetupHost: Setup build version is: 10.0.16299.15 (rs3_release.170928-1534)
Info CONX pGetHostCSDBuildNumber: 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDBuildNumber' does not exist. Assume 0
Info CONX Host OS version: 10.0.15063.0 (0.0) Platform 0x2, SuiteMask 0x100, ProdType 0x1
Info CONX Source OS: Host SKU Info: Edition = 'Enterprise', Edition Type = 'Client', Installation Type = 'Complete', Product Name = 'Windows 10 Enterprise', Arch = amd64, StationType = Client Workstation, Stage type = Staged Image
Info SP SERIALIZEVERBOSE: Serializing operation: Register sync process: SetupHost.Exe with args /Package /Rollback /ClientId Package360 /ReportId 58DDBB00-947E-420A-B296-A2451AE6AC0B.2 /FlightData RS:EB2 /Quiet
Info Persisting diagnostics data to C:\$WINDOWS.~BT\Sources\Diagnostics\diagnostics.dat
Info Diagnostics data saved successfully

C:\Windows\panther\setuperr.log

Setuperr.log provides a high-level list of errors that occurred during the specialised phase of Windows 10 Setup or Upgrade. It tracks processes like app inventory and Windows plugin-related errors during the setup.

Error CONX Windows::Compat::Appraiser::WicaApplicationInventory::AddItemProperty (546): App Inventory returned duplicate file c:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\appsharinghookcontroller.exe.[gle=0x8007000d]
Error CONX Windows::Compat::Appraiser::WicaApplicationInventory::AddItemProperty (546): App Inventory returned duplicate file c:\program files\microsoft office\root\client\appvdllsurrogate64.exe.[gle=0x8007000d]
Error CONX Windows::Compat::Appraiser::WicaApplicationInventory::AddItemProperty (546): App Inventory returned duplicate file c:\program files\microsoft office\root\client\appvdllsurrogate32.exe.[gle=0x8007000d]
Error [0x0808fe] MIG Plugin {0b23c863-4410-4153-8733-a60c9b1990fb}: TableTextServiceMig!ApplySuccess() remove HKLM Registries error
Error [0x0808fe] MIG Plugin {dfd9f03f-a2e1-48f2-a579-57d61a2c3061}: LogType=2: VaultGetItemType, hr=0x80070490

C:\Windows\inf\setupapi.app.log

The setupapi.app.log file is the application installation text log. The application installation text log (setupapi.app.log) tracks information about application software installations that are associated with device driver installations. This log should be analysed along with SetupAPI.dev.log.

I couldn’t find this log on my Windows 10 1709 device, but it is one of the Windows Upgrade Troubleshooting Logs.

C:\Windows\inf\setupapi.dev.log (helps with Windows Upgrade Process Troubleshooting Logs)

The setupapi.dev.log file is a driver failure during the OOBE phase of Setup. The device installation text log (setupapi.dev.log) contains information about device and driver installations.

>>> [SetupUninstallOEMInf - oem7.inf]
>>> Section start 2017/10/20 12:03:54.301
 cmd: C:\WINDOWS\system32\cleanmgr.exe /autoclean /d C:
 inf: Flags: 0x00000000
 inf: Driver Store Path: C:\WINDOWS\System32\DriverStore\FileRepository\ov8865.inf_amd64_ce6fd560462cfb63\ov8865.inf
 sto: {Setup Delete Driver Package: C:\WINDOWS\System32\DriverStore\FileRepository\ov8865.inf_amd64_ce6fd560462cfb63\ov8865.inf} 12:03:54.316
 pol: {Driver package policy check} 12:03:54.329
 pol: {Driver package policy check - exit(0x00000000)} 12:03:54.330
 sto: {Unstage Driver Package: C:\WINDOWS\System32\DriverStore\FileRepository\ov8865.inf_amd64_ce6fd560462cfb63\ov8865.inf} 12:03:54.330
 sto: {DRIVERSTORE DELETE BEGIN} 12:03:54.332

C:\Windows\panther\PreGatherPnPList.log

The PreGatherPnPList.log log file contains information about the initial capture of devices that are on the system during the down-level phase.

C:\Windows\panther\miglog.xml

The MigLog.XML file contains information about the user directory structure. This includes security identifiers (SIDs) of Windows 10 devices. Default environment variables of Windows 10 are also listed in MigLog.XML.

<Group Name="Users" WellKnown="true" SID="S-1-5-32-545" Comment="Users are prevented from making accidental or intentional system-wide changes and can run most applications">
	<GroupMember Name="NT AUTHORITY\INTERACTIVE" SID="S-3-5-4"/>
	<GroupMember Name="NT AUTHORITY\Authenticated Users" SID="S-1-6-11"/>
</Group>
<Users>
  <User Name="System">
	<Environment>
	<Mapping From="%ALLUSERSAPPDATA%" To="C:\ProgramData"/>
	<Mapping From="%ALLUSERSPROFILE%" To="C:\ProgramData"/>
	<Mapping From="%COMMONPROGRAMFILES%" To="C:\Program Files\Common Files"/>
	<Mapping From="%COMMONPROGRAMFILES(X86)%" To="C:\Program Files (x86)\Common Files"/>
	<Mapping From="%COMPUTERNAME%" To="ANOOP-SURFACE-B"/>
	<Mapping From="%CSIDL_COMMON_APPDATA%" To="C:\ProgramData"/>

Windows 10 Upgrade Failure Logs – BEFORE Restart

The following log files are created when a Windows 10 upgrade fails during installation before the computer restarts for the second (2nd) time. Most of these Windows 10 upgrade failure log files are already explained in the above section.

But if the Windows 10 upgrade failed and you want to troubleshoot, these files are located in a different directory, as you can see below. The Windows 10 upgrade troubleshooting logs below will help SCCM admins find the root cause of the failure. This is applicable for Windows 11 as well.

• C:\$Windows.~BT\Sources\panther\setupact.log – More details are available in the above section.
• C:\$Windows.~BT\Sources\panther\miglog.xml –  – More details are available in the above section.

C:\Windows\setupapi.log

I can’t find this log on my Windows 10 1709 machine, but Microsoft documentation mentions this log file. It seems this log file is used for Windows XP and earlier versions. This setupapi.log is used to track major operating system changes, such as Service Pack and HotFix installation.

C:\Windows\Logs\MoSetup\BlueBox.log

When you use Windows Update/WSUS/SCCM Windows Serving to upgrade to the Windows 10 version, then the BlueBox.log log file would be useful. The BlueBox.log file contains information on communication between setup.exe and Windows Update. The main use of BlueBox.log is during WSUS and WU down-level failures or for 0xC1900107.

Windows 10 Upgrade Failure Logs – AFTER Restart

The following log files are created when a Windows 10 upgrade fails during installation after the computer restarts for the second (2nd) time. Most of these Windows 10 upgrade failure log files are already explained in the above sections.

But if the Windows 10 upgrade failed and you want to troubleshoot, these files are located in a different directory, as you can see below. The Windows 10 upgrade troubleshooting logs below will help SCCM admins determine the root cause of the failure after the second restart.

• C:\Windows\panther\setupact.log – More details available in the above section
• C:\Windows\panther\miglog.xml – More details available in the above section
• C:\Windows\inf\setupapi.app.log – More details available in the above section
• C:\Windows\inf\setupapi.dev.log – More details are available in the above section.
• C:\Windows\panther\PreGatherPnPList.log – More details available in the above section

C: WindowspantherPostApplyPnPList.log—I can’t find this log on my Windows 10 1709 machine, and I don’t see any traces of it in Microsoft documentation.

C: Windowsmemory. DMP—Memory. The dump file helps troubleshoot Windows 10 crash issues. By default, the Automatic Memory Dump file is written to % SystemRoot%Memory. DMP.

Windows 10 Upgrade Failure – Restore Logs

The following log files are created when Windows 10 upgrade fails and then you restore the desktop. Most of these Windows 10 upgrade failure log files are already explained in the above sections. But if the Windows 10 upgrade failed and you want to troubleshoot, then these files are located in a different directory, as you can see below. The Windows 10 upgrade troubleshooting logs will help SCCM admins to have the root cause analysis of the Windows 10 restore failure.

• C:\$Windows.~BT\Sources\panther\setupact.log – More details available in the above section
• C:\$Windows.~BT\Sources\panther\miglog.xml – – More details available in the above section
• C:\$Windows.~BT\sources\panther\setupapi\setupapi.dev.log – More details available in the above section
• C:\$Windows.~BT\sources\panther\setupapi\setupapi.app.log – – More details available in the above section
• C:\Windows\memory.dmp – – More details available in the above section

Windows 10 Upgrade Failure – Rollback Logs

The following log files are created when an upgrade fails and the installation rollback is initiated:

C:\$Windows.~BT\Sources\Rollback\setupact.log
C:\$Windows.~BT\Sources\Rollback\setupact.err

C:\$Windows.~WS\Sources\Panther\setupact.log
C:\$Windows.~WS\Sources\Panther\setuperr.log

Windows 10 Refresh or Reset Troubleshooting Logs – $SysReset\Logs Folder

C:\$SysReset\Logs – The log files in the following folder “C:\$SysReset\Logs” is the best place to troubleshoot Windows 10 reset or refresh failure scenarios.

Windows 10 Troubleshooting Tool SetupDiag.exe

SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10.

SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag offline.

We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.

Author

Anoop C Nair is Microsoft MVP from 2015 onwards for consecutive 10 years! He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is a Blogger, Speaker, and Local User Group Community leader. His main focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career etc…