Windows Upgrade Troubleshooting Logs

Let’s discuss Windows Upgrade Troubleshooting Logs in this post. I have done several Windows upgrades without any issues. But in the real-world scenario, we are expected to have several Windows 10 deployment issues. Let’s check the Windows 10 Deployment Upgrade Process Logs. These log files are relevant for Windows 11 Upgrade Process as well.

Windows 11 deployment troubleshooting flow will help you to complete Windows 10 migrations. In this post, we will cover the Windows 11 logs related to the upgrading process. All these logs will help SCCM admins to troubleshoot various scenarios.

I have a new blog post about the SCCM Logs or SCCM log files in the following post. I would recommend reading that post to get more details about SCCM Log Files or SCCM Logs. This will surely help you with SCCM troubleshooting.

Windows Upgrade Troubleshooting Logs are spread across different folders. Depending on the deployment or failure scenarios, the Windows upgrade troubleshooting logs are located in different folders.  Windows 10 deployment troubleshooting flow will surely help SCCM admins to resolve the most common issues.

Patch My PC

Windows 10 Setup Process FlowWindows Upgrade Troubleshooting Logs

Windows 10 setup scenario begins with completing a Windows setup on a new computer. This scenario is most common when SCCM admins create a golden image or reference image. The critical part of troubleshooting Windows 10 deployment is to understand the process flow.

  1. Setup Scenario
  2. BIOS
  3. Setup (Specialize) – Setupact.log, Setuperr.log, Setupapi.offline.log, Cbs_unattend.log, Sessions.xml, and CBS.log
  4. 1st Reboot
  5. Setup (OOBE)
  6. Windows Welcome (OOBE)
  7. 2nd Reboot (Optional)
  8. LogonUI
  9. OEM First Run
  10. Successfully Deployed
Windows 10 Deployment Upgrade Process Logs Windows Upgrade Troubleshooting Logs
Windows 10 Deployment Upgrade Process LogsWindows Upgrade Troubleshooting Logs

Windows 10 Deployment Upgrade Process Logs

C:\Windows\Panther\Setupact.log

Setupact.log provides information about your Windows 10 SKU, OS Version details, License State, Language Id, Processor clock, and end-to-end process about the Windows 10 upgrade process. Windows 10 upgrade processes are tracked primarily through the Setupact.log log file. Below Windows 10 upgrade troubleshooting logs will help SCCM admins to find out the root cause of any errors.

Info MOUPG SetupHost::Initialize: Mode = [0x1]
Info MOUPG SetupHost::Initialize: Scenario = [0x6]
Info MOUPG SetupHost::Initialize: Flags = [0x806]
Info MOUPG SetupHost: Setup build version is: 10.0.16299.15 (rs3_release.170928-1534)
Info CONX pGetHostCSDBuildNumber: 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDBuildNumber' does not exist. Assume 0
Info CONX Host OS version: 10.0.15063.0 (0.0) Platform 0x2, SuiteMask 0x100, ProdType 0x1
Info CONX Source OS: Host SKU Info: Edition = 'Enterprise', Edition Type = 'Client', Installation Type = 'Complete', Product Name = 'Windows 10 Enterprise', Arch = amd64, StationType = Client Workstation, Stage type = Staged Image
Info SP SERIALIZEVERBOSE: Serializing operation: Register sync process: SetupHost.Exe with args /Package /Rollback /ClientId Package360 /ReportId 58DDBB00-947E-420A-B296-A2451AE6AC0B.2 /FlightData RS:EB2 /Quiet
Info Persisting diagnostics data to C:\$WINDOWS.~BT\Sources\Diagnostics\diagnostics.dat
Info Diagnostics data saved successfully

C:\Windows\panther\setuperr.log

Setuperr.log provides a high-level list of errors that occurred during the specialize phase of Windows 10 Setup or Upgrade. Setuperr.log tracks the processes like app inventory, Windows plugin-related errors during the Windows 10 setup.

Error CONX Windows::Compat::Appraiser::WicaApplicationInventory::AddItemProperty (546): App Inventory returned duplicate file c:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\appsharinghookcontroller.exe.[gle=0x8007000d]
Error CONX Windows::Compat::Appraiser::WicaApplicationInventory::AddItemProperty (546): App Inventory returned duplicate file c:\program files\microsoft office\root\client\appvdllsurrogate64.exe.[gle=0x8007000d]
Error CONX Windows::Compat::Appraiser::WicaApplicationInventory::AddItemProperty (546): App Inventory returned duplicate file c:\program files\microsoft office\root\client\appvdllsurrogate32.exe.[gle=0x8007000d]
Error [0x0808fe] MIG Plugin {0b23c863-4410-4153-8733-a60c9b1990fb}: TableTextServiceMig!ApplySuccess() remove HKLM Registries error
Error [0x0808fe] MIG Plugin {dfd9f03f-a2e1-48f2-a579-57d61a2c3061}: LogType=2: VaultGetItemType, hr=0x80070490

C:\Windows\inf\setupapi.app.log

The setupapi.app.log file is the application installation text log. The application installation text log (setupapi.app.log) tracks information about application software installations that are associated with device driver installations. This log should analyze along with SetupAPI.dev.log.

Adaptiva

I couldn’t find this log on my Windows 10 1709 device. But this is one of the Windows Upgrade Troubleshooting Logs.

C:\Windows\inf\setupapi.dev.log (helps with Windows Upgrade Process Troubleshooting Logs)

The setupapi.dev.log file is driver failures during the OOBE phase of Setup. The device installation text log (setupapi.dev.log) contains information about device and driver installations.

>>> [SetupUninstallOEMInf - oem7.inf]
>>> Section start 2017/10/20 12:03:54.301
 cmd: C:\WINDOWS\system32\cleanmgr.exe /autoclean /d C:
 inf: Flags: 0x00000000
 inf: Driver Store Path: C:\WINDOWS\System32\DriverStore\FileRepository\ov8865.inf_amd64_ce6fd560462cfb63\ov8865.inf
 sto: {Setup Delete Driver Package: C:\WINDOWS\System32\DriverStore\FileRepository\ov8865.inf_amd64_ce6fd560462cfb63\ov8865.inf} 12:03:54.316
 pol: {Driver package policy check} 12:03:54.329
 pol: {Driver package policy check - exit(0x00000000)} 12:03:54.330
 sto: {Unstage Driver Package: C:\WINDOWS\System32\DriverStore\FileRepository\ov8865.inf_amd64_ce6fd560462cfb63\ov8865.inf} 12:03:54.330
 sto: {DRIVERSTORE DELETE BEGIN} 12:03:54.332

C:\Windows\panther\PreGatherPnPList.log

The PreGatherPnPList.log log file contains information about the initial capture of devices that are on the system during the down level phase.

C:\Windows\panther\miglog.xml

The MigLog.XML file contains information about the user directory structure. This includes security identifiers (SIDs) of Windows 10 devices. Default environment variables of Windows 10 are also listed in MigLog.XML.

<Group Name="Users" WellKnown="true" SID="S-1-5-32-545" Comment="Users are prevented from making accidental or intentional system-wide changes and can run most applications">
	<GroupMember Name="NT AUTHORITY\INTERACTIVE" SID="S-3-5-4"/>
	<GroupMember Name="NT AUTHORITY\Authenticated Users" SID="S-1-6-11"/>
</Group>
<Users>
  <User Name="System">
	<Environment>
	<Mapping From="%ALLUSERSAPPDATA%" To="C:\ProgramData"/>
	<Mapping From="%ALLUSERSPROFILE%" To="C:\ProgramData"/>
	<Mapping From="%COMMONPROGRAMFILES%" To="C:\Program Files\Common Files"/>
	<Mapping From="%COMMONPROGRAMFILES(X86)%" To="C:\Program Files (x86)\Common Files"/>
	<Mapping From="%COMPUTERNAME%" To="ANOOP-SURFACE-B"/>
	<Mapping From="%CSIDL_COMMON_APPDATA%" To="C:\ProgramData"/>

Windows 10 Upgrade Failure Logs – BEFORE Restart

The following log files are created when a Windows 10 upgrade fails during installation before the computer restarts for the second (2nd) time. Most of these Windows 10 upgrade failure log files are already explained in the above section.

But if the Windows 10 upgrade failed and you want to troubleshoot then, these files are located in a different directory as you can see below. Below Windows 10 upgrade troubleshooting logs will help SCCM admins get the root cause of the failure. This is applicable for Windows 11 as well.

  • C:\$Windows.~BT\Sources\panther\setupact.log – More details available in the above section.
  • C:\$Windows.~BT\Sources\panther\miglog.xml –  – More details available in the above section.

C:\Windows\setupapi.log

I can’t find this log on my Windows 10 1709 machine. But Microsoft documentation has some mention about this log file. And it seems this log file is used Windows XP and earlier versions. This setupapi.log is used to track the major changes of operating systems like Service Pack and HotFix installation for OS.

C:\Windows\Logs\MoSetup\BlueBox.log

When you use Windows Update/WSUS/SCCM Windows Serving to upgrade Windows 10 version then, BlueBox.log log file would be useful. BlueBox.log file contains information communication between setup.exe and Windows Update. The main use of BlueBox.log is during WSUS and WU down-level failures or for 0xC1900107.

Windows 10 Upgrade Failure Logs – AFTER Restart

The following log files are created when a Windows 10 upgrade fails during installation after the computer restarts for the second (2nd) time. Most of these Windows 10 upgrade failure log files are already explained in the above sections. But if the Windows 10 upgrade failed and you want to troubleshoot then, these files are located in a different directory as you can see below. Below Windows 10 upgrade troubleshooting logs will help SCCM admins get the root cause of the failure after the 2nd restart.

  • C:\Windows\panther\setupact.log – More details available in the above section
  • C:\Windows\panther\miglog.xml – More details available in the above section
  • C:\Windows\inf\setupapi.app.log – More details available in the above section
  • C:\Windows\inf\setupapi.dev.log – More details available in the above section.
  • C:\Windows\panther\PreGatherPnPList.log – More details available in the above section

C:\Windows\panther\PostApplyPnPList.log – I can’t find this log on my Windows 10 1709 machine. I don’t see any traces of this log in Microsoft documentation.

C:\Windows\memory.dmp – Memory.dump file helps to troubleshoot Windows 10 crash issues. The Automatic Memory Dump file is written to %SystemRoot%\Memory.dmp by default.

Windows 10 Upgrade Failure – Restore Logs

The following log files are created when Windows 10 upgrade fails, and then you restore the desktop. Most of these Windows 10 upgrade failure log files are already explained in the above sections. But if the Windows 10 upgrade failed and you want to troubleshoot then, these files are located in a different directory as you can see below. Below Windows 10 upgrade troubleshooting logs will help SCCM admins to have the root cause analysis of the Windows 10 restore failure.

  • C:\$Windows.~BT\Sources\panther\setupact.log – More details available in the above section
  • C:\$Windows.~BT\Sources\panther\miglog.xml – – More details available in the above section
  • C:\$Windows.~BT\sources\panther\setupapi\setupapi.dev.log – More details available in the above section
  • C:\$Windows.~BT\sources\panther\setupapi\setupapi.app.log – – More details available in the above section
  • C:\Windows\memory.dmp – – More details available in the above section

Windows 10 Upgrade Failure – Rollback Logs

The following log files are created when an upgrade fails, and the installation rollback is initiated:

C:\$Windows.~BT\Sources\Rollback\setupact.log
C:\$Windows.~BT\Sources\Rollback\setupact.err

C:\$Windows.~WS\Sources\Panther\setupact.log
C:\$Windows.~WS\Sources\Panther\setuperr.log

Windows 10 Refresh or Reset Troubleshooting Logs – $SysReset\Logs Folder

C:\$SysReset\Logs – The log files in the following folder “C:\$SysReset\Logs” is the best place to troubleshoot Windows 10 reset or refresh failure scenarios.

Windows 10 Troubleshooting Tool SetupDiag.exe

SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10.

SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode.

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…

7 thoughts on “Windows Upgrade Troubleshooting Logs”

  1. Hi,
    i am stuck during in place upgrade where in some machine after the command executioan it stop further process .

    some last entry of smsts.log are as follows.

    OS upgrade version: 10.0.18362.0 OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    No timeout set for Windows Upgrade Setup OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    Setting the client into provisioning mode OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    Exiting SetClientProvisioningMode 0x00000000 OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    Disabling CCMExec service OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    CcmExec service startup type is set to disabled OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    Disabling TSManager service OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    smstsmgr service startup type is set to disabled OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    Disabling Remote control service OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    CmRcService service startup type is set to disabled OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    Command line of Windows setup upgrade: ‘”E:\_SMSTaskSequence\Packages\AGH000D5\SETUP.EXE” /ImageIndex 1 /auto Upgrade /quiet /noreboot /postoobe “C:\Windows\SMSTSPostUpgrade\SetupComplete.cmd” /postrollback “C:\Windows\SMSTSPostUpgrade\SetupRollback.cmd” /postrollbackcontext system /DynamicUpdate Disable /compat IgnoreWarning ‘ OSDUpgradeWindows 29-06-2020 13:26 504 (0x01F8)
    Starting execution of thread with argument: “E:\_SMSTaskSequence\Packages\AGH000D5\SETUP.EXE” /ImageIndex 1 /auto Upgrade /quiet /noreboot /postoobe “C:\Windows\SMSTSPostUpgrade\SetupComplete.cmd” /postrollback “C:\Windows\SMSTSPostUpgrade\SetupRollback.cmd” /postrollbackcontext system /DynamicUpdate Disable /compat IgnoreWarning OSDUpgradeWindows 29-06-2020 13:26 11312 (0x2C30)
    Command line for extension .EXE is “%1” %* OSDUpgradeWindows 29-06-2020 13:26 11312 (0x2C30)
    Set command line: “E:\_SMSTaskSequence\Packages\AGH000D5\SETUP.EXE” /ImageIndex 1 /auto Upgrade /quiet /noreboot /postoobe “C:\Windows\SMSTSPostUpgrade\SetupComplete.cmd” /postrollback “C:\Windows\SMSTSPostUpgrade\SetupRollback.cmd” /postrollbackcontext system /DynamicUpdate Disable /compat IgnoreWarning OSDUpgradeWindows 29-06-2020 13:26 11312 (0x2C30)
    Executing command line: “E:\_SMSTaskSequence\Packages\AGH000D5\SETUP.EXE” /ImageIndex 1 /auto Upgrade /quiet /noreboot /postoobe “C:\Windows\SMSTSPostUpgrade\SetupComplete.cmd” /postrollback “C:\Windows\SMSTSPostUpgrade\SetupRollback.cmd” /postrollbackcontext system /DynamicUpdate Disable /compat IgnoreWarning with options (0, 0) OSDUpgradeWindows 29-06-2020 13:26 11312 (0x2C30)
    Could not open Windows Upgrade Setup progress registry key ‘HKLM\SYSTEM\Setup\MoSetup\Volatile’. Error = 0x80070002. Progress UI will not be updated OSDUpgradeWindows 29-06-2020 13:27 504 (0x01F8)
    Waiting for Windows Upgrade Setup process to return … OSDUpgradeWindows 29-06-2020 13:27 504 (0x01F8)
    after this last line nothing happen. it didnt even generate Folder “C:\$Windows.~BT\*”. i can upgrade the OS in same model. to clear the doubt i have even install OS Win 10 1809 again but nothing worked. can someone help on this?

    Reply
    • I can’t see any error part from registry access error …

      Are you having this issue only with many devices or only one device ? Do you mind starting a thread htmdforum.com

      Reply

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.