Deployment Troubleshooting and Log Files

The following section describes the relationship between common deployment scenarios and their associated log files. WindowsВ® deployment is a highly customizable process, which has the potential for many points of failure. Identifying the specific point of failure you have encountered begins with understanding how the underlying technologies work.

Windows Setup Scenario

This scenario begins with completing Windows Setup on a new computer, so that you arrive at the desktop. This scenario is most common when you are creating a reference image. This process is also known as the first user experience.

As shown in the following illustration, the key to solving failures is identifying where you are in the installation process and when a failure occurs. Because you are creating a new installation, the hard drive is not initially available, so Windows Setup writes logs into memory, specifically in a Windows PE session (X:\Windows). After the hard drive is formatted, Setup continues logging directly onto the new hard drive (C:\Windows). Log files created during the Windows PE session are temporary.

When a failure occurs in Windows Setup, review the entries in the Setuperr.log file first, then the Setupact.log file second, and then other log files as needed.

Windows Setup-Related Log Files

Primary log file for most errors that occur during the Windows installation process. There are several instances of the Setupact.log file, depending on what point in the installation process the failure occurs. It is important to know which version of the Setupact.log file to look at, based on the phase you are in.

Setup (specialize): X:\Windows\panther

Setup (OOBE), LogonUI, OEM First Run:%windir%\panther

Out-Of-Box Experience (OOBE): %windir%\panther\unattendGC

High-level list of errors that occurred during the specialize phase of Setup. The Setuperr.log file does not provide any specific details.

Setup (specialize): %windir%\panther

Setup (specialize): %windir%\panther

Setup (OOBE), LogonUI, OEM First Run: %windir%\panther

Driver failures during the Component Specialization sub-phase of the Setup specialize phase.

Unattended-setup servicing failures.

Driver failures during the oobe phase of Setup.

An XML-based transaction log file that tracks all servicing activity, based on session id, client, status, tasks, and actions. If necessary, the Sessions.log file will point to the DISM.log and CBS.log files for more details.

Servicing log file that provides more details about offline-servicing failures.

Offline Servicing Scenario

This scenario involves adding and removing updates, drivers, and language packs, and configuring other settings, without booting Windows. Offline servicing is an efficient way to manage existing images that are stored on a server, because it eliminates the need for recreating updated images. You can perform offline servicing on an image that is mounted or applied to a drive or directory.

The Deployment Image Servicing and Management (DISM) tool is the primary tool for all offline-servicing tasks. DISM runs from a command prompt from Windows PE or a running Windows operating system. If a failure occurs when executing a DISM command, the tool will provide an immediate response, and log the issue in the DISM.log file. The Session.xml file is a transaction log file that captures all servicing activities on the target operating system. The Session.xml file can be used in conjunction with the DISM.log file to determine points of failures and the required servicing activity.

When a failure occurs in offline servicing, look at the DISM.log file first for specific errors. If the DISM.log file doesn’t contain any errors, review the Sessions.xml log file second, and then the CBS.log file.

Offline Servicing Related Log Files

Primary log file for all offline actions using DISM.

You can also create the DISM log file in a different location by using the /LogPath option. The level of data written to the log file can also be controlled by using the /LogLevel option.

An XML-based transaction log that tracks all servicing activity, based on session id, client, status, tasks, and actions. If necessary, the Sessions.log file will point to the DISM.log and CBS.log files for more details.

To learn more about offline servicing, see Understanding Servicing Strategies.

Online Servicing Scenario

This scenario is servicing a running operating system. This scenario involves booting the computer to audit mode to add drivers, applications, and other packages. Online servicing is ideal for drivers if the driver packages have co-installers or application dependencies. It is also efficient when the majority of your servicing packages have installers, the updates are in either .msi or KB.exe file formats, or the applications rely on Windows-installed services and technologies (such as the .NET Framework or full plug and play support).

Like offline servicing, all logging is captured in the DISM.log, CBS.log, and Sessions.xml files. If a failure occurs when executing a DISM command, the tool will provide immediate response as well as log the issue in the DISM.log file. The Session.xml file is a transaction log file that captures all servicing activities on the target operating system. The Session.xml file can be used in conjunction with the DISM.log file to determine points of failures and the required servicing activities.

When a failure occurs in offline servicing, look at the DISM.log file for specific errors. If the DISM.log file doesn’t contain any errors, review the Sessions.xml log file and then the CBS.log file.

Online Servicing-Related Log Files

Primary log file for all online actions using DISM. If necessary, DISM.log will point to CBS.log for more details.

You can also point DISM log file to a different location by using the /LogPath command option. The log data can also be controlled by using the /LogLevel command option.

Secondary log file that provides more details about an online servicing failure. DISM.log will reference CBS.log for more details.

An xml based transaction log that tracks all servicing activity based on session id, client, status, tasks, and actions. If necessary, Sessions.log will point to DISM.log and CBS.log for more details.

To learn more about offline servicing, see Understanding Servicing Strategies.

Diagnosing Online Servicing-Related Log Files

SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. Starting in Windows 10, version 2004, Windows Setup includes and executes SetupDiag. When Windows 10 Setup launches setupdiag.exe, the following parameters are used:

/ZipLogs:False
/Format:xml
/Output:%windir%\logs\SetupDiag\SetupDiagResults.xml
/RegPath:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupDiag\Results

To learn more about SetupDiag, see SetupDiag.

Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations

This article describes where to locate these log files and which log files are most useful for troubleshooting each setup phase of Windows 7, of Windows Server 2008 R2, and of Windows Vista.

Original product version: В Windows 10 — all editions, Windows Server 2019, Windows Server 2016
Original KB number: В 927521

Introduction

Windows setup log files are in different locations on the hard disk. These locations depend on the setup phase.

Support for Windows Vista without any service packs installed ended on April 13, 2010. To continue receiving security updates for Windows, make sure you’re running Windows Vista with Service Pack 2 (SP2). For more information, see Windows XP support has ended.

Down-level phase

The downlevel phase is the Windows setup phase that is running within the previous operating system. The following table lists important log files in this setup phase.

Log file	Description
C:\WINDOWS\setupapi.log	Contains information about device changes, driver changes, and major system changes, such as service pack installations and hotfix installations. This log file is used only by Microsoft Windows XP and earlier versions.
C:$WINDOWS. BT\Sources\Panther\setupact.log	Contains information about setup actions during the installation.
C:$WINDOWS. BT\Sources\Panther\setuperr.log	Contains information about setup errors during the installation.
C:$WINDOWS. BT\Sources\Panther\miglog.xml	Contains information about the user directory structure. This information includes security identifiers (SIDs).
C:$WINDOWS. BT\Sources\Panther\PreGatherPnPList.log	Contains information about the initial capture of devices that are on the system during the downlevel phase.

Windows Preinstallation Environment phase

The Windows Preinstallation Environment (Windows PE or WinPE) phase is the Windows setup phase that occurs after the restart at the end of the downlevel phase, or when you start the computer by using the Windows installation media. The following table lists important log files in this setup phase.

Log file	Description
X:$WINDOWS. BT\Sources\Panther\setupact.log	Contains information about setup actions during the installation.
X:$WINDOWS. BT\Sources\Panther\setuperr.log	Contains information about setup errors during the installation.
X:$WINDOWS. BT\Sources\Panther\miglog.xml	Contains information about the user directory structure. This information includes security identifiers (SIDs).
X:$WINDOWS. BT\Sources\Panther\PreGatherPnPList.log	Contains information about the initial capture of devices that are on the system during the downlevel phase.
or
C:$WINDOWS. BT\Sources\Panther\setupact.log	Contains information about setup actions during the installation.
C:$WINDOWS. BT\Sources\Panther\setuperr.log	Contains information about setup errors during the installation.
C:$WINDOWS. BT\Sources\Panther\miglog.xml	Contains information about the user directory structure. This information includes security identifiers (SIDs).
C:$WINDOWS. BT\Sources\Panther\PreGatherPnPList.log	Contains information about the initial capture of devices that are on the system during the downlevel phase.

You may also see a log file in the X:\WINDOWS directory. The Setupact.log file in this directory contains information about the progress of the initial options that are selected on the Windows installation screen. The Windows installation screen appears when you start the computer by using the Windows installation media. After you select Install now from the Windows installation screen, the Setup.exe file starts, and this log file is no longer used.

Online configuration phase

The online configuration phase (the first boot phase) starts when you receive the following message:

Please wait a moment while Windows prepares to start for the first time.

During this phase, basic hardware support is installed. If it’s an upgrade installation, data and programs are also migrated. The following table lists important log files in this setup phase.

Log file	Description
C:\WINDOWS\PANTHER\setupact.log	Contains information about setup actions during the installation.
C:\WINDOWS\PANTHER\setuperr.log	Contains information about setup errors during the installation.
C:\WINDOWS\PANTHER\miglog.xml	Contains information about the user directory structure. This information includes security identifiers (SIDs).
C:\WINDOWS\INF\setupapi.dev.log	Contains information about Plug and Play devices and driver installation.
C:\WINDOWS\INF\setupapi.app.log	Contains information about application installation.
C:\WINDOWS\Panther\PostGatherPnPList.log	Contains information about the capture of devices that are on the system after the online configuration phase.
C:\WINDOWS\Panther\PreGatherPnPList.log	Contains information about the initial capture of devices that are on the system during the downlevel phase.

Windows Welcome phase

The Windows Welcome phase includes the following options and events:

• It provides the options to create user accounts.
• It provides the option to specify a name for the computer.
• The Windows System Assessment Tool (Winsat.exe) finishes performance testing to determine the Windows Experience Index rating.

The Windows Welcome phase is the final setup phase before a user signs in. The following table lists important log files in this setup phase.

Log file	Description
C:\WINDOWS\PANTHER\setupact.log	Contains information about setup actions during the installation.
C:\WINDOWS\PANTHER\setuperr.log	Contains information about setup errors during the installation.
C:\WINDOWS\PANTHER\miglog.xml	Contains information about the user directory structure. This information includes security identifiers (SIDs).
C:\WINDOWS\INF\setupapi.dev.log	Contains information about Plug and Play devices and driver installation.
C:\WINDOWS\INF\setupapi.app.log	Contains information about application installation.
C:\WINDOWS\Panther\PostGatherPnPList.log	Contains information about the capture of devices that are on the system after the online configuration phase.
C:\WINDOWS\Panther\PreGatherPnPList.log	Contains information about the initial capture of devices that are on the system during the downlevel phase.
C:\WINDOWS\Performance\Winsat\winsat.log	Contains information about the Windows System Assessment Tool performance testing results.

Rollback phase

If a Windows upgrade installation fails, and you’ve successfully rolled back the installation to the previous operating system desktop, there are several log files that you can use for troubleshooting. The following table lists important log files in this phase.