Diagnose Failed Windows 10/11 Feature Updates with SetupDiag Logs

Diagnose Failed Windows 10/11 Feature Updates with SetupDiag Logs​

Difficulty: Intermediate | Time Required: 20 minutes
Failed Windows feature updates can be frustrating, especially when Windows rolls back and gives only a vague error such as 0xC1900101, 0x8007001F, or “We couldn’t install this update.” SetupDiag helps turn those cryptic failures into useful clues by scanning Windows Setup logs and matching them against known upgrade failure patterns.
This tutorial walks you through using SetupDiag on Windows 10 and Windows 11 to find the likely cause of a failed feature update, locate the important log files, and decide what to fix before trying the upgrade again.

Version note: Windows 10 version 22H2 was the final Windows 10 feature update and reached end of support for most Home, Pro, Enterprise, and Education editions on October 14, 2025. Windows 10 LTSC/LTSB and devices enrolled in Extended Security Updates may follow different timelines. For most users, failed “feature update” troubleshooting now commonly applies to upgrading from Windows 10 to Windows 11 or moving between Windows 11 releases such as 23H2, 24H2, or 25H2.

Prerequisites​

Before you begin, make sure you have:

1. Administrator access to the affected PC.
2. The failed PC still available, preferably before running Disk Cleanup or deleting Windows.old.
3. An internet connection if you need to download the latest SetupDiag.
4. .NET Framework 4.7.2 or newer, which is required for manually running SetupDiag.
5. A backup of important files before making driver, partition, or system changes.

Warning: Do not randomly delete files from C:\$Windows.~BT, C:\Windows\Panther, or the DriverStore. Use the logs to identify the likely cause first.

Step-by-Step Instructions​

1. Confirm the update really failed and rolled back​

1. Open Settings.
2. Go to:
   • Windows 11: Settings > Windows Update > Update history
   • Windows 10: Settings > Update & Security > Windows Update > View update history
3. Look for the failed feature update entry.
4. Write down any error code shown, such as:

0xC1900101
0x8007001F
0x8007042B
0xC1900208

If Windows successfully returned to the desktop after a failed upgrade, SetupDiag can usually analyze the rollback logs.

2. Check whether SetupDiag already ran automatically​

Modern Windows Setup can run SetupDiag automatically after a failed upgrade. First, check for its automatic result file.

1. Open File Explorer.
2. In the address bar, enter:

%WinDir%\Logs\SetupDiag

1. Look for:

SetupDiagResults.xml

1. Open it with Notepad or another text editor.

If the folder exists and contains results, you may already have the primary diagnosis. Look for fields such as:

ProfileName
FailureData
FailureDetails
Last Setup Phase
Last Setup Operation
Error

Tip: If SetupDiag reports multiple failures, the last failure is usually the fatal one that stopped the upgrade.

3. Download the latest SetupDiag manually​

Even if Windows ran SetupDiag automatically, Microsoft recommends using the latest available version when running it manually because the rules can be updated over time.

1. Open your browser.
2. Go to Microsoft’s official SetupDiag download page from Microsoft Learn or the Microsoft Download Center.
3. Save SetupDiag.exe to a simple folder, such as:

C:\SetupDiag
If the folder does not exist, create it first.

4. Open an elevated Command Prompt​

1. Click Start.
2. Type:

cmd

1. Right-click Command Prompt.
2. Select Run as administrator.
3. If prompted by User Account Control, select Yes.

Now move to the folder where you saved SetupDiag:
cd /d C:\SetupDiag

5. Run SetupDiag in online mode​

Online mode analyzes upgrade logs on the current computer automatically.
Run:
SetupDiag.exe /Output:C:\SetupDiag\SetupDiagResults.log
Wait for the scan to finish. Depending on log size, this can take a few seconds or several minutes.
When complete, open the result:
notepad C:\SetupDiag\SetupDiagResults.log
You may also choose XML or JSON output if you prefer structured data:
SetupDiag.exe /Output:C:\SetupDiag\SetupDiagResults.xml /Format:xml
or:
SetupDiag.exe /Output:C:\SetupDiag\SetupDiagResults.json /Format:json

6. Read the SetupDiag result​

A useful SetupDiag result usually contains a matched rule. For example, you may see a rule related to:

• A blocked application
• An incompatible driver
• Insufficient disk space
• A Safe OS phase failure
• A migration failure
• A servicing stack or optional component problem
• A WIM mount problem
• A rollback caused by a bug check or unexpected restart

Focus on these items:

1. ProfileName — the matched SetupDiag rule.
2. Error — the main error code.
3. Last Setup Phase — where setup failed.
4. Last Setup Operation — what setup was doing.
5. FailureData — the human-readable explanation.
6. Recommended action, if provided.

Common phase names include:

• Downlevel — setup was still running inside the old Windows installation.
• Safe OS — setup booted into the temporary setup environment.
• First Boot — Windows was booting into the new OS for the first time.
• Second Boot / OOBE — final setup, user profile, and out-of-box experience work.

7. Match the diagnosis to the original logs​

SetupDiag gives you the summary, but sometimes you need supporting evidence from the raw logs.
Important log locations include:

C:\$Windows.~BT\Sources\Panther\setupact.log
C:\$Windows.~BT\Sources\Panther\setuperr.log
C:\$Windows.~BT\Sources\Rollback\setupact.log
C:\Windows\Panther\setupact.log
C:\Windows\Panther\setuperr.log
C:\Windows\Logs\MoSetup\BlueBox.log

In File Explorer, you may need to enable View > Show > Hidden items because $Windows.~BT is hidden.
Open setuperr.log first, then compare timestamps with setupact.log. Search for:

Error
Fatal Error
abandoning
rollback
Shell application requested abort

Note: setupact.log is often the most important setup log because it records setup actions in detail. setuperr.log is shorter, but it can lack context.

8. Run SetupDiag in offline mode if needed​

Offline mode is useful when you copied logs from another PC, a Windows.old folder, or a recovery environment.

1. Copy the failed upgrade logs to a folder, such as:

D:\UpgradeLogs

1. Include the full folder structure if possible, especially:

C:\$Windows.~BT\Sources\Panther
C:\$Windows.~BT\Sources\Rollback
C:\Windows\Panther
C:\Windows\Panther\NewOS

1. Run:

SetupDiag.exe /Output:C:\SetupDiag\OfflineResults.log /LogsPath:D:\UpgradeLogs
SetupDiag will recursively search subfolders for relevant logs.

9. Apply the likely fix​

Your next step depends on the rule or error SetupDiag found.
Common fixes include:

1. Driver-related errors
   • Update BIOS/UEFI firmware.
   • Update chipset, storage, graphics, Wi-Fi, and Bluetooth drivers.
   • Disconnect nonessential USB devices.
   • Remove old VPN, antivirus, disk encryption, or storage filter drivers if they are implicated.
2. Compatibility blocks
   • Uninstall the named application.
   • Reboot.
   • Search for leftover program folders if the logs identify a specific blocking file.
3. Disk space failures
   • Free space on the system drive.
   • Empty temporary files.
   • Remove old upgrade files only after copying logs you still need.
4. Optional component or language pack failures
   • Remove unused Windows optional features.
   • Remove extra language packs.
   • Reboot before retrying the feature update.
5. Servicing corruption
   • Run these from an elevated Command Prompt:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

1. Windows Update delivery problems
   • Retry with Windows Update.
   • If that fails, try the Installation Assistant, ISO, or enterprise deployment method appropriate for your edition.

Tips and Troubleshooting Notes​

• Keep a copy of the logs before deleting Windows.old or using cleanup tools.
• Do not rely on the first error only. Setup logs can contain many warnings that are not fatal.
• Error 0xC1900101 often points to drivers, especially when paired with rollback, bug check, or device installation clues.
• Check the exact phase and operation. The same error code can mean different things depending on whether it happened during Downlevel, Safe OS, First Boot, or OOBE.
• If SetupDiag finds no match, inspect setuperr.log, setupact.log, and BlueBox.log manually.
• For forum help, share the SetupDiag result text, the error code, Windows version, PC model, and whether third-party antivirus, encryption, or older drivers are installed. Avoid posting personal data from logs.

Conclusion​

SetupDiag is one of the quickest ways to turn a failed Windows 10 or Windows 11 feature update into an actionable troubleshooting path. Instead of guessing, you can identify the failing phase, matched rule, error code, and supporting log entries. Once you know whether the problem is a driver, application, disk space, servicing, compatibility, or rollback issue, your next repair attempt becomes much more targeted.
Key Takeaways:

• SetupDiag scans Windows Setup logs and identifies known feature update failure patterns.
• Automatic results may already exist in %WinDir%\Logs\SetupDiag.
• Running the latest SetupDiag manually can provide newer rules and clearer results.
• The most useful logs are usually setupact.log, setuperr.log, rollback logs, and BlueBox.log.
• Always fix the identified root cause before retrying the feature update.

---

This tutorial was generated to help WindowsForum.com users get the most out of their Windows experience.