Identify Windows Upgrade Failures Like a Boss (How to use SetupDiag.exe)

Have you run into cryptic Windows 10 feature upgrade errors? You know, the ones that aren’t helpful at all? I don’t know about you, but I have no idea what that these error codes mean and I don’t spend my free time memorizing the hundreds of error codes that Microsoft has. You’ve probably been in this situation before. Have you seen an error like this one:

Or this one:

So how do we figure this out? In the blog, I’ll walk through several actionable steps that you can take to quickly identify what’s going on and unblock your clients from upgrading. We’ll cover some common errors that you can quickly identify as well as using SetupDiag.exe for deeper digging. And lastly, we’ll cover how to remediate some of these as well.

Pre-Reqs

Since we’ll be talking bout Windows 10 feature upgrades, this blog will be assuming you know how to at least deploy them to clients. If you don’t know, check out my other blog on how to use the TargetReleaseVersion CSP and Windows Hello for Business in order to specify which feature version the client should upgrade to. With that said, there are a few other prereqs:

• SetupDiag.exe must be downloaded separately if the client upgrading to anything earlier than 2004.
• For versions 2004 and newer, SetupDiag.exe is automatically included with the WIndows setup files and thus you won’t have to download it separately. Before upgrade, it can be found in the hidden folder c:\$Windows.~bt\Sources. And after upgrade it will be moved to c:\windows.old\$Windows.~bt\Sources.
• SetupDiag.exe only works if Windows Setup actually runs, extracts all of the source files to C:\$Windows.~bt\Sources, and then subsequently has a failure during one of the steps.
• It requires .NET Framework 4.6 or higher to be installed on the system running SetupDiag.exe. If you aren’t sure, you can read this article or run this command in an elevated command prompt:

reg query "HKLM\SOFTWARE\Microsoft\Net Framework Setup\NDP\v4" /s

Common Windows Update Errors

Before we dig into SetupDiag.exe, it’s good to know about the common errors that you can identify quickly. These are called Result Codes and start with 0xC or 0x8 and are followed by numbers. The ones that start with C are called “NTSTATUS” errors and the ones that start with 8 are Win32 Errors. The “C” ones are fairly common so it’s useful to have these on hand. Here they are, taken from Microsoft documentation:

Result Code	Description
0xC1900208	“Setup found an actionable compat issue, such as an incompatible app” – This means there is an incompatible app on the system.
0xC1900204	“The migration choice selected is not available (ex: Enterprise to Home)” – Pretty self-explanatory. You can’t go in between SKUs.
0xC1900200	“The computer is not eligible for Windows 10” – This means the system requirements aren’t met which would be pretty rare in 2021. But you never know. Go here for the full list.
0xC190020E	“The computer does not have enough free space to install” – Windows doesn’t have enough free space to upgrade. This has gotten significantly less with each version so hopefully, you don’t see this one too much.
0xC1900101	This is a generic rollback error and can happen at any point during the upgrade process. This is usually attributed to some sort of driver problem.

The Win32 Error Codes will look like 0x80070005 or 0x80070070. According to MS, you should be able to grab the last 4 digits and look up the value on the Win32 error code page. I have not had much luck with this though. For example, on a test system, I had an 0x80070005 error which maps to Access is Denied which doesn’t tell me really anything. On the Windows Update page, it said it was a download error.

Checking in the Windows Update log also revealed a download problem:

I’ve had numerous other systems with both Win32 codes (starting with 0x8…) and NTSTATUS codes (0xC….) and so far I haven’t found the lookup tables to be useful at all. So instead of trying to map them like that, I’ve found that this page is a lot more useful for documenting common errors. Even still, the Windows Update UI may not always show you the correct error. So to get a more detailed error as well as a better root cause, let’s turn to SetupDiag.exe.

How to Use SetupDiag.exe

SetupDiag.exe is a free tool developed by Microsoft that analyzes Windows Setup log files in order to discover the root cause of any setup failures. You can run this tool on the system having the upgrade problems, or run it against exported logs from another system. Here’s how to use it:

1. Download the tool from Microsoft’s site here
2. On the system having upgrade failures create a new folder, say C:\Temp and copy SetupDiag.exe to it
3. Launch an elevated command line window
4. Change directories to C:\Temp (cd C:\Temp)
5. Type SetupDiag.Exe and hit enter. This will run the tool in “online” mode and put the log files in the same folder the tool is in. So in our case it will be C:\Temp. NOTE: If you don’t have any setup logs available on the system, you’ll get a response saying “SetupDiag was unable to find a relevant log file. Exiting!”.

6. Once it completes, you should see the folder look like this:
   

Let’s talk through each file:

• SetupDiagResults.txt — This is the summary of all the failures and what you’ll want to check first.
• SetupDiag.exe.config — This is SetupDiag.exe’s config file. I’ve never needed to modify this file.
• Logs.zip – This contains all of the “CompatData” xml files that will show any incompatibilities. It will also contain setupact.log which will also capture errors during setup. Both of these are extremely useful.

7. Once the tool has run and analyzed the log files, let’s open SetupDiagResults.log. In this example, a client I was working with had this particular error:

Additionally, SetupDiag.exe automatically includes failure details in the registry under HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup\Volatile\SetupDiag. You may also find the results under HKLM\SYSTEM\Setup\SetupDiag\Results. Here is another example of a failure on a system, but this time low disk space:

Other SetupDiag.exe Examples

You can run SetupDiag.exe a few other ways as well:

Specify Log Path

If you’d like to specify a different path for SetupDiag.exe to export log files to you can run this command (Note: you need a full path. Relative paths don’t work):

SetupDiag.exe /Output:C:\Update\SetupDiag.log

Run Against a Different system

If you want to run this against logs from another system, do the following:

1. Copy one of these folders off of the system or remotely connect to it via PSexec or other remoting tool:
   1. C:\$Windows.~bt\sources\panther
   2. C:\$Windows.~bt\Sources\Rollback
   3. C:\Windows\Panther
   4. C:\Windows\Panther\NewOS
2. Run the following command:

SetupDiag.exe /LogsPath:C:\$WINDOWS.~BT\Sources\Panther

Crash Dump

If some sort of blue screen or hard error occurs during the upgrade, you may need to analyze the crash dump file. Thankfully SetupDiag.exe supports analyzing this, but you will need to install Windows Debugging tools on the system running SetupDiag.exe

1. Gather the setupmem.dmp file from C:\$Windows.~bt\Sources\Rollback or C:\Windows\Panther\NewOS\Rollback and copy to a folder such as C:\Temp\CrashDump.
2. Install Windows Debugging Tools from here.
3. Run this command to analyze:

SetupDiag.exe /LogsPath:C:\Temp\CrashDump

How to Remediate

Now that you know how to gather upgrade errors with SetupDiag.exe, let’s move onto some ways to actually fix the problem so you can unblock the system.

First, take the error code and search for it on the main resolutions page. This should have most of the errors that you will encounter on a day-to-day basis. For example, one person I was helping had the error 0xC1900101 – 0x30018. Looking up that error on that page reveals this to be the problem:

Unplugging all peripherals (monitors, keyboard, USB hubs, etc) ended up fixing the issue.

However, sometimes you will get errors that are not listed on that page. Such was the case with my customer a few weeks ago (and one of the screenshots I posted above). They had error 0xC1900223 – 0x20009. This proved to be particularly tricky to figure out. After searching around the internet to see if anyone else had this issue, a few articles mentioned issues with network connectivity, DNS, or some sort of network-level proxy messing with the download. Even though we disabled all network filtering and VPN, the system still did not want to upgrade.

I then turned to Adam Gross’s Feature Update script (called FU.WhyAmIBlocked) that analyzes a lot of other data on the system like Windows Compatibility Database and Appraiser. This is an under-the-hood Windows process that runs on a scheduled task to determine if you are eligible for the next feature upgrade. For detailed information on this as well a how his script works check out his blog here. He did a great job with it and I highly recommend it. To run it, follow these steps:

1. In an elevated PowerShell window, run:

Install-Module -Name FU.WhyAmIBlocked

2. If you are prompted to install Nuget, hit Y. If you are prompted to install modules from an “untrusted” repository (PSGallery), hit Y.

4. Then import the module:

Import-Module FU.WhyAmIBlocked

If you get an error about the execution policy, you can set it to bypass mode and then run the import-module command again:

Set-ExecutionPolicy Unrestricted

5. Run this command:

Get-FUBlocks

After if finished, open the results.txt file as specified by the script.

In my case, it found that two particular things were potentially causing the problem:

• LSASS Crashes + Admin Accounts
• TBT Storage Devices

This tells us that the upgrade is blocked due to one or both of these things. The first one seems related to the 20H2 upgrade problem where there were major issues if the built-in administrator and/or guest accounts were renamed. This got fixed with an update back in December of 2020, so it doesn’t fully make sense why this is still being flagged as this system was patched with June 2021 patches. The second one is more intriguing and makes a bit more sense. “TBT storage devices” essentially means thunderbolt storage devices, aka thunderbolt NVMe SSDs. This was a known issue with upgrading to 20H2 and 2004 per this article. This was also supposedly patched so we are still investigating this issue with Microsoft. I’ll report back on what the final results were once we get to the bottom of it.

Either way, leveraging Microsoft’s resolutions page and/or Adam’s script should get you well on your way to remediating problematic clients. If you find particular success with these, definitely let me know! I’d like to document and share more error codes and their fixes.

How to Report Back Results

Finally, this is all great if you are troubleshooting one system. But how do you know how widespread the issue is in your environment? Check out this blog (coming soon!) where I walk through how to pull in SetupDiag.exe data into Workspace ONE via Sensors for centralized reporting and analyses.

Summary

Running into Windows Upgrade failures can be frustrating, especially with the less-than-helpful error codes that Windows gives. Thankfully, SetupDiag.exe can give you a ton of useful information on how to analyze what is really going on. And if that doesn’t work, running Adam’s script can take you even further. Good luck upgrading!