This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade.

If you are not an IT administrator, you can try the quick fixes listed in this topic. If the quick fixes do not resolve your issue, see Get help with Windows 10 upgrade and installation errors for more information.

## In this topic

The following sections and procedures are provided in this guide:

## The Windows 10 upgrade process

The Windows Setup application is used to upgrade a computer to Windows 10, or to perform a clean installation. Windows Setup starts and restarts the computer, gathers information, copies files, and creates or adjusts configuration settings. When performing an operating system upgrade, Windows Setup uses the following phases:

1. Downlevel phase: The downlevel phase is run within the previous operating system. Installation components are gathered.
2. Safe OS phase: A recovery partition is configured and updates are installed. An OS rollback is prepared if needed.
• Example error codes: 0x2000C, 0x20017
3. First boot phase: Initial settings are applied.
• Example error codes: 0x30018, 0x3000D
4. Second boot phase: Final settings are applied. This is also called the OOBE boot phase.
• Example error: 0x4000D, 0x40017
5. Uninstall phase: This phase occurs if upgrade is unsuccessful.
• Example error: 0x50000

Figure 1: Phases of a successful Windows 10 upgrade (uninstall is not shown):

OOBE = Out of box experience.
WIM = Windows image (Microsoft)

## Quick fixes

The following steps can resolve many Windows upgrade problems.

1. Remove nonessential external hardware, such as docks and USB devices.
2. Check all hard drives for errors and attempt repairs. To automatically repair hard drives, open an elevated command prompt, switch to the drive you wish to repair, and type the following command. You will be required to reboot the computer if the hard drive being repaired is also the system drive.
• chkdsk /F
3. Attept to restore and repair system files by typing the following commands at an elevated command prompt. It may take several minutes for the command operations to be completed. For more information, see Repair a Windows Image.
• DISM.exe /Online /Cleanup-image /Restorehealth
• sfc /scannow
4. Update Windows so that all available recommended updates are installed.
5. Uninstall non-Microsoft antivirus software.
• Use Windows Defender for protection during the upgrade.
• Verify compatibility information and re-install antivirus applications after the upgrade.
6. Uninstall all nonessential software.
7. Update firmware and drivers.
9. Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS.

If the upgrade process is not successful, Windows Setup will return two codes:

1. A result code: The result code corresponds to a specific Win32 error.
2. An extend code: The extend code contains information about both the phase in which an error occurred, and the operation that was being performed when the error occurred.

For example, a result code of 0xC1900101 with an extend code of 0x4000D will be returned as: 0xC1900101 – 0x4000D.

Note: If only a result code is returned, this can be because a tool is being used that was not able to capture the extend code. For example, if you are using the Windows 10 Upgrade Assistant then only a result code might be returned.

### Result codes

A result code of 0xC1900101 is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the Resolution procedures section later in this topic.

Result codes can be matched to the type of error encountered. To match a result code to an error:

1. Identify the error code type, either Win32 or NTSTATUS, using the first hexidecimal digit:
8 = Win32 error code (ex: 0x80070070)
C = NTSTATUS value (ex: 0xC1900107)
2. Write down the last 4 digits of the error code (ex: 0x80070070 = 0070). These digits correspond to the last 16 bits of the HRESULT or the NTSTATUS structure.
3. Based on the type of error code determined in the first step, match the 4 digits derived from the second step to either a Win32 error code, or an NTSTATUS value.

For example:

• 0x80070070 = Win32 = 0070 = 0x00000070 = ERROR_DISK_FULL
• 0xC1900107 = NTSTATUS = 0107 = 0x00000107 = STATUS_SOME_NOT_MAPPED

Some result codes are self-explanatory, whereas others are more generic and require further analysis. In the examples shown above, ERROR_DISK_FULL indicates that the hard drive is full and additional room is needed to complete Windows upgrade. The message STATUS_SOME_NOT_MAPPED is more ambiguous, and means that an action is pending. In this case, the action pending is often the cleanup operation from a previous installation attempt, which can be resolved with a system reboot.

### Extend codes

Important: Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update.

Extend codes can be matched to the phase and operation when an error occurred. To match an extend code to the phase and operation:

1. Use the first digit to identify the phase (ex: 0x4000D = 4).
2. Use the last two digits to identify the operation (ex: 0x4000D = 0D).
3. Match the phase and operation to values in the tables provided below.

The following tables provide the corresponding phase and operation for values of an extend code:

 Extend code: phase Hex Phase 0 SP_EXECUTION_UNKNOWN 1 SP_EXECUTION_DOWNLEVEL 2 SP_EXECUTION_SAFE_OS 3 SP_EXECUTION_FIRST_BOOT 4 SP_EXECUTION_OOBE_BOOT 5 SP_EXECUTION_UNINSTALL
Extend code: operation
 Hex Operation 0 SP_EXECUTION_OP_UNKNOWN 1 SP_EXECUTION_OP_COPY_PAYLOAD 2 SP_EXECUTION_OP_DOWNLOAD_UPDATES 3 SP_EXECUTION_OP_INSTALL_UPDATES 4 SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT 5 SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE 6 SP_EXECUTION_OP_REPLICATE_OC 7 SP_EXECUTION_OP_INSTALL_DRVIERS 8 SP_EXECUTION_OP_PREPARE_SAFE_OS 9 SP_EXECUTION_OP_PREPARE_ROLLBACK A SP_EXECUTION_OP_PREPARE_FIRST_BOOT B SP_EXECUTION_OP_PREPARE_OOBE_BOOT C SP_EXECUTION_OP_APPLY_IMAGE D SP_EXECUTION_OP_MIGRATE_DATA E SP_EXECUTION_OP_SET_PRODUCT_KEY F SP_EXECUTION_OP_ADD_UNATTEND
 Hex Operation 10 SP_EXECUTION_OP_ADD_DRIVER 11 SP_EXECUTION_OP_ENABLE_FEATURE 12 SP_EXECUTION_OP_DISABLE_FEATURE 13 SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS 14 SP_EXECUTION_OP_REGISTER_SYNC_PROCESS 15 SP_EXECUTION_OP_CREATE_FILE 16 SP_EXECUTION_OP_CREATE_REGISTRY 17 SP_EXECUTION_OP_BOOT 18 SP_EXECUTION_OP_SYSPREP 19 SP_EXECUTION_OP_OOBE 1A SP_EXECUTION_OP_BEGIN_FIRST_BOOT 1B SP_EXECUTION_OP_END_FIRST_BOOT 1C SP_EXECUTION_OP_BEGIN_OOBE_BOOT 1D SP_EXECUTION_OP_END_OOBE_BOOT 1E SP_EXECUTION_OP_PRE_OOBE 1F SP_EXECUTION_OP_POST_OOBE 20 SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE

For example: An extend code of 0x4000D, represents a problem during phase 4 (0x4) with data migration (000D).

## Log files

Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is setupact.log. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code.

The following table describes some log files and how to use them for troubleshooting purposes:

 Log file Phase: Location Description When to use setupact.log Down-Level: $Windows.~BT\Sources\Panther Contains information about setup actions during the downlevel phase. All down-level failures and starting point for rollback investigations. This is the most important log for diagnosing setup issues. OOBE:$Windows.~BT\Sources\Panther\UnattendGC Contains information about actions during the OOBE phase. Investigating rollbacks that failed during OOBE phase and operations – 0x4001C, 0x4001D, 0x4001E, 0x4001F. Rollback: $Windows.~BT\Sources\Rollback Contains information about actions during rollback. Investigating generic rollbacks – 0xC1900101. Pre-initialization (prior to downlevel): Windows Contains information about initializing setup. If setup fails to launch. Post-upgrade (after OOBE): Windows\Panther Contains information about setup actions during the installation. Investigate post-upgrade related issues. setuperr.log Same as setupact.log Contains information about setup errors during the installation. Review all errors encountered during the installation phase. miglog.xml Post-upgrade (after OOBE): Windows\Panther Contains information about what was migrated during the installation. Identify post upgrade data migration issues. BlueBox.log Down-Level: Windows\Logs\Mosetup Contains information communication between setup.exe and Windows Update. Use during WSUS and WU down-level failures or for 0xC1900107. Supplemental rollback logs: Setupmem.dmp setupapi.dev.log Event logs (*.evtx)$Windows.~BT\Sources\Rollback Additional logs collected during rollback. Setupmem.dmp: If OS bugchecks during upgrade, setup will attempt to extract a mini-dump. Setupapi: Device install issues – 0x30018 Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.

### Log entry structure

A setupact.log or setuperr.log entry includes the following elements:

1. The date and time – 2016-09-08 09:20:05.
2. The log level – Info, Warning, Error, Fatal Error.
3. The logging component – CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS.
• The logging components SP (setup platform), MIG (migration engine), and CONX (compatibility information) are particularly useful for troubleshooting Windows Setup errors.
4. The message – Operation completed successfully.

See the following example:

Date/Time Log level Component Message
2016-09-08 09:23:50, Warning MIG Could not replace object C:\Users\name\Cookies. Target Object cannot be removed.

### Analyze log files

To analyze Windows Setup log files:

1. Determine the Windows Setup error code.
2. Based on the extend code portion of the error code, determine the type and location of a log files to investigate.
3. Open the log file in a text editor, such as notepad.
4. Using the result code portion of the Windows Setup error code, search for the result code in the file and find the last occurrence of the code. Alternatively search for the “abort” and abandoning” text strings described in step 7 below.
5. To find the last occurrence of the result code:
1. Scroll to the bottom of the file and click after the last character.
2. Click Edit.
3. Click Find.
4. Type the result code.
5. Under Direction select Up.
6. Click Find Next.
6. When you have located the last occurrence of the result code, scroll up a few lines from this location in the file and review the processes that failed just prior to generating the result code.
7. Search for the following important text strings:
• Shell application requested abort
• Abandoning apply due to error for object
8. Decode Win32 errors that appear in this section.
9. Write down the timestamp for the observed errors in this section.
10. Search other log files for additional information matching these timestamps or errors.

For example, assume that the error code for an error is 0x8007042B – 0x2000D. Searching for “8007042B” reveals the following content from the setuperr.log file:

Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just “CN.”

setuperr.log content:

27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
27:08, Error                  Gather failed. Last error: 0x00000000
27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
27:09, Error           SP     CMigrateFramework: Gather framework failed. Status: 44
27:09, Error           SP     Operation failed: Migrate framework (Full). Error: 0x8007042B[gle=0x000000b7]
27:09, Error           SP     Operation execution failed: 13. hr = 0x8007042B[gle=0x000000b7]
27:09, Error           SP     CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x8007042B[gle=0x000000b7]


The first line indicates there was an error 0x00000570 with the file C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN] (shown below):

27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]


The error 0x00000570 is a Win32 error code corresponding to: ERROR_FILE_CORRUPT: The file or directory is corrupted and unreadable.

Therefore, Windows Setup failed because it was not able to migrate the corrupt file C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18[CN]. This file is a local system certificate and can be safely deleted. Searching the setupact.log file for additional details, the phrase “Shell application requested abort” is found in a location with the same timestamp as the lines in setuperr.log. This confirms our suspicion that this file is the cause of the upgrade failure:

setupact.log content:

27:00, Info                   Gather started at 10/5/2016 23:27:00
27:00, Info [0x080489] MIG    Setting system object filter context (System)
27:00, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
27:00, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
27:00, Info            SP     ExecuteProgress: Elapsed events:1 of 4, Percent: 12
27:00, Info [0x0802c6] MIG    Processing GATHER for migration unit: \UpgradeFramework (CMXEAgent)
27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
27:08, Info            SP     ExecuteProgress: Elapsed events:2 of 4, Percent: 25
27:08, Info            SP     ExecuteProgress: Elapsed events:3 of 4, Percent: 37
27:08, Info [0x080489] MIG    Setting system object filter context (System)
27:08, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
27:08, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
27:08, Info            MIG    COutOfProcPluginFactory::FreeSurrogateHost: Shutdown in progress.
27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost::CommandLine: -shortened-
27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost: Successfully launched host and got control object.
27:08, Error                  Gather failed. Last error: 0x00000000
27:08, Info                   Gather ended at 10/5/2016 23:27:08 with result 44
27:08, Info                   Leaving MigGather method
27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C


This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f.

## Resolution procedures

### 0xC1900101

A frequently observed result code is 0xC1900101. This result code can be thrown at any stage of the upgrade process, with the exception of the downlevel phase. 0xC1900101 is a generic rollback code, and usually indicates that an incompatible driver is present. The incompatible driver can cause blue screens, system hangs, and unexpected reboots. Analysis of supplemental log files is often helpful, such as:

• The minidump file: $Windows.~bt\Sources\Rollback\setupmem.dmp, • Event logs:$Windows.~bt\Sources\Rollback*.evtx
• The device install log: $Windows.~bt\Sources\Rollback\setupapi\setupapi.dev.log The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). To resolve a rollback due to driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a clean boot before initiating the upgrade process. See the following general troubleshooting procedures associated with a result code of 0xC1900101:  Code 0xC1900101 – 0x20004  Cause Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation This is generally caused by out-of-date drivers.  Mitigation Uninstall antivirus applications. Remove all unused SATA devices. Remove all unused devices and drivers. Update drivers and BIOS.  Code 0xC1900101 – 0x2000c  Cause Windows Setup encountered an unspecified error during Wim apply in the WinPE phase. This is generally caused by out-of-date drivers.  Mitigation Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. Contact your hardware vendor to obtain updated device drivers. Ensure that “Download and install updates (recommended)” is accepted at the start of the upgrade process.  Code 0xC1900101 – 0x20017  Cause A driver has caused an illegal operation. Windows was not able to migrate the driver, resulting in a rollback of the operating system.This is a safeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software.  Mitigation Ensure that all that drivers are updated. Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers. For more information, see Understanding Failures and Log Files. Update or uninstall the problem drivers.  Code 0xC1900101 – 0x30018  Cause A device driver has stopped responding to setup.exe during the upgrade process.  Mitigation Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. Contact your hardware vendor to obtain updated device drivers. Ensure that “Download and install updates (recommended)” is accepted at the start of the upgrade process.  Code 0xC1900101 – 0x3000D  Cause Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation. This can occur due to a problem with a display driver.  Mitigation Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. Update or uninstall the display driver.  Code 0xC1900101 – 0x4000D  Cause A rollback occurred due to a driver configuration issue.Installation failed during the second boot phase while attempting the MIGRATE_DATA operation. This can occur due to incompatible drivers.  Mitigation Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors. Review the rollback log and determine the stop code. The rollback log is located in the C:\$Windows.~BT\Sources\Panther folder. An example analysis is shown below. This example is not representative of all cases: Info SP Crash 0x0000007E detected Info SP Module name : Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005 Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728 Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40 Info SP Cannot recover the system. Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows. Typically there is a a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures: 1. Make sure you have enough disk space. 2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates. 3. Try changing video adapters. 4. Check with your hardware vendor for any BIOS updates. 5. Disable BIOS memory options such as caching or shadowing.
 Code 0xC1900101 – 0x40017
 Cause Windows 10 upgrade failed after the second reboot. This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers.
 Mitigation Clean boot into Windows, and then attempt the upgrade to Windows 10. For more information, see How to perform a clean boot in Windows.Ensure you select the option to “Download and install updates (recommended).”

### 0x800xxxxx

Result codes starting with the digits 0x800 are also important to understand. These error codes indicate general operating system errors, and are not unique to the Windows upgrade process. Examples include timeouts, devices not functioning, and a process stopping unexpectedly.

See the following general troubleshooting procedures associated with a result code of 0x800xxxxx:

 Code 8000405 – 0x20007
 Cause An unspecified error occurred with a driver during the SafeOS phase.
 Mitigation This error has more than one possible cause. Attempt quick fixes, and if not successful, analyze log files in order to determine the problem and solution.
 Code 800704B8 – 0x3001A
 Cause An extended error has occurred during the first boot phase.
 Mitigation Disable or uninstall non-Microsoft antivirus applications, disconnect all unnecessary devices, and perform a clean boot.
 Code 8007042B – 0x4000D
 Cause The installation failed during the second boot phase while attempting the MIGRATE_DATA operation. This issue can occur due to file system, application, or driver issues.
 Mitigation Analyze log files in order to determine the file, application, or driver that is not able to be migrated. Disconnect, update, remove, or replace the device or object.
 Code 8007001F – 0x4000D
 Cause General failure, a device attached to the system is not functioning.
 Mitigation Analyze log files in order to determine the device that is not functioning properly. Disconnect, update, or replace the device.
 Code 8007042B – 0x4001E
 Cause The installation failed during the second boot phase while attempting the PRE_OOBE operation.
 Mitigation This error has more than one possible cause. Attempt quick fixes, and if not successful, analyze log files in order to determine the problem and solution.