Upgrading Windows to a newer version is a big system change. Whether you upgrade from Windows 10 to Windows 11, or from one Windows 11 version to another (like 22H2 to 23H2 or 23H2 to 24H2), Windows performs hundreds of background actions during the upgrade. It checks your hardware, copies system files, installs updates, migrates drivers, moves user data, and then finalizes the new version.
To make sure everything works properly, Windows also creates multiple log files during the upgrade process. These log files are extremely useful if your upgrade fails, gets stuck, rolls back, or causes errors after installation. Even if the upgrade completes successfully, these logs can help IT teams and advanced users confirm what happened in the upgrade process.
In this article, you will learn what log files are created during a Windows upgrade, where they are stored, and how to read them in a simple and practical way.
Why Does Windows Create Upgrade Log Files?
Windows upgrade log files exist for one main reason: troubleshooting and tracking. They record important actions performed during the upgrade, such as:
Hardware compatibility checks
Driver installation and failures
Windows Update download and installation status
Migration of settings and user profiles
App compatibility and removal actions
Rollback reasons when an upgrade fails
These files help Windows identify where the upgrade went wrong and help you fix issues faster without guessing.
When Are These Upgrade Logs Created?
Windows creates upgrade logs during different phases of an upgrade. You may see logs being created at multiple times, such as:
Before the upgrade begins (compatibility checks)
While Windows Setup downloads and prepares files
During the offline installation phase (restarting and installing)
After upgrade completion (post-install setup and migration tasks)
During rollback if the upgrade fails
This means you can find logs both inside your current Windows installation and inside temporary upgrade folders created during the process.
The Most Important Log Folders Created During a Windows Upgrade
Windows does not store all upgrade logs in one single place. Instead, it spreads them across multiple folders depending on the upgrade stage.
Below are the most important and commonly used log locations.
1) Panther Folder (Most Famous Upgrade Logs Location)
The Panther folder is one of the most important locations for Windows upgrade logs. It mainly stores setup-related files and compatibility data.
Common Panther locations include:
C:$WINDOWS.~BT\Sources\Panther
C:\Windows\Panther
These folders may include several useful logs like:
Setup progress logs
Compatibility and driver logs
Error records and failure details
If your upgrade fails during the early or middle stages, Panther logs usually contain the best clues.
2) SetupAct.log (Main Setup Activity Log)
SetupAct.log is one of the most useful files for upgrade troubleshooting. It contains step-by-step actions performed by Windows Setup, including successes and failures.
You can find it inside Panther folders, such as:
C:$WINDOWS.~BT\Sources\Panther\setupact.log
C:\Windows\Panther\setupact.log
This file is extremely helpful when:
Your upgrade gets stuck at a percentage
Setup fails with a generic error
You want to track what Setup did
It is readable with Notepad, but using advanced tools like CMTrace makes it easier to search.
3) SetupErr.log (Setup Error Log)
Along with SetupAct.log, Windows creates SetupErr.log. This file specifically contains error messages related to the upgrade.
Typical location:
C:$WINDOWS.~BT\Sources\Panther\setuperr.log
C:\Windows\Panther\setuperr.log
If you are looking for quick failures, this log is often shorter and easier to scan than setupact.log.
4) CompatData.xml (Compatibility Check Results)
Before upgrading, Windows checks whether your hardware and apps are compatible. It creates a file called CompatData.xml.
Common location:
C:$WINDOWS.~BT\Sources\Panther\CompatData.xml
This file stores information about:
Drivers that may not work
Apps that could block the upgrade
Hardware issues that prevent installation
If Windows says something like “This PC can’t be upgraded” or “Remove this app to continue,” CompatData.xml usually records why.
5) BlueBox.log (Compatibility Engine Log)
Windows also uses a compatibility component often referred to as BlueBox. The log file is called BlueBox.log.
You may find it in:
C:$WINDOWS.~BT\Sources\Panther\BlueBox.log
This file can help when:
The upgrade fails due to compatibility
A driver or software is marked as a blocker
Windows Setup refuses to continue
It explains what the compatibility engine detected and why it stopped the process.
6) MigLog.xml (Migration Log)
During an upgrade, Windows migrates your user profile, settings, and older system data into the new build. For this, it creates migration logs like MigLog.xml.
Common locations may include:
C:$WINDOWS.~BT\Sources\Panther
C:\Windows\Panther
Migration logs can show details about:
Account migration
Desktop settings transfers
Registry migration events
Data movement issues
If the upgrade completes but your settings look missing or broken, migration logs can be helpful.
7) MOSetup Logs (Modern Windows Setup Logs)
Windows uses a component called MOSetup (Modern Setup) that handles many upgrade tasks and integrates with Windows Update.
MOSetup logs are often located in:
C:\Windows\Logs\MOSetup
Common files in this folder include:
MOSetup.log
Rollback-related MOSetup records
Setup engine details
If your upgrade failed when installing through Windows Update, this folder is especially important.
8) CBS Logs (Component-Based Servicing Logs)
The Windows upgrade process uses Windows servicing mechanisms, which generate logs known as CBS logs.
Location:
C:\Windows\Logs\CBS\CBS.log
CBS logs contain information about:
Windows component installation
Servicing package failures
Update installation errors
Corrupt system file repair attempts
CBS.log can become very large, and it can be difficult to read, but it is very useful when upgrade problems are related to servicing stack issues.
9) DISM Logs (Deployment Image Servicing Logs)
DISM (Deployment Image Servicing and Management) is commonly used by Windows internally during setup and upgrade tasks.
Location:
C:\Windows\Logs\DISM\dism.log
DISM logs are important when:
The upgrade fails due to missing or damaged system components
Windows image servicing fails
A repair attempt was made before or during upgrade
If you run DISM commands manually, the same log file also records your actions.
10) WindowsUpdate Logs (Update-Based Upgrade Logs)
If you upgrade Windows using Windows Update, Windows creates additional logs that record update downloads and installation actions.
In Windows 11, classic WindowsUpdate.log is not stored in the same way as older Windows versions. Instead, Windows stores logs in ETL format.
Still, you can generate a readable log file using PowerShell:
Open PowerShell as Admin
Run: Get-WindowsUpdateLog
This command creates a WindowsUpdate.log on your desktop.
Windows Update related logs may also exist in:
C:\Windows\SoftwareDistribution\ReportingEvents.log (may exist on some systems)
ETL trace files in Windows log folders
These are helpful if your upgrade fails while downloading updates.
11) Event Viewer Logs (Setup and System Events)
Apart from plain log files, Windows also records upgrade-related actions in Event Viewer.
You can view them using:
Event Viewer > Windows Logs > System
Event Viewer > Windows Logs > Application
Event Viewer > Applications and Services Logs
Some upgrade-related logs are stored under:
Microsoft > Windows > Setup
This area may show errors with detailed codes even when setup files look confusing.
12) Rollback Logs (When Upgrade Fails and Reverts)
When an upgrade fails, Windows may automatically rollback to the previous version. During rollback, Windows generates additional logs.
Common rollback-related log locations include:
C:$WINDOWS.~BT\Sources\Rollback
C:\Windows\Panther\Rollback
These logs help identify why the upgrade failed and what triggered the rollback.
You may see rollback logs like:
setupact.log (rollback details)
setuperr.log (rollback errors)
Rollback specific XML reports
If your PC says something like “We couldn’t install Windows 11” and then reverts back, rollback logs are very important.
Hidden Upgrade Folders You Should Know About
During upgrade, Windows creates temporary hidden folders on the system drive. These folders may disappear after a few days or after Disk Cleanup runs.
Here are the main ones:
C:$WINDOWS.~BT
This folder contains installation files, setup folders, and Panther logs.
C:\Windows.old
This folder contains the old Windows installation after upgrade. It may include additional logs and old system files.
C:$WINDOWS.~WS
This may exist in some upgrade methods (like Media Creation Tool style upgrades).
If you don’t see these folders, you may need to enable hidden files:
Open File Explorer
Click View
Enable Hidden items
Also, some of these folders require administrator access to open.
How to Open and Read Windows Upgrade Log Files
Most upgrade logs are text-based and can be opened easily.
You can use:
Notepad (simple, works fine)
Notepad++ (better for large files)
CMTrace (best for reading setup logs cleanly)
If you open setupact.log and it looks too long, the easiest way is:
Press Ctrl + F
Search for words like Error, Fail, Rollback, or 0xC1900101
These keywords usually take you directly to the real issue.
Common Upgrade Error Codes You May See in Logs
Even if you don’t fully understand log files, recognizing common error codes can help.
Here are a few common ones:
0xC1900101
Usually driver-related (graphics, WiFi, storage controller)
0x80070070
Not enough storage space
0x800F081F
Missing or corrupted Windows component files
0x8007042B or 0xC1900208
App compatibility issue blocking upgrade
The logs usually explain which driver or app is causing the problem.
What Logs Should You Check First If Upgrade Fails?
If your upgrade fails, you don’t need to read everything. Start with these most important logs:
setupact.log (shows the complete upgrade process step-by-step)
setuperr.log (shows direct errors)
BlueBox.log (compatibility problems)
CompatData.xml (blocked drivers or apps)
MOSetup.log (Windows Update upgrade problems)
This order helps you quickly find the root cause without wasting time.
After Successful Upgrade: Should You Delete These Logs?
If your upgrade completed successfully and your PC works fine, it’s okay to keep logs. They don’t usually take too much space.
However, Windows upgrade folders like Windows.old and $WINDOWS.~BT can take a lot of storage.
If you need space, you can delete old upgrade files using:
Settings > System > Storage > Temporary files
Disk Cleanup tool
But make sure everything works properly before deleting them, because removing Windows.old will also remove your easy rollback option.
Final Thoughts
Windows upgrade logs are one of the most useful resources when something goes wrong during an upgrade. They are created automatically by the system to record everything that happened during setup, including compatibility checks, file installation actions, driver migration, and rollback details.
The most important upgrade logs are usually found in the Panther folder, along with files like setupact.log, setuperr.log, and compatibility logs such as CompatData.xml and BlueBox.log. If the upgrade fails through Windows Update, MOSetup logs and Windows Update logs become even more important.
If you are troubleshooting an upgrade failure, start with setupact.log and setuperr.log first, and then move to compatibility and servicing logs. With the right log file, you can identify the exact driver or error that broke the upgrade and fix it without reinstalling Windows again.
![Log files created when you upgrade Windows to a newer version [Windows 11/10]](https://www.geeksdigit.com/wp-content/themes/rehub-theme/images/default/noimage_70_70.png)
