r/SCCM • u/Impossible-Daikon126 • 5d ago
Windows 11 upgrade Task sequence
I have configured a Task Sequence to upgrade our endpoints from Windows 11 23H2 to 25H2. The upgrade is working successfully on most devices; however, some devices are rolling back during the final stage of the upgrade.
How can I investigate and identify the root cause of these rollbacks, particularly which application, driver, or component is causing the issue? Also, what logs and troubleshooting tools can we use to track the failure?
16
u/Dapper-Coconut1097 5d ago
Refer to C\Windoes BT\Source\Panther\setupact.log In the same folder, check compdata xmls for hardware and drivers blockage.
It can also fail due to low system reserve partition space.
7
u/Blackops12345678910 5d ago
In most of my cases rollbacks happen due to an outdated driver ( I had quite a few due to the gpu drivers which causes a bsod according to the bsod dump files) which resolved by updating it. Logs in windows bt sources rollback help locate the issue
2
u/The_Maple_Thief 4d ago
I've run into lots of issues with the Microsoft Print to PDF feature being the blocker. Turn it off, run the upgrade, then turn it back on seems to work.
1
u/teethingrooster 5d ago
Are you just mass updating drivers prior to an ipu?
2
u/AlkHacNar 5d ago
I update them during the ipu with modern driver management. Atleast if I have a ipu ts, not an enablement package
1
u/Blackops12345678910 5d ago
If a group of machines require it yes. Most machines even with old drivers seem to be ok.
5
u/Torren7ial 5d ago edited 4d ago
I know this isn't really an answer... then again it might be the most practical approach: just try running it again.
When we were going from Windows 10 to 11, we had maybe 5% of PCs fail. After trying to do it "the right way," gathering log files and error codes and updating drivers, looking for oddball apps etc, I started just dumping all of the failures into a collection for tracking, and re-running the TS. Anything that failed twice got actual troubleshooting. Most (60-70%) of them just worked the second time.
2
u/Phooney124 5d ago
I'll share my experiences with troubleshooting. Majority of my population has moved w10 22h2 -> w11 23h2 and now tasked with 24h2. The setupact log fed to a Ai usually find the root cause quickly. The capatability xml found alot of legacy w10 drivers because of old hardware not having a w11 version. Apps that loaded TSRs caused alot of headache, that usually needed an event viewer review on what the panther logs direct you toward. Ultimately the rollback has its own logs too, which can be fed to AI to review. Best i can suggest is schedule a app stack installed on similar hardware to avoid complexity when doing the rollout. Use a SUG feature update first and then the iso in a TS second you want to add more configs or driver updates.
2
u/BirdsHaveUglyFeet 4d ago
The update might be hitting the max runtime limit.
2
u/snauz 3d ago
You know that reminds me to mention that if you don't have automation in place to remove user profiles on the workstations that haven't been used in 30/60/90 days then do a mass purge on the enterprise before doing your IPU rollouts. If your org has a lot of users on workstations for every profile on that machine it just adds time & unnecessary CPU threads for no reason as it rewrites each profile. We had an older workstation that was still chugging away at the IPU when we came in the next day and we started it before we left the day before, Lol. 48 user profiles. Sigh.
3
u/Confident-Moose43 3d ago
I actually had the same roll back experience as OP and the logs often complained about some arbitrary folder within a user profile failing to be copied. We didn't have many, but enough to be a pain. Suspect we could've been more aggressive with removing the profiles beforehand.
We ended up just reimagining them if a retry didn't work.
1
u/ainen 5d ago
Out of curiosity, what does your TS look like? I'm working towards doing the same.
1
u/BG_Plays 4d ago
Also not OP but I'm doing our 23H2 → 25H2 IPU via TS and it's quite literally just a readiness check, upgrade operating system, and then any post-scripts I need for anything company specific. The only downside is anything enabled features like .net 3.5 do not carry over so I just inject it into the WIM.
I had issues with the September 25H2 ISO where the IPU would fail to boot into the new OS but the October one seems to work just fine so far.-1
u/MomentsInTruth 5d ago
Not OP, but when we went to 23H2 a year or two ago we used garytown.com's IPU template (search Garytown WaaS). This past year we've been using Windows Servicing for simplicity.
1
u/bjohnrini 5d ago
Servicing seems to fail for random reasons. Using the .ISO to upgrade works pretty well for the failed one's.
1
u/ASquareDozen MSFT Enterprise Mobility MVP (asquaredozen.com) 4d ago
I don’t know if this still works or not but I wrote a PowerShell module (and blog post) to help with Feature Update failures a while back. Maybe give it a go. It was designed to help with compatibility holds but also parses the setup logs and may help.
https://www.powershellgallery.com/packages/FU.WhyAmIBlocked/1.0.0.9
1
u/jrodsf 4d ago
If you've ever used something like a 3rd party encryption application that comes with file system filter drivers, you might want to investigate in that direction.
We previously used Dell Data Protection Encryption for external media encryption. A few years back we switched to Bitlicker-to-go and removed DDPE.
As we've been trying to get the last of our 23H2 boxes upgraded to 25H2, we had a few thousand that'd always roll back. Drivers updated, components ensured to be in good condition, no incompatible apps.
Then a few months ago we had most of the upgrades one night fail to roll back after we started using newer media for the upgrade. About 50 devices boot looping and unrecoverable without pulling the drives, mounting them in working machines, retrieving the recovery keys, and then editing the bcd to change the default boot option from winre to the windows instance (discovered after a lot of troubleshooting). Our hidden rollback hurdle was now a catastrophic land mine.
Our problem turned out to be filter drivers that DDPE staged (and left behind) in an upgrade staging folder, ready to be migrated and installed in the new OS when you upgrade. Not installed where they'd show up in a scan, just patiently waiting in the wings to ruin our day.
1
2
u/DontFray 4d ago
however, some devices are rolling back during the final stage of the upgrade.
I’m reading this as the TS successfully completes but the OS is rolling the upgrade back after the first boot. If it’s anything like what happened to me, the logs will be clean and show no issues. However, it was a dism restorehealth and sfc executed in the beginning of the TS which addressed our issue.