## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Diagnosed a Windows 10 -> 11 in-place upgrade failure on Carrie's machine at Rednour. Setup
rolled back with error `0x8007000D - 0x2000C`: "The installation failed in the SAFE_OS phase
with an error during APPLY_IMAGE operation."

Decoded the failure: `0x8007000D` = `ERROR_INVALID_DATA`; `0x2000C` = the failure occurred in
the SAFE_OS (offline WinPE) phase during the APPLY_IMAGE step, i.e. Setup choked while laying
down the new Windows image. This class of failure points at corrupt/incomplete setup media or
download, a storage/disk issue, or interference from drivers, AV, or attached external devices —
not a TPM/hardware compatibility block (which fails earlier with a different message).

Provided a prioritized remediation path: (1) unplug all non-essential externals (USB drives,
docks, dongles, SD cards) and temporarily disable third-party AV; (2) build fresh install media
via the Media Creation Tool and run setup.exe from a mounted ISO rather than the in-place
download/Update Assistant; (3) clear the old upgrade cache (`$WINDOWS.~BT`, `$WINDOWS.~WS`,
SoftwareDistribution\Download) after stopping wuauserv/bits; (4) repair the running OS with DISM
RestoreHealth + SFC + chkdsk and confirm 20+ GB free; (5) update storage/chipset drivers
(Intel RST / AMD RAID being a classic APPLY_IMAGE culprit).

Howard reported he has already updated drivers and run all the repairs. He will attempt the
upgrade on Carrie's machine tonight and will loop me back in if it fails. No remote action was
taken this session — GuruRMM does not work for Rednour (see Pending), so any remote assist is
currently blocked; this would be a hands-on / by-hand effort.

## Key Decisions

- Classified the error as media/storage/interference rather than a hardware-compatibility block,
  based on the SAFE_OS + APPLY_IMAGE failure signature.
- Recommended a fresh ISO mounted in-Windows (setup.exe) over the in-place download, since the
  download cache is a frequent source of the invalid-data corruption.
- Held off on any remote remediation this session: upgrade is scheduled by Howard for tonight,
  and RMM coverage for Rednour is non-functional.

## Problems Encountered

- Windows 11 in-place upgrade fails at SAFE_OS / APPLY_IMAGE with `0x8007000D - 0x2000C`.
  Not yet resolved — driver updates and OS repairs already done by Howard; next attempt is a
  manual upgrade tonight. If it recurs, the actionable next step is to pull the first error from
  `C:\$WINDOWS.~BT\Sources\Panther\setuperr.log` around the APPLY_IMAGE step.
- GuruRMM is not working for Rednour, so the machine cannot be assisted/repaired remotely.

## Configuration Changes

None this session (advisory/diagnostic only).

## Credentials & Secrets

None discovered or created.

## Infrastructure & Servers

- Client: Rednour
- Affected machine: Carrie's workstation (Windows 10, attempting upgrade to Windows 11)
- GuruRMM: NOT functional for Rednour client (remote management unavailable)

## Commands & Outputs

Error shown on Carrie's machine:
```
0x8007000D - 0x2000C
The installation failed in the SAFE_OS phase with an error during APPLY_IMAGE operation
```

Recommended OS-repair sequence (already run by Howard):
```
dism /online /cleanup-image /restorehealth
sfc /scannow
chkdsk C: /scan
```

Upgrade-cache reset (elevated):
```
net stop wuauserv
net stop bits
# delete C:\$WINDOWS.~BT, C:\$WINDOWS.~WS (hidden), C:\Windows\SoftwareDistribution\Download\*
net start wuauserv
net start bits
```

Diagnostic logs to pull if the next attempt fails:
```
C:\$WINDOWS.~BT\Sources\Panther\setupact.log
C:\$WINDOWS.~BT\Sources\Panther\setuperr.log
```

## Pending / Incomplete Tasks

- Howard to manually attempt the Win10 -> Win11 upgrade on Carrie's machine TONIGHT
  (2026-06-29), using a fresh ISO / setup.exe with externals unplugged and AV disabled.
- If it fails again: capture `setuperr.log` from `C:\$WINDOWS.~BT\Sources\Panther\` and bring
  it back for analysis of the specific failing file/volume/driver.
- BLOCKER: GuruRMM does not work for Rednour — no remote remediation available; assist must be
  hands-on.

## Reference Information

- Error: `0x8007000D` (ERROR_INVALID_DATA) / `0x2000C` (SAFE_OS phase, APPLY_IMAGE operation)
- Panther logs: `C:\$WINDOWS.~BT\Sources\Panther\setupact.log` and `setuperr.log`
- **Billing target ticket: Syncro #32368 (id 111999527)** — Rednour Law (customer 1224246),
  subject "New machine for Carrie to act as a central hub/file share. Upgrade for reception
  computer that is running slow." (created 2026-06-02, status Customer Reply). All labor for
  this Carrie-machine / reception-upgrade effort gets billed here when the work is done.
  Route the actual billing through `/syncro` — do not free-hand the API.
  URL: https://computerguru.syncromsp.com/tickets/111999527

## Update: 16:?? PT — billing ticket identified

Howard provided the Syncro ticket the Carrie-machine work will be billed to once complete:
**#32368 (id 111999527)** — Rednour Law. Confirmed read-only that it belongs to customer
1224246 and matches the scope (new central-hub/file-share machine for Carrie + reception
upgrade). No billing entered yet — billing happens at completion, via `/syncro`.

## Update: ~22:30 PT — ROOT CAUSE FOUND + UPGRADE SUCCEEDED (live over GuruRMM)

**Outcome: REDNOURCARRIEVI (rednourcarrievirt) successfully upgraded to Windows 11 25H2
(build 26200).** Root cause of the prior failures: a **corrupt Win11 install image**.

### GuruRMM IS working for Rednour (correcting earlier session note)
Contrary to the earlier "RMM doesn't work for Rednour" note, the GuruRMM agent on this box
(`8e4e2221-7e2a-4a6f-9eda-864568539961`, hostname `rednourcarrievirt`, agent v0.6.66) is
**online and executing commands fine**. All diagnosis below was done live over `/rmm`. The
agent record's `is_connected` field returns null, but `status` = "online" and commands
complete exit 0. (The earlier "RMM didn't work" likely referred to the Mac enrollment issue,
not this Windows box.) The client filter on `/api/agents` uses `client_name == "Rednour Law
Offices"` (not "rednour") — search by hostname.

### Root cause (from setuperr.log, pulled live)
The `0x8007000D` SAFE_OS error is only the final rollup. The real, upstream error:
```
SPWIMCallback: Error in apply of ...\WinSxS\...kernelstreaming...10.0.26100.6584...\ks.sys.
  GLE [1392]                               <- ERROR_FILE_CORRUPT
CApplyWIM: Failure while applying image 6 for <Install.wim>. Error 0x80070570
  -> Operation failed -> Failed execution phase Safe OS. Error: 0x8007000D
```
`ks.sys` (kernel-streaming driver) failed to decompress from the WIM with
`ERROR_FILE_CORRUPT` — deterministically, the SAME file every attempt.

### How it was proven (not guessing)
1. First attempt's media was under `C:\Users\Carrie\OneDrive - Rednour Law\Desktop\...` — the
   `Install.wim` there threw `0x80070780` (ERROR_CANT_ACCESS_FILE) because OneDrive served a
   cloud placeholder that WinPE/SAFE_OS (OneDrive not running) couldn't read. Howard MOVED the
   extracted folder to `C:\temp\Win11_25H2_English_x64` — fixed the access error but the
   `ks.sys` `0x80070570` corruption persisted (same bytes moved along).
2. Hashed the extracted `install.wim`: SHA256
   `9AD2EF7251AED36BCF5E36D4F067B5277C205ED02E3FDFA354069505214C7D54`.
3. Mounted the original desktop `.iso` and hashed ITS `install.wim` (`F:\sources\install.wim`)
   = **identical hash** to the extracted copy. Identical bytes in both = the **download itself
   was corrupt**, not the extraction. Disk health checked: WD Green SN350 1TB SSD = Healthy/OK,
   so not a failing-disk read fault. Deterministic same-file CRC failure = bad source image.

### Fix
Re-download via **Media Creation Tool** (validates its own download integrity). New media:
`C:\temp\Windows.iso` (6.39 GB, ESD-based, mounted drive labeled `ESD-ISO`, uses
`install.esd` not `install.wim`). Ran `setup.exe` from the mounted ISO. Watched live over RMM:
down-level apply climbed 28%->36%->46%->50%->68% with NO `ks.sys`/`0x80070570` (all 3 prior
attempts died at ~49%), rebooted into SAFE_OS, applied offline, booted into Win11.

### Post-upgrade verified state (build 26200 / 25H2)
- OS: Windows 11 Pro, build 26200, DisplayVersion 25H2. Reboot pending: No. Setup running: No.
- `C:\Windows.old` present -> 10-day rollback window (do NOT run Disk Cleanup until apps verified).
- Datto AV (`EndpointProtectionService`) auto-restored Running after reboot.
- Defender RTP = False -> EXPECTED, Datto AV is the registered primary AV on this box.

### "endpointprotection.exe" identification (Howard asked)
The `endpointprotection` process in Task Manager =
`C:\Program Files\infocyte\agent\dattoav\Endpoint Protection SDK\endpointprotection.exe`,
service `EndpointProtectionService` ("Endpoint Protection Service", Auto/Running). It is
**Datto AV** (the AV engine inside the Datto EDR/Infocyte agent) — ACG-managed, legitimate,
not malware. Datto tenant azcomp4587. To pause for an upgrade: `Stop-Service
EndpointProtectionService -Force` (Auto-start; returns on reboot).

## Key Decisions (this update)
- Diagnosed entirely over GuruRMM rather than waiting for hands-on log retrieval, after
  confirming the agent executes commands on this box.
- Hash-compared ISO vs extracted `install.wim` to decisively distinguish a corrupt DOWNLOAD
  from extraction corruption / failing hardware before recommending a 7 GB re-download.
- Recommended Media Creation Tool (integrity-validated) over a plain browser ISO re-download to
  avoid another silently-corrupt image.
- Did NOT unilaterally stop Datto AV mid-run — corrupt download was the proven cause, AV was
  secondary; flagged it instead.

## Problems Encountered (this update)
- Win11 upgrade failed 3x at SAFE_OS/APPLY_IMAGE `0x8007000D`. Root cause = corrupt download
  (`ks.sys` `0x80070570`). Resolved with fresh Media Creation Tool media.
- PowerShell variable-expansion trap: `"C:\$WINDOWS.~BT"` in a DOUBLE-quoted PS string expands
  `$WINDOWS` to empty -> `C:\.~BT`, so Test-Path falsely returned "folder gone." Fix: escape as
  `"C:\`$WINDOWS.~BT"` (backtick) or single-quote the path. (logged as friction)
- Bash tool default timeout is 120000ms (2 min); long RMM watch loops got cut off twice until
  the `timeout` param was set to 600000.

## Update — Pending / Incomplete Tasks (supersedes earlier "tonight" plan)
- [DONE] Win11 upgrade on Carrie's machine (build 26200/25H2).
- Verify post-upgrade that the firm's SMB shares (`Documents`, Time Matters, Timeslips) and
  local accounts (`carrie`, `nick`, `emma`) survived the feature upgrade (sharing/firewall can
  reset). Nick's Mac mounts `smb://192.168.10.194/Documents`.
- Confirm with Carrie that Time Matters / Timeslips / WordPerfect work on Win11 before the
  10-day `Windows.old` rollback window lapses (don't Disk-Cleanup it until then).
- [DONE] BILLING: invoiced Syncro #32368 (see billing update below).
- Optional: pause Datto AV (`EndpointProtectionService`) for any future feature upgrades.

## Update: ~22:50 PT — billed + invoiced #32368 (via /syncro)

Added the in-shop labor and a customer-visible work-summary note to Syncro ticket #32368
(id 111999527, Rednour Law, customer 1224246, prepay 0 / break-fix), then invoiced.

**Line items added this session (product 573881 Labor - In Shop Business @ $150/hr, non-tax):**
- id 43070074 — Carrie's machine: cloned old workstation -> new machine + Win11 Pro upgrade
  (several attempts). 1.5h = $225.00. Description notes interim USB-to-HDMI adapter until the
  proper one arrives.
- id 43070075 — FRONTDESKRECEPT (reception): clone to new NVMe SSD, big perf improvement.
  1.0h = $150.00.

**NOT billed as a line item (per Howard):** Nick — printer setup + future custom phone/desktop
cables — NO CHARGE. Documented in the public note only.

**Public work-summary note** (comment id 421331789, hidden:false, do_not_email:true) covers all
four machines: Carrie, reception, LEGALASST (Win11 upgrade), and Nick (no charge).

**LEGALASST already billed by a prior session** (confirmed, not duplicated): line id 43069980,
Labor - Remote Business 1.5h @ $150 = $225, user_id 1750 (Howard), desc "LEGALASST Win10->Win11
in-place upgrade to repair corrupted Windows ... explorer .zip hangs + WordPerfect save errors;
remote." -> confirms LEGALASST WAS upgraded to Win11.

**Pre-existing hardware on the ticket** (Carrie's adapters, taxable): HDMI cable $19.99 +
USB 3.0->HDMI adapter $43.99.

**Invoice: #67912 (id 1650846801), total $669.55** (labor $600 non-taxable + hardware $63.98
+ ~$5.57 tax on hardware). Invoice note set (no-block upsell). Ticket status -> Invoiced.
Tax note: labor non-taxable, hardware taxable.