236 lines
12 KiB
Markdown
236 lines
12 KiB
Markdown
## User
|
|
- **User:** Howard Enos (howard)
|
|
- **Machine:** Howard-Home
|
|
- **Role:** tech
|
|
|
|
## Session Summary
|
|
|
|
Diagnosed a Windows 10 -> 11 in-place upgrade failure on Carrie's machine at Rednour. Setup
|
|
rolled back with error `0x8007000D - 0x2000C`: "The installation failed in the SAFE_OS phase
|
|
with an error during APPLY_IMAGE operation."
|
|
|
|
Decoded the failure: `0x8007000D` = `ERROR_INVALID_DATA`; `0x2000C` = the failure occurred in
|
|
the SAFE_OS (offline WinPE) phase during the APPLY_IMAGE step, i.e. Setup choked while laying
|
|
down the new Windows image. This class of failure points at corrupt/incomplete setup media or
|
|
download, a storage/disk issue, or interference from drivers, AV, or attached external devices —
|
|
not a TPM/hardware compatibility block (which fails earlier with a different message).
|
|
|
|
Provided a prioritized remediation path: (1) unplug all non-essential externals (USB drives,
|
|
docks, dongles, SD cards) and temporarily disable third-party AV; (2) build fresh install media
|
|
via the Media Creation Tool and run setup.exe from a mounted ISO rather than the in-place
|
|
download/Update Assistant; (3) clear the old upgrade cache (`$WINDOWS.~BT`, `$WINDOWS.~WS`,
|
|
SoftwareDistribution\Download) after stopping wuauserv/bits; (4) repair the running OS with DISM
|
|
RestoreHealth + SFC + chkdsk and confirm 20+ GB free; (5) update storage/chipset drivers
|
|
(Intel RST / AMD RAID being a classic APPLY_IMAGE culprit).
|
|
|
|
Howard reported he has already updated drivers and run all the repairs. He will attempt the
|
|
upgrade on Carrie's machine tonight and will loop me back in if it fails. No remote action was
|
|
taken this session — GuruRMM does not work for Rednour (see Pending), so any remote assist is
|
|
currently blocked; this would be a hands-on / by-hand effort.
|
|
|
|
## Key Decisions
|
|
|
|
- Classified the error as media/storage/interference rather than a hardware-compatibility block,
|
|
based on the SAFE_OS + APPLY_IMAGE failure signature.
|
|
- Recommended a fresh ISO mounted in-Windows (setup.exe) over the in-place download, since the
|
|
download cache is a frequent source of the invalid-data corruption.
|
|
- Held off on any remote remediation this session: upgrade is scheduled by Howard for tonight,
|
|
and RMM coverage for Rednour is non-functional.
|
|
|
|
## Problems Encountered
|
|
|
|
- Windows 11 in-place upgrade fails at SAFE_OS / APPLY_IMAGE with `0x8007000D - 0x2000C`.
|
|
Not yet resolved — driver updates and OS repairs already done by Howard; next attempt is a
|
|
manual upgrade tonight. If it recurs, the actionable next step is to pull the first error from
|
|
`C:\$WINDOWS.~BT\Sources\Panther\setuperr.log` around the APPLY_IMAGE step.
|
|
- GuruRMM is not working for Rednour, so the machine cannot be assisted/repaired remotely.
|
|
|
|
## Configuration Changes
|
|
|
|
None this session (advisory/diagnostic only).
|
|
|
|
## Credentials & Secrets
|
|
|
|
None discovered or created.
|
|
|
|
## Infrastructure & Servers
|
|
|
|
- Client: Rednour
|
|
- Affected machine: Carrie's workstation (Windows 10, attempting upgrade to Windows 11)
|
|
- GuruRMM: NOT functional for Rednour client (remote management unavailable)
|
|
|
|
## Commands & Outputs
|
|
|
|
Error shown on Carrie's machine:
|
|
```
|
|
0x8007000D - 0x2000C
|
|
The installation failed in the SAFE_OS phase with an error during APPLY_IMAGE operation
|
|
```
|
|
|
|
Recommended OS-repair sequence (already run by Howard):
|
|
```
|
|
dism /online /cleanup-image /restorehealth
|
|
sfc /scannow
|
|
chkdsk C: /scan
|
|
```
|
|
|
|
Upgrade-cache reset (elevated):
|
|
```
|
|
net stop wuauserv
|
|
net stop bits
|
|
# delete C:\$WINDOWS.~BT, C:\$WINDOWS.~WS (hidden), C:\Windows\SoftwareDistribution\Download\*
|
|
net start wuauserv
|
|
net start bits
|
|
```
|
|
|
|
Diagnostic logs to pull if the next attempt fails:
|
|
```
|
|
C:\$WINDOWS.~BT\Sources\Panther\setupact.log
|
|
C:\$WINDOWS.~BT\Sources\Panther\setuperr.log
|
|
```
|
|
|
|
## Pending / Incomplete Tasks
|
|
|
|
- Howard to manually attempt the Win10 -> Win11 upgrade on Carrie's machine TONIGHT
|
|
(2026-06-29), using a fresh ISO / setup.exe with externals unplugged and AV disabled.
|
|
- If it fails again: capture `setuperr.log` from `C:\$WINDOWS.~BT\Sources\Panther\` and bring
|
|
it back for analysis of the specific failing file/volume/driver.
|
|
- BLOCKER: GuruRMM does not work for Rednour — no remote remediation available; assist must be
|
|
hands-on.
|
|
|
|
## Reference Information
|
|
|
|
- Error: `0x8007000D` (ERROR_INVALID_DATA) / `0x2000C` (SAFE_OS phase, APPLY_IMAGE operation)
|
|
- Panther logs: `C:\$WINDOWS.~BT\Sources\Panther\setupact.log` and `setuperr.log`
|
|
- **Billing target ticket: Syncro #32368 (id 111999527)** — Rednour Law (customer 1224246),
|
|
subject "New machine for Carrie to act as a central hub/file share. Upgrade for reception
|
|
computer that is running slow." (created 2026-06-02, status Customer Reply). All labor for
|
|
this Carrie-machine / reception-upgrade effort gets billed here when the work is done.
|
|
Route the actual billing through `/syncro` — do not free-hand the API.
|
|
URL: https://computerguru.syncromsp.com/tickets/111999527
|
|
|
|
## Update: 16:?? PT — billing ticket identified
|
|
|
|
Howard provided the Syncro ticket the Carrie-machine work will be billed to once complete:
|
|
**#32368 (id 111999527)** — Rednour Law. Confirmed read-only that it belongs to customer
|
|
1224246 and matches the scope (new central-hub/file-share machine for Carrie + reception
|
|
upgrade). No billing entered yet — billing happens at completion, via `/syncro`.
|
|
|
|
## Update: ~22:30 PT — ROOT CAUSE FOUND + UPGRADE SUCCEEDED (live over GuruRMM)
|
|
|
|
**Outcome: REDNOURCARRIEVI (rednourcarrievirt) successfully upgraded to Windows 11 25H2
|
|
(build 26200).** Root cause of the prior failures: a **corrupt Win11 install image**.
|
|
|
|
### GuruRMM IS working for Rednour (correcting earlier session note)
|
|
Contrary to the earlier "RMM doesn't work for Rednour" note, the GuruRMM agent on this box
|
|
(`8e4e2221-7e2a-4a6f-9eda-864568539961`, hostname `rednourcarrievirt`, agent v0.6.66) is
|
|
**online and executing commands fine**. All diagnosis below was done live over `/rmm`. The
|
|
agent record's `is_connected` field returns null, but `status` = "online" and commands
|
|
complete exit 0. (The earlier "RMM didn't work" likely referred to the Mac enrollment issue,
|
|
not this Windows box.) The client filter on `/api/agents` uses `client_name == "Rednour Law
|
|
Offices"` (not "rednour") — search by hostname.
|
|
|
|
### Root cause (from setuperr.log, pulled live)
|
|
The `0x8007000D` SAFE_OS error is only the final rollup. The real, upstream error:
|
|
```
|
|
SPWIMCallback: Error in apply of ...\WinSxS\...kernelstreaming...10.0.26100.6584...\ks.sys.
|
|
GLE [1392] <- ERROR_FILE_CORRUPT
|
|
CApplyWIM: Failure while applying image 6 for <Install.wim>. Error 0x80070570
|
|
-> Operation failed -> Failed execution phase Safe OS. Error: 0x8007000D
|
|
```
|
|
`ks.sys` (kernel-streaming driver) failed to decompress from the WIM with
|
|
`ERROR_FILE_CORRUPT` — deterministically, the SAME file every attempt.
|
|
|
|
### How it was proven (not guessing)
|
|
1. First attempt's media was under `C:\Users\Carrie\OneDrive - Rednour Law\Desktop\...` — the
|
|
`Install.wim` there threw `0x80070780` (ERROR_CANT_ACCESS_FILE) because OneDrive served a
|
|
cloud placeholder that WinPE/SAFE_OS (OneDrive not running) couldn't read. Howard MOVED the
|
|
extracted folder to `C:\temp\Win11_25H2_English_x64` — fixed the access error but the
|
|
`ks.sys` `0x80070570` corruption persisted (same bytes moved along).
|
|
2. Hashed the extracted `install.wim`: SHA256
|
|
`9AD2EF7251AED36BCF5E36D4F067B5277C205ED02E3FDFA354069505214C7D54`.
|
|
3. Mounted the original desktop `.iso` and hashed ITS `install.wim` (`F:\sources\install.wim`)
|
|
= **identical hash** to the extracted copy. Identical bytes in both = the **download itself
|
|
was corrupt**, not the extraction. Disk health checked: WD Green SN350 1TB SSD = Healthy/OK,
|
|
so not a failing-disk read fault. Deterministic same-file CRC failure = bad source image.
|
|
|
|
### Fix
|
|
Re-download via **Media Creation Tool** (validates its own download integrity). New media:
|
|
`C:\temp\Windows.iso` (6.39 GB, ESD-based, mounted drive labeled `ESD-ISO`, uses
|
|
`install.esd` not `install.wim`). Ran `setup.exe` from the mounted ISO. Watched live over RMM:
|
|
down-level apply climbed 28%->36%->46%->50%->68% with NO `ks.sys`/`0x80070570` (all 3 prior
|
|
attempts died at ~49%), rebooted into SAFE_OS, applied offline, booted into Win11.
|
|
|
|
### Post-upgrade verified state (build 26200 / 25H2)
|
|
- OS: Windows 11 Pro, build 26200, DisplayVersion 25H2. Reboot pending: No. Setup running: No.
|
|
- `C:\Windows.old` present -> 10-day rollback window (do NOT run Disk Cleanup until apps verified).
|
|
- Datto AV (`EndpointProtectionService`) auto-restored Running after reboot.
|
|
- Defender RTP = False -> EXPECTED, Datto AV is the registered primary AV on this box.
|
|
|
|
### "endpointprotection.exe" identification (Howard asked)
|
|
The `endpointprotection` process in Task Manager =
|
|
`C:\Program Files\infocyte\agent\dattoav\Endpoint Protection SDK\endpointprotection.exe`,
|
|
service `EndpointProtectionService` ("Endpoint Protection Service", Auto/Running). It is
|
|
**Datto AV** (the AV engine inside the Datto EDR/Infocyte agent) — ACG-managed, legitimate,
|
|
not malware. Datto tenant azcomp4587. To pause for an upgrade: `Stop-Service
|
|
EndpointProtectionService -Force` (Auto-start; returns on reboot).
|
|
|
|
## Key Decisions (this update)
|
|
- Diagnosed entirely over GuruRMM rather than waiting for hands-on log retrieval, after
|
|
confirming the agent executes commands on this box.
|
|
- Hash-compared ISO vs extracted `install.wim` to decisively distinguish a corrupt DOWNLOAD
|
|
from extraction corruption / failing hardware before recommending a 7 GB re-download.
|
|
- Recommended Media Creation Tool (integrity-validated) over a plain browser ISO re-download to
|
|
avoid another silently-corrupt image.
|
|
- Did NOT unilaterally stop Datto AV mid-run — corrupt download was the proven cause, AV was
|
|
secondary; flagged it instead.
|
|
|
|
## Problems Encountered (this update)
|
|
- Win11 upgrade failed 3x at SAFE_OS/APPLY_IMAGE `0x8007000D`. Root cause = corrupt download
|
|
(`ks.sys` `0x80070570`). Resolved with fresh Media Creation Tool media.
|
|
- PowerShell variable-expansion trap: `"C:\$WINDOWS.~BT"` in a DOUBLE-quoted PS string expands
|
|
`$WINDOWS` to empty -> `C:\.~BT`, so Test-Path falsely returned "folder gone." Fix: escape as
|
|
`"C:\`$WINDOWS.~BT"` (backtick) or single-quote the path. (logged as friction)
|
|
- Bash tool default timeout is 120000ms (2 min); long RMM watch loops got cut off twice until
|
|
the `timeout` param was set to 600000.
|
|
|
|
## Update — Pending / Incomplete Tasks (supersedes earlier "tonight" plan)
|
|
- [DONE] Win11 upgrade on Carrie's machine (build 26200/25H2).
|
|
- Verify post-upgrade that the firm's SMB shares (`Documents`, Time Matters, Timeslips) and
|
|
local accounts (`carrie`, `nick`, `emma`) survived the feature upgrade (sharing/firewall can
|
|
reset). Nick's Mac mounts `smb://192.168.10.194/Documents`.
|
|
- Confirm with Carrie that Time Matters / Timeslips / WordPerfect work on Win11 before the
|
|
10-day `Windows.old` rollback window lapses (don't Disk-Cleanup it until then).
|
|
- [DONE] BILLING: invoiced Syncro #32368 (see billing update below).
|
|
- Optional: pause Datto AV (`EndpointProtectionService`) for any future feature upgrades.
|
|
|
|
## Update: ~22:50 PT — billed + invoiced #32368 (via /syncro)
|
|
|
|
Added the in-shop labor and a customer-visible work-summary note to Syncro ticket #32368
|
|
(id 111999527, Rednour Law, customer 1224246, prepay 0 / break-fix), then invoiced.
|
|
|
|
**Line items added this session (product 573881 Labor - In Shop Business @ $150/hr, non-tax):**
|
|
- id 43070074 — Carrie's machine: cloned old workstation -> new machine + Win11 Pro upgrade
|
|
(several attempts). 1.5h = $225.00. Description notes interim USB-to-HDMI adapter until the
|
|
proper one arrives.
|
|
- id 43070075 — FRONTDESKRECEPT (reception): clone to new NVMe SSD, big perf improvement.
|
|
1.0h = $150.00.
|
|
|
|
**NOT billed as a line item (per Howard):** Nick — printer setup + future custom phone/desktop
|
|
cables — NO CHARGE. Documented in the public note only.
|
|
|
|
**Public work-summary note** (comment id 421331789, hidden:false, do_not_email:true) covers all
|
|
four machines: Carrie, reception, LEGALASST (Win11 upgrade), and Nick (no charge).
|
|
|
|
**LEGALASST already billed by a prior session** (confirmed, not duplicated): line id 43069980,
|
|
Labor - Remote Business 1.5h @ $150 = $225, user_id 1750 (Howard), desc "LEGALASST Win10->Win11
|
|
in-place upgrade to repair corrupted Windows ... explorer .zip hangs + WordPerfect save errors;
|
|
remote." -> confirms LEGALASST WAS upgraded to Win11.
|
|
|
|
**Pre-existing hardware on the ticket** (Carrie's adapters, taxable): HDMI cable $19.99 +
|
|
USB 3.0->HDMI adapter $43.99.
|
|
|
|
**Invoice: #67912 (id 1650846801), total $669.55** (labor $600 non-taxable + hardware $63.98
|
|
+ ~$5.57 tax on hardware). Invoice note set (no-block upsell). Ticket status -> Invoiced.
|
|
Tax note: labor non-taxable, hardware taxable.
|