claudetools/clients/rednour/session-logs/2026-06/2026-06-29-howard-carrie-win11-upgrade-applyimage.md

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Diagnosed a Windows 10 -> 11 in-place upgrade failure on Carrie's machine at Rednour. Setup rolled back with error 0x8007000D - 0x2000C: "The installation failed in the SAFE_OS phase with an error during APPLY_IMAGE operation."

Decoded the failure: 0x8007000D = ERROR_INVALID_DATA; 0x2000C = the failure occurred in the SAFE_OS (offline WinPE) phase during the APPLY_IMAGE step, i.e. Setup choked while laying down the new Windows image. This class of failure points at corrupt/incomplete setup media or download, a storage/disk issue, or interference from drivers, AV, or attached external devices — not a TPM/hardware compatibility block (which fails earlier with a different message).

Provided a prioritized remediation path: (1) unplug all non-essential externals (USB drives, docks, dongles, SD cards) and temporarily disable third-party AV; (2) build fresh install media via the Media Creation Tool and run setup.exe from a mounted ISO rather than the in-place download/Update Assistant; (3) clear the old upgrade cache ($WINDOWS.~BT, $WINDOWS.~WS, SoftwareDistribution\Download) after stopping wuauserv/bits; (4) repair the running OS with DISM RestoreHealth + SFC + chkdsk and confirm 20+ GB free; (5) update storage/chipset drivers (Intel RST / AMD RAID being a classic APPLY_IMAGE culprit).

Howard reported he has already updated drivers and run all the repairs. He will attempt the upgrade on Carrie's machine tonight and will loop me back in if it fails. No remote action was taken this session — GuruRMM does not work for Rednour (see Pending), so any remote assist is currently blocked; this would be a hands-on / by-hand effort.

Key Decisions

• Classified the error as media/storage/interference rather than a hardware-compatibility block, based on the SAFE_OS + APPLY_IMAGE failure signature.
• Recommended a fresh ISO mounted in-Windows (setup.exe) over the in-place download, since the download cache is a frequent source of the invalid-data corruption.
• Held off on any remote remediation this session: upgrade is scheduled by Howard for tonight, and RMM coverage for Rednour is non-functional.

Problems Encountered

• Windows 11 in-place upgrade fails at SAFE_OS / APPLY_IMAGE with 0x8007000D - 0x2000C. Not yet resolved — driver updates and OS repairs already done by Howard; next attempt is a manual upgrade tonight. If it recurs, the actionable next step is to pull the first error from C:\$WINDOWS.~BT\Sources\Panther\setuperr.log around the APPLY_IMAGE step.
• GuruRMM is not working for Rednour, so the machine cannot be assisted/repaired remotely.

Configuration Changes

None this session (advisory/diagnostic only).

Credentials & Secrets

None discovered or created.

Infrastructure & Servers

• Client: Rednour
• Affected machine: Carrie's workstation (Windows 10, attempting upgrade to Windows 11)
• GuruRMM: NOT functional for Rednour client (remote management unavailable)

Commands & Outputs

Error shown on Carrie's machine:

0x8007000D - 0x2000C
The installation failed in the SAFE_OS phase with an error during APPLY_IMAGE operation

Recommended OS-repair sequence (already run by Howard):

dism /online /cleanup-image /restorehealth
sfc /scannow
chkdsk C: /scan

Upgrade-cache reset (elevated):

net stop wuauserv
net stop bits
# delete C:\$WINDOWS.~BT, C:\$WINDOWS.~WS (hidden), C:\Windows\SoftwareDistribution\Download\*
net start wuauserv
net start bits

Diagnostic logs to pull if the next attempt fails:

C:\$WINDOWS.~BT\Sources\Panther\setupact.log
C:\$WINDOWS.~BT\Sources\Panther\setuperr.log

Pending / Incomplete Tasks

• Howard to manually attempt the Win10 -> Win11 upgrade on Carrie's machine TONIGHT (2026-06-29), using a fresh ISO / setup.exe with externals unplugged and AV disabled.
• If it fails again: capture setuperr.log from C:\$WINDOWS.~BT\Sources\Panther\ and bring it back for analysis of the specific failing file/volume/driver.
• BLOCKER: GuruRMM does not work for Rednour — no remote remediation available; assist must be hands-on.

Reference Information

• Error: 0x8007000D (ERROR_INVALID_DATA) / 0x2000C (SAFE_OS phase, APPLY_IMAGE operation)
• Panther logs: C:\$WINDOWS.~BT\Sources\Panther\setupact.log and setuperr.log
• Billing target ticket: Syncro #32368 (id 111999527) — Rednour Law (customer 1224246), subject "New machine for Carrie to act as a central hub/file share. Upgrade for reception computer that is running slow." (created 2026-06-02, status Customer Reply). All labor for this Carrie-machine / reception-upgrade effort gets billed here when the work is done. Route the actual billing through /syncro — do not free-hand the API. URL: https://computerguru.syncromsp.com/tickets/111999527

Update: 16:?? PT — billing ticket identified

Howard provided the Syncro ticket the Carrie-machine work will be billed to once complete: #32368 (id 111999527) — Rednour Law. Confirmed read-only that it belongs to customer 1224246 and matches the scope (new central-hub/file-share machine for Carrie + reception upgrade). No billing entered yet — billing happens at completion, via /syncro.

Update: ~22:30 PT — ROOT CAUSE FOUND + UPGRADE SUCCEEDED (live over GuruRMM)

Outcome: REDNOURCARRIEVI (rednourcarrievirt) successfully upgraded to Windows 11 25H2 (build 26200). Root cause of the prior failures: a corrupt Win11 install image.

GuruRMM IS working for Rednour (correcting earlier session note)

Contrary to the earlier "RMM doesn't work for Rednour" note, the GuruRMM agent on this box (8e4e2221-7e2a-4a6f-9eda-864568539961, hostname rednourcarrievirt, agent v0.6.66) is online and executing commands fine. All diagnosis below was done live over /rmm. The agent record's is_connected field returns null, but status = "online" and commands complete exit 0. (The earlier "RMM didn't work" likely referred to the Mac enrollment issue, not this Windows box.) The client filter on /api/agents uses client_name == "Rednour Law Offices" (not "rednour") — search by hostname.

Root cause (from setuperr.log, pulled live)

The 0x8007000D SAFE_OS error is only the final rollup. The real, upstream error:

SPWIMCallback: Error in apply of ...\WinSxS\...kernelstreaming...10.0.26100.6584...\ks.sys.
  GLE [1392]                               <- ERROR_FILE_CORRUPT
CApplyWIM: Failure while applying image 6 for <Install.wim>. Error 0x80070570
  -> Operation failed -> Failed execution phase Safe OS. Error: 0x8007000D

ks.sys (kernel-streaming driver) failed to decompress from the WIM with ERROR_FILE_CORRUPT — deterministically, the SAME file every attempt.

How it was proven (not guessing)

1. First attempt's media was under C:\Users\Carrie\OneDrive - Rednour Law\Desktop\... — the Install.wim there threw 0x80070780 (ERROR_CANT_ACCESS_FILE) because OneDrive served a cloud placeholder that WinPE/SAFE_OS (OneDrive not running) couldn't read. Howard MOVED the extracted folder to C:\temp\Win11_25H2_English_x64 — fixed the access error but the ks.sys 0x80070570 corruption persisted (same bytes moved along).
2. Hashed the extracted install.wim: SHA256 9AD2EF7251AED36BCF5E36D4F067B5277C205ED02E3FDFA354069505214C7D54.
3. Mounted the original desktop .iso and hashed ITS install.wim (F:\sources\install.wim) = identical hash to the extracted copy. Identical bytes in both = the download itself was corrupt, not the extraction. Disk health checked: WD Green SN350 1TB SSD = Healthy/OK, so not a failing-disk read fault. Deterministic same-file CRC failure = bad source image.

Fix

Re-download via Media Creation Tool (validates its own download integrity). New media: C:\temp\Windows.iso (6.39 GB, ESD-based, mounted drive labeled ESD-ISO, uses install.esd not install.wim). Ran setup.exe from the mounted ISO. Watched live over RMM: down-level apply climbed 28%->36%->46%->50%->68% with NO ks.sys/0x80070570 (all 3 prior attempts died at ~49%), rebooted into SAFE_OS, applied offline, booted into Win11.

Post-upgrade verified state (build 26200 / 25H2)

• OS: Windows 11 Pro, build 26200, DisplayVersion 25H2. Reboot pending: No. Setup running: No.
• C:\Windows.old present -> 10-day rollback window (do NOT run Disk Cleanup until apps verified).
• Datto AV (EndpointProtectionService) auto-restored Running after reboot.
• Defender RTP = False -> EXPECTED, Datto AV is the registered primary AV on this box.

"endpointprotection.exe" identification (Howard asked)

The endpointprotection process in Task Manager = C:\Program Files\infocyte\agent\dattoav\Endpoint Protection SDK\endpointprotection.exe, service EndpointProtectionService ("Endpoint Protection Service", Auto/Running). It is Datto AV (the AV engine inside the Datto EDR/Infocyte agent) — ACG-managed, legitimate, not malware. Datto tenant azcomp4587. To pause for an upgrade: Stop-Service EndpointProtectionService -Force (Auto-start; returns on reboot).

Key Decisions (this update)

• Diagnosed entirely over GuruRMM rather than waiting for hands-on log retrieval, after confirming the agent executes commands on this box.
• Hash-compared ISO vs extracted install.wim to decisively distinguish a corrupt DOWNLOAD from extraction corruption / failing hardware before recommending a 7 GB re-download.
• Recommended Media Creation Tool (integrity-validated) over a plain browser ISO re-download to avoid another silently-corrupt image.
• Did NOT unilaterally stop Datto AV mid-run — corrupt download was the proven cause, AV was secondary; flagged it instead.

Problems Encountered (this update)

• Win11 upgrade failed 3x at SAFE_OS/APPLY_IMAGE 0x8007000D. Root cause = corrupt download (ks.sys 0x80070570). Resolved with fresh Media Creation Tool media.
• PowerShell variable-expansion trap: "C:\$WINDOWS.~BT" in a DOUBLE-quoted PS string expands $WINDOWS to empty -> C:\.~BT, so Test-Path falsely returned "folder gone." Fix: escape as "C:\$WINDOWS.~BT"` (backtick) or single-quote the path. (logged as friction)
• Bash tool default timeout is 120000ms (2 min); long RMM watch loops got cut off twice until the timeout param was set to 600000.

Update — Pending / Incomplete Tasks (supersedes earlier "tonight" plan)

• [DONE] Win11 upgrade on Carrie's machine (build 26200/25H2).
• Verify post-upgrade that the firm's SMB shares (Documents, Time Matters, Timeslips) and local accounts (carrie, nick, emma) survived the feature upgrade (sharing/firewall can reset). Nick's Mac mounts smb://192.168.10.194/Documents.
• Confirm with Carrie that Time Matters / Timeslips / WordPerfect work on Win11 before the 10-day Windows.old rollback window lapses (don't Disk-Cleanup it until then).
• BILLING: enter labor on Syncro #32368 (id 111999527) via /syncro now that work is complete.
• Optional: pause Datto AV (EndpointProtectionService) for any future feature upgrades.