The upgrade rolled back.
Read the logs it left behind.

Three hours, 71%, and a hex code

A feature update runs for hours, reaches some percentage, reboots, and puts everything back exactly as it was with an error code and no explanation. The code is almost always 0xC1900101, which on its own means “something went wrong and Setup rolled back” and nothing more.

Setup does write down what happened, in C:\$WINDOWS.~BT\Sources\Panther. Microsoft's own tool for reading it is SetupDiag.exe, a command-line rule-matcher you download separately, which frequently returns “no match found” and assumes you already know where Panther is.

This page reads those logs and lays out their contents: the phases mentioned and when, every result and extend code with its documented meaning where one exists, every Error and Fatal line verbatim, and every entry in the compatibility report.

Where the logs are

$WINDOWS.~BT is hidden and a protected operating-system folder. In File Explorer: View → Show → Hidden items, then Options → View and clear Hide protected operating system files. Windows will ask for permission when you open it.

You can drop several files at once, or zip the Panther folder and drop that. More files means more of the picture — but setuperr.log alone is usually a 200 KB upload and carries most of what is extractable.

The four phases, and what a mention of each means

Setup runs in stages, and its logs name them. Knowing which stages your logs mention narrows the reading enormously — advice written for one phase is irrelevant to the others.

The report lists which phases your logs mention and how many times, and is explicit that a phase not appearing can mean either that it never ran or that its log was not supplied. Those are different, and the tool will not pretend to know which one applies.

Result codes and extend codes

Setup errors usually appear as a pair: 0xC1900101 - 0x20017. The first half is generic. The second half — the extend code — is the part that records a phase and a stage.

Every pair in your logs is extracted with its occurrence count and first location. Codes with a documented meaning carry a note saying what they are recorded against. Codes without one are shown raw, and the report says so, rather than offering a plausible-sounding guess.

The phases and codes in setuperr.log, and what each names

Setup reports its result as a pair: a status code, and the phase it was in when it stopped. The phase is the more useful half, because it eliminates most of the internet’s advice before you read a word of it. Every string below is one this reader extracts with its line number.

CompatData: what the compatibility scan flagged

CompatData_*.xml is structured, which makes it the most precise file in the folder. It lists programs, driver packages and hardware items, each with a blocking flag.

Every entry is extracted with its flag, version, publisher and INF name where present, plus a count of which XML elements appeared — so if the file contains element types this reader does not know, you can see that rather than having them silently dropped.

The XML is parsed with the document type refused outright. That removes entity attacks as a class rather than defusing them individually, and no real CompatData file contains one.

Why this page does not tell you which thing broke it

A successful Windows upgrade writes hundreds of error lines. Picking one out of a failed run and presenting it as the reason would look authoritative and be unfounded.

So the report gives you the material instead: every error line verbatim with its timestamp, every code with its count, every phase with its time span, every flagged compatibility entry. That is the evidence a vendor's support desk asks for and cannot normally get.

Another reader on this site

Frequently asked questions