FolderRisk: Caution
UnattendGC C:\Windows\Panther\UnattendGC
Folder of logs (setupact.log, setuperr.log) from the online configuration phase of a Windows installation or deployment.
What it’s for
UnattendGC keeps the setup logs written after the restart that follows file copy, during online system configuration: the specialize and oobe passes in an automated deployment. The logs of the previous phase are in C:\Windows\Panther.
What it contains
- A
setupact.logand asetuperr.logspecific to this phase, separate from those inC:\Windows\Panther. - Traces of the answer file (
unattend.xml) being applied when there is one: settings applied, scripts run (for exampleSetupComplete.cmd), errors.
Risks and best practices
- Deleting the folder has no effect on how Windows runs, but you lose the trace of the initial configuration. Keep it until the deployment is validated.
- The logs may reveal account names, domains and deployment commands. If the answer file was poorly protected, passwords may show up in them, so check before sharing.
Useful commands
# Folder contentsGet-ChildItem "$env:windir\Panther\UnattendGC" -Force -ErrorAction SilentlyContinue
# Errors from the online configuration phaseGet-Content "$env:windir\Panther\UnattendGC\setuperr.log" -ErrorAction SilentlyContinue
# Latest actionsGet-Content "$env:windir\Panther\UnattendGC\setupact.log" -Tail 50 -ErrorAction SilentlyContinue