Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. Sysprep
  5. Panther
FolderRisk: Caution

Panther C:\Windows\System32\Sysprep\Panther

Sysprep logs (setupact.log, setuperr.log): the first place to look when generalizing a Windows image fails.

Updated on By AltF4 Formation

What it’s for

Sysprep writes its logs here. When generalization fails, the cause is in these files, in particular the app or package that blocks the operation.

What it contains

  • setupact.log: the action log, chronological and detailed.
  • setuperr.log: errors only, quicker to read.
  • Sysprep’s own lines are prefixed SYSPRP, which lets you isolate them from the rest of the setup engine.

Risks and best practices

  • Archive or delete these logs, but keep them until the incident is resolved. They name machines, accounts and packages: protect them before sharing.
  • Do not confuse them with C:\Windows\Panther, which logs Windows setup and upgrades. For Sysprep, open this one.
  • A generalization that fails because of a Store app shows in setupact.log: the message says a package is installed for a user but not provisioned for all users. Remove it for that user with Remove-AppxPackage, then run Sysprep again.

Useful commands

Fenêtre de terminal
# List the Sysprep logs
Get-ChildItem -Force "$env:windir\System32\Sysprep\Panther" | Select-Object Name, Length, LastWriteTime


# Errors from the latest run
Get-Content "$env:windir\System32\Sysprep\Panther\setuperr.log" -Tail 40


# Sysprep lines in the action log
Select-String -Path "$env:windir\System32\Sysprep\Panther\setupact.log" -Pattern "SYSPRP" | Select-Object -Last 30

Report a mistake