Troubleshooting Windows 11 Feature Updates Using Logs in Intune
When managing Windows 11 Feature Updates via Microsoft Intune, you may encounter failed installations, long update cycles, or devices stuck in a specific update state. To troubleshoot effectively, you must understand which logs to collect, how to interpret them, and where to find update-related details from the Intune Admin Center and the endpoint itself.
This guide explains the types of logs involved, collection methods, and diagnostic paths for analyzing Windows 11 Feature Update issues in Intune-managed environments.
1. Understand How Feature Updates Work in Intune
When you deploy Feature Updates via Intune, the following services and components are involved:
- Windows Update for Business (WUfB): Controls update download and installation via Microsoft’s cloud service.
- Intune Policy Configuration Service Provider (CSP): Delivers Feature Update and Quality Update policies.
- Windows Update Agent (WUA): Executes the update process on the client.
- Update Orchestrator Service (UsoSvc): Coordinates update downloads and installation tasks.
Feature updates are delivered either through:
- Feature updates for Windows 10 and later (Policy type)
- Windows Update rings policy (for update deferral and control)
Understanding this flow helps determine where to focus troubleshooting.
2. Key Logs to Collect
When a device fails to install a Windows 11 Feature Update or shows as “Pending” or “Failed” in Intune, several logs provide insight:
| Log Name / Source | File Path | Purpose |
|---|---|---|
| WindowsUpdate.log | Generated via Get-WindowsUpdateLog | Consolidated WU trace file (contains WU agent operations) |
| UpdateDeployment.log | C:\ProgramData\Microsoft\IntuneManagementExtension\Logs | Tracks Intune update policy deployments |
| WUAHandler.log | %windir%\CCM\Logs (SCCM co-managed devices) | Monitors Windows Update Agent activity |
| CBS.log | C:\Windows\Logs\CBS | Tracks component-based servicing actions |
| SetupDiag logs | C:\$WINDOWS.~BT\Sources\Panther\ | Explains upgrade failures during setup |
| IntuneManagementExtension.log | C:\ProgramData\Microsoft\IntuneManagementExtension\Logs | Logs Intune agent communications and actions |
| UpdateHandler.log / USO logs | C:\Windows\SoftwareDistribution\ReportingEvents.log | General update processing and download results |
3. Reviewing Logs in Detail
A. WindowsUpdate.log
Run:
Get-WindowsUpdateLog
This merges ETL logs into a readable .log file on your desktop.
Search for:
"Download failed"or"0x8024XXXX"errors (network or content issues)"Policy Type: Feature Update"or"TargetBuildVersion"(indicates assigned update)"Feature Update Deferred"or"User action required"
Example entry:
2024/10/15 10:33:22.1313458 1234 1256 Update Orchestrator: Feature Update to Windows 11, version 24H2 failed. Error = 0xC1900101
B. SetupDiag
If the upgrade started but failed mid-way, run Microsoft’s SetupDiag tool:
SetupDiag.exe /Output:C:\Logs\SetupDiagResults.log
It analyzes upgrade logs (from Panther folder) and identifies:
- Driver compatibility errors
- Disk space issues
- Blocked updates due to third-party AV or policies
Example:
Error: SetupDiag found block upgrade rule - IncompatibleDriver: oem23.inf
C. IntuneManagementExtension.log
Located at:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log
Search for entries like:
[Win32App] Assigning Update Deployment...
[UpdateHandler] Deployment Status = 0x87d1041c
This shows Intune policy assignment and delivery success/failure.
Common failure causes:
- Incorrect device targeting
- Policy conflicts (multiple update rings)
- Device not checking in regularly
4. Intune Admin Center Insights
A. Reports → Windows updates (Preview)
Go to:
Devices > Windows > Feature updates for Windows 10 and later > Reports
You can view:
- Update Status per device (Success, In progress, Failed)
- Update Sub-status (Download pending, Install started, Reboot pending)
- Error Codes
Common error codes:
| Code | Meaning | Action |
|---|---|---|
| 0x80240034 | Generic update failure | Run Windows Update Troubleshooter |
| 0xC1900101 | Driver-related failure | Update or remove incompatible drivers |
| 0xC1900208 | Blocked by incompatible app | Review SetupDiag logs |
| 0x8024a105 | Update service issue | Restart UsoSvc and Wuauserv services |
B. Device-specific logs from Intune
- In Intune Admin Center → Devices > [Device Name] > Device diagnostics
- Click Collect diagnostics
- The log bundle includes key files: UpdateDeployment.log, WindowsUpdate.log (merged), CBS logs, etc.
- Download and analyze the ZIP file once ready.
This built-in collection feature is extremely useful for remote troubleshooting without needing user intervention.
5. Troubleshooting Workflow
Follow this structured process to identify and resolve the root cause:
Step 1: Confirm Device Status
In Intune Admin Center, confirm:
- The device is compliant
- Connected to the Internet and Windows Update for Business service
- Update ring and Feature Update policies are successfully assigned
Step 2: Verify Update Policy Configuration
Use PowerShell on the endpoint:
Get-WindowsUpdatePolicy
Ensure policies such as TargetReleaseVersion and TargetReleaseVersionInfo match the intended update (e.g., 24H2).
Step 3: Analyze Error Codes
Retrieve from Event Viewer or Intune Reports.
Example:
Event Viewer > Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational
Search for Event IDs:
- 20 – Update download started
- 25 – Installation started
- 31/34 – Failure (includes HRESULT error codes)
Step 4: Check Disk and System Requirements
Ensure:
- Minimum 25GB free space
- No pending restarts
- TPM and Secure Boot enabled for Windows 11 updates
- No third-party AV blocking setup files
Step 5: Use SetupDiag for Upgrade Failures
This tool identifies upgrade blockers and driver issues quickly. Combine with the WindowsUpdate.log output to correlate the failure point.
Step 6: Retry with Clean Policy Sync
# Force policy sync
Invoke-IntuneDeviceSync
# Retry update scan
UsoClient StartScan
UsoClient StartInstall
6. Common Real-World Issues
| Symptom | Cause | Fix |
|---|---|---|
| Device stuck on “Pending download” | Delivery Optimization not enabled or restricted bandwidth | Enable Delivery Optimization or update network policies |
| Error 0xC1900101 | Driver or BIOS compatibility | Update drivers, uninstall old VPN clients, ensure latest BIOS |
| Update installed but rollback occurred | Incompatible drivers or startup scripts | Review SetupDiag results for “Rollback” causes |
| Update ring + Feature Update conflict | Multiple update policies assigned | Consolidate policy targeting in Intune |
| Devices show as “Up to date” but still on old build | Policy not synced | Force Intune sync and check WindowsUpdate registry keys |
7. Preventive Recommendations
- Use Windows Update for Business Reports (WUfB Reports) in the Microsoft Intune admin center to proactively monitor rollout health.
- Avoid assigning multiple update rings or conflicting Feature Update policies.
- Validate updates on pilot devices before broad deployment.
- Use Endpoint Analytics → Windows Updates (Preview) for performance and readiness insights.
- Maintain updated drivers, firmware, and OEM device BIOS through Intune driver update management.
8. Quick Reference Commands
# Merge logs
Get-WindowsUpdateLog
# Check feature update policy
Get-WindowsUpdatePolicy
# List updates and status
Get-WindowsUpdateHistory
# Trigger scan and install
UsoClient StartScan
UsoClient StartInstall
UsoClient RestartDevice
# Retrieve Intune log folder
explorer "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs"
9. Summary
Troubleshooting Feature Updates in Windows 11 with Intune requires reviewing multiple layers — Intune policies, update agent logs, servicing logs, and setup diagnostics.
The main takeaway:
- Start with Intune reports for quick visibility.
- Analyze logs locally (especially
WindowsUpdate.logandSetupDiag). - Resolve conflicts and ensure system readiness before reattempting the update.
By systematically checking policies, reviewing logs, and validating device configurations, administrators can ensure smooth, predictable update rollouts across Windows 11 devices managed by Intune.
