Where are Windows 11 first-boot OOBE errors logged when Event Viewer shows nothing

OOBE-Phase Errors Often Skip Event Viewer

During first-boot OOBE, certain transient errors bypass Event Viewer entirely. This happens because the setup process runs in a specialized boot environment where the Event Log service may not be fully initialized. Microsoft does not publicly document this intentional omission, but it's a well-known behavior in deployment engineering circles.

Where to Look When Event Viewer Shows Nothing

Start with the standard deployment logs, then check the often-overlooked UnattendGC subfolder:

1. %WINDIR%\Panther\setupact.log and setupdev.log - General deployment progress
2. %WINDIR%\Panther\UnattendGC\setupact.log - OOBE-specific answer file processing and configuration failures
3. %WINDIR%\Logs\CBS\CBS.log - Component servicing outcomes

The UnattendGC\setupact.log file specifically captures errors during the final OOBE configuration pass, including failures in user account creation, network provisioning, and answer file processing.

Build Variations and Log Locations

Log behavior varies between Windows 11 builds. In 22H2 and 23H2, network-based provisioning (NPE) timeouts and user creation failures are most likely to appear only in UnattendGC\setupact.log. If you're using a non-system drive installation or have customized logging via unattend.xml, paths may be redirected. Always verify the UnattendGC directory exists after a failed OOBE attempt.

Diagnostic Steps

1. Immediately after a failed OOBE, check %SystemRoot%\Panther\UnattendGC\setupact.log
2. Compare timestamps between main setupact.log and UnattendGC\setupact.log to identify the exact failure point
3. Search for Microsoft-Windows-Setup source with Event ID in the 0000 series in Event Viewer
4. Look for error codes like 0x80070002 or network timeout messages in the UnattendGC log

Important Considerations

Transient errors during network provisioning or user account creation may not generate Event Log entries if the process crashes before flushing buffers. Error code meanings can shift between Windows 11 releases, so focus on the log context rather than specific codes. If you're not seeing any UnattendGC folder, the OOBE may have failed earlier than expected, or the system may have rebooted successfully past that phase.