Prototype of modules for WindowsUpdate and OSUpgrade

docs/manifests/windows/diagnostic-eventlogs.md

@@ -0,0 +1,55 @@
+# Windows Event Logs Diagnostic Manifests
+
+Modular manifests for collecting Windows Event Logs.
+
+## Available Manifests
+
+| Manifest | Description | Size Est. | PII |
+|----------|-------------|-----------|-----|
+| `diagnostic-eventlogs-general-common` | System, Application, Setup logs | 25-150 MB | Low |
+| `diagnostic-eventlogs-client-windowsupdate` | Windows Update client events | 5-50 MB | None |
+| `diagnostic-eventlogs-do-windowsupdate` | Delivery Optimization, BITS | 5-30 MB | None |
+| `diagnostic-eventlogs-setup-osupgrade` | Setup, Upgrade Diagnostics | 5-50 MB | None |
+| `diagnostic-eventlogs-taskscheduler-common` | Task Scheduler operational | 5-30 MB | None |
+| `diagnostic-eventlogs-kernel-common` | Kernel PnP, Power events | 5-30 MB | None |
+| `diagnostic-eventlogs-security-common` | CAPI2, Licensing events | 5-30 MB | Low |
+| `diagnostic-eventlogs-grouppolicy-common` | Group Policy operational | 5-20 MB | None |
+
+## File Locations
+
+### diagnostic-eventlogs-general-common
+```
+/Windows/System32/winevt/Logs/System.evtx
+/Windows/System32/winevt/Logs/Application.evtx
+/Windows/System32/winevt/Logs/Setup.evtx
+```
+
+### diagnostic-eventlogs-client-windowsupdate
+```
+/Windows/System32/winevt/Logs/Microsoft-Windows-WindowsUpdateClient%4Operational.evtx
+/Windows/System32/winevt/Logs/Microsoft-Windows-Servicing%4Admin.evtx
+/Windows/System32/winevt/Logs/Microsoft-Windows-WUSA%4Operational.evtx
+```
+
+### diagnostic-eventlogs-do-windowsupdate
+```
+/Windows/System32/winevt/Logs/Microsoft-Windows-DeliveryOptimization%4Operational.evtx
+/Windows/System32/winevt/Logs/Microsoft-Windows-Bits-Client%4Operational.evtx
+```
+
+### diagnostic-eventlogs-setup-osupgrade
+```
+/Windows/System32/winevt/Logs/Microsoft-Windows-Setup%4Operational.evtx
+/Windows/System32/winevt/Logs/Microsoft-Windows-Upgrade-Diagnostics%4Operational.evtx
+```
+
+## Use Cases
+
+| Issue Type | Recommended Manifests |
+|------------|----------------------|
+| Windows Update failures | `eventlogs-general-common` + `eventlogs-client-windowsupdate` |
+| Download issues | `eventlogs-do-windowsupdate` |
+| OS Upgrade failures | `eventlogs-setup-osupgrade` + `eventlogs-general-common` |
+| Boot/driver issues | `eventlogs-kernel-common` |
+| Scheduled task issues | `eventlogs-taskscheduler-common` |
+| Policy issues | `eventlogs-grouppolicy-common` |

docs/manifests/windows/diagnostic-logs.md

@@ -0,0 +1,72 @@
+# Windows Update Logs Diagnostic Manifests
+
+Modular manifests for Windows Update and Setup log files.
+
+## Available Manifests
+
+| Manifest | Description | Size Est. | PII |
+|----------|-------------|-----------|-----|
+| `diagnostic-logs-client-windowsupdate` | WindowsUpdate.log, ETL | 10-100 MB | None |
+| `diagnostic-logs-sih-windowsupdate` | SIH service logs | 5-20 MB | None |
+| `diagnostic-logs-dpx-windowsupdate` | DPX setup logs | 1-10 MB | None |
+| `diagnostic-logs-setupapi-windowsupdate` | SetupAPI logs | 10-50 MB | None |
+| `diagnostic-logs-mosetup-osupgrade` | MoSetup/UpdateAgent | 5-30 MB | None |
+
+## File Locations
+
+### diagnostic-logs-client-windowsupdate
+```
+/Windows/WindowsUpdate.log
+/Windows/Logs/WindowsUpdate/*.log
+/Windows/Logs/WindowsUpdate/*.etl
+```
+
+### diagnostic-logs-sih-windowsupdate
+```
+/Windows/Logs/SIH/SIH*.log
+/Windows/Logs/SIH/SIH*.etl
+```
+
+### diagnostic-logs-dpx-windowsupdate
+```
+/Windows/Logs/DPX/setupact.log
+/Windows/Logs/DPX/setuperr.log
+```
+
+### diagnostic-logs-setupapi-windowsupdate
+```
+/Windows/INF/setupapi.dev.log
+/Windows/INF/setupapi.app.log
+```
+
+### diagnostic-logs-mosetup-osupgrade
+```
+/Windows/Logs/mosetup/UpdateAgent.log
+/Windows/Logs/MoSetup/BlueBox.log
+```
+
+## Use Cases
+
+| Issue Type | Recommended Manifests |
+|------------|----------------------|
+| Windows Update failures | `logs-client-windowsupdate` |
+| Driver update issues | `logs-setupapi-windowsupdate` |
+| Feature update issues | `logs-mosetup-osupgrade` |
+| SIH/remediation issues | `logs-sih-windowsupdate` |
+| Package extraction | `logs-dpx-windowsupdate` |
+
+## Log Descriptions
+
+| Log | Purpose |
+|-----|---------|
+| WindowsUpdate.log | Main WU client log (legacy and ETL-converted) |
+| SIH*.log | Self-Initiated Healing service logs |
+| setupapi.dev.log | Device driver installation log |
+| setupapi.app.log | Application setup log |
+| UpdateAgent.log | Feature update agent log |
+
+## Notes
+
+- WindowsUpdate.log on Windows 10+ requires ETL conversion
+- SetupAPI logs are key for driver installation issues
+- SIH is used for automated WU remediation

docs/manifests/windows/diagnostic-orchestrator.md

@@ -0,0 +1,43 @@
+# Windows Update Orchestrator Diagnostic Manifests
+
+Modular manifests for Update Session Orchestrator (USO) and health tools.
+
+## Available Manifests
+
+| Manifest | Description | Size Est. | PII |
+|----------|-------------|-----------|-----|
+| `diagnostic-orchestrator-uso-windowsupdate` | USO UpdateStore, logs | 10-100 MB | None |
+| `diagnostic-orchestrator-healthtools-windowsupdate` | Update Health Tools | 5-30 MB | None |
+
+## File Locations
+
+### diagnostic-orchestrator-uso-windowsupdate
+```
+/ProgramData/USOPrivate/UpdateStore/*.xml
+/ProgramData/USOShared/Logs/*.log
+/ProgramData/USOShared/Logs/*.etl
+ll,/ProgramData/USOPrivate
+ll,/ProgramData/USOShared
+```
+
+### diagnostic-orchestrator-healthtools-windowsupdate
+```
+/ProgramData/Microsoft/Windows/UpdateHealthTools/*.log
+/ProgramData/Microsoft/Windows/UpdateHealthTools/*.etl
+ll,/ProgramData/Microsoft/Windows/UpdateHealthTools
+```
+
+## Use Cases
+
+| Issue Type | Recommended Manifests |
+|------------|----------------------|
+| Updates not scanning | `orchestrator-uso-windowsupdate` |
+| Updates stuck pending | `orchestrator-uso-windowsupdate` |
+| WU service issues | `orchestrator-uso-windowsupdate` + `orchestrator-healthtools-windowsupdate` |
+| Update Health alerts | `orchestrator-healthtools-windowsupdate` |
+
+## Notes
+
+- USO (Update Session Orchestrator) replaced the legacy WU service in Windows 10+
+- UpdateStore contains pending update state
+- Update Health Tools are used by Microsoft to diagnose WU issues remotely

docs/manifests/windows/diagnostic-osupgrade.md

@@ -0,0 +1,57 @@
+# Windows OS Upgrade Additional Diagnostic Manifests
+
+Modular manifests for OS Upgrade compatibility and cleanup.
+
+## Available Manifests
+
+| Manifest | Description | Size Est. | PII |
+|----------|-------------|-----------|-----|
+| `diagnostic-compat-appraiser-osupgrade` | Compatibility Appraiser | 5-50 MB | None |
+| `diagnostic-previousos-osupgrade` | Windows.old folder | 10-50 MB | Low |
+| `diagnostic-cleanup-osupgrade` | Disk Cleanup logs | 1-10 MB | None |
+
+## File Locations
+
+### diagnostic-compat-appraiser-osupgrade
+```
+/Windows/appcompat/Appraiser*.xml
+/Windows/appcompat/Appraiser*.cab
+ll,/Windows/appcompat/Programs
+```
+
+### diagnostic-previousos-osupgrade
+```
+ll,/Windows.old
+/Windows.old/Windows/Panther/setupact.log
+/Windows.old/Windows/Panther/setuperr.log
+```
+
+### diagnostic-cleanup-osupgrade
+```
+/Windows/Logs/DiskCleanup/DiskCleanup.log
+ll,/Windows/Logs/DiskCleanup
+```
+
+## Use Cases
+
+| Issue Type | Recommended Manifests |
+|------------|----------------------|
+| Compatibility blocks | `compat-appraiser-osupgrade` |
+| Upgrade safeguard holds | `compat-appraiser-osupgrade` |
+| Previous OS recovery | `previousos-osupgrade` |
+| Disk space issues | `cleanup-osupgrade` |
+| Rollback investigation | `previousos-osupgrade` |
+
+## Component Descriptions
+
+| Component | Purpose |
+|-----------|---------|
+| Appraiser | Evaluates system compatibility before feature updates |
+| Windows.old | Contains previous Windows installation for rollback |
+| Disk Cleanup | Handles removal of update cleanup files |
+
+## Notes
+
+- Appraiser data identifies compatibility blockers for feature updates
+- Windows.old exists for 10 days after upgrade (by default)
+- Cleanup logs show what was removed during update cleanup

docs/manifests/windows/diagnostic-provisioning.md

@@ -0,0 +1,64 @@
+# Windows Provisioning Diagnostic Manifests
+
+Modular manifests for Windows provisioning and setup diagnostics.
+
+## Available Manifests
+
+| Manifest | Description | Size Est. | PII |
+|----------|-------------|-----------|-----|
+| `diagnostic-provisioning-panther-osupgrade` | Panther setup logs | 10-50 MB | Low |
+| `diagnostic-provisioning-sysprep-osupgrade` | Sysprep files and logs | 5-30 MB | Low |
+| `diagnostic-provisioning-state-osupgrade` | Setup State.ini | 1-5 MB | None |
+| `diagnostic-provisioning-firstboot-osupgrade` | First logon commands | 1-10 MB | None |
+
+## File Locations
+
+### diagnostic-provisioning-panther-osupgrade
+```
+/Windows/Panther/setupact.log
+/Windows/Panther/setuperr.log
+/Windows/Panther/UnattendGC/setupact.log
+/Windows/Panther/UnattendGC/setuperr.log
+/Windows/Panther/cbs_unattend.log
+/Windows/Panther/DDACLSys.log
+/Windows/Panther/UnattendedJoin/UnattendedJoinDCLocator.etl
+/Windows/Panther/miglog.xml
+```
+
+### diagnostic-provisioning-sysprep-osupgrade
+```
+/Windows/System32/Sysprep/Panther/setupact.log
+/Windows/System32/Sysprep/Panther/setuperr.log
+/Windows/System32/Sysprep/Panther/IE/setupact.log
+/Windows/System32/Sysprep/Sysprep_succeeded.tag
+/Windows/System32/Sysprep/Unattend.xml
+ll,/Windows/System32/Sysprep
+```
+
+### diagnostic-provisioning-state-osupgrade
+```
+/Windows/Setup/State/State.ini
+ll,/Windows/Setup/State
+```
+
+### diagnostic-provisioning-firstboot-osupgrade
+```
+/Windows/Panther/FirstLogonCommands.log
+/Windows/Panther/Specialize.log
+```
+
+## Use Cases
+
+| Issue Type | Recommended Manifests |
+|------------|----------------------|
+| VM provisioning failures | `provisioning-panther-osupgrade` + `provisioning-sysprep-osupgrade` |
+| Sysprep failures | `provisioning-sysprep-osupgrade` |
+| Setup stuck | `provisioning-state-osupgrade` + `provisioning-panther-osupgrade` |
+| First boot issues | `provisioning-firstboot-osupgrade` |
+| Azure VM generalization | `provisioning-sysprep-osupgrade` |
+
+## Key Error Patterns
+
+- setupact.log: Look for `Error`, `Warning`, `OOBE`
+- setuperr.log: All entries are errors
+- State.ini: Check `IMAGE_STATE` value

docs/manifests/windows/diagnostic-recovery.md

@@ -0,0 +1,56 @@
+# Windows Recovery Diagnostic Manifests
+
+Modular manifests for Windows recovery and error reporting.
+
+## Available Manifests
+
+| Manifest | Description | Size Est. | PII |
+|----------|-------------|-----------|-----|
+| `diagnostic-recovery-startuprepair-osupgrade` | Startup Repair logs | 1-10 MB | None |
+| `diagnostic-recovery-wer-osupgrade` | Windows Error Reporting | 5-30 MB | Low |
+| `diagnostic-recovery-postsetup-osupgrade` | Post-setup action logs | 1-10 MB | None |
+
+## File Locations
+
+### diagnostic-recovery-startuprepair-osupgrade
+```
+/Windows/System32/LogFiles/Srt/SrtTrail.txt
+/Windows/System32/LogFiles/Srt/srt-ui-*.txt
+ll,/Windows/System32/LogFiles/Srt
+```
+
+### diagnostic-recovery-wer-osupgrade
+```
+ll,/ProgramData/Microsoft/Windows/WER/ReportQueue
+/ProgramData/Microsoft/Windows/WER/ReportQueue/*/Report.wer
+```
+
+### diagnostic-recovery-postsetup-osupgrade
+```
+/Windows/Logs/mosetup/UpdateAgent.log
+/Windows/Logs/MoSetup/BlueBox.log
+```
+
+## Use Cases
+
+| Issue Type | Recommended Manifests |
+|------------|----------------------|
+| Boot loop after update | `recovery-startuprepair-osupgrade` |
+| BSOD after update | `recovery-wer-osupgrade` |
+| Upgrade completed but issues | `recovery-postsetup-osupgrade` |
+| Automatic repair triggered | `recovery-startuprepair-osupgrade` |
+
+## Key Files
+
+| File | Purpose |
+|------|---------|
+| `SrtTrail.txt` | Startup Repair diagnostic trail |
+| `Report.wer` | Windows Error Report details |
+| `UpdateAgent.log` | Post-upgrade setup actions |
+| `BlueBox.log` | Feature update completion tasks |
+
+## Notes
+
+- SrtTrail.txt is created when Startup Repair runs
+- WER reports contain crash details and may identify failing components
+- Post-setup logs show actions taken after feature update completes