Detailed File and Registry Entry Removal Log

[MaryPoppinsUmbrella]

Sometimes when NTLite breaks some function, that function can be restored by simply restoring files and/or registry entries that are removed, but I can't find which exact files and/or registry entries NTLite removes in NTLite logs. Am I missing something?

 

[garlin]

Neither NTLite or DISM logs will reveal those details. They report on the component level.
Component manifests will list which files are to be installed, their destinations & ownership/permissions, and registry changes.

Unfortunately in recent Windows editions, manifests are delta compressed and unreadable without using sxsexp.exe

 

[|====|]

Friend garlin Pl pardone me if i am wrong somewhere regarding this topic %Windir%\Servicing\Sessions\Sessions.xml plus %Windir%\Servicing\Sessions\SessionsBackup.xml retrieves the info about removed componenets using any software on offline either online OS image.

 

[garlin]

Correct, Sessions.xml captures both offline & online component changes. But why bother when /forcelistcomponents does the same work on any loaded image for removals? DISM commands can list installed features & updates.

Servicing logs are too large to read, unless you know how to write a parser script.

Deployment Troubleshooting and Log Files