Detailed File and Registry Entry Removal Log

Sometimes when NTLite breaks some function, that function can be restored by simply restoring files and/or registry entries that are removed, but I can't find which exact files and/or registry entries NTLite removes in NTLite logs. Am I missing something?


Staff member
Neither NTLite or DISM logs will reveal those details. They report on the component level.
Component manifests will list which files are to be installed, their destinations & ownership/permissions, and registry changes.

Unfortunately in recent Windows editions, manifests are delta compressed and unreadable without using sxsexp.exe


Active Member
Friend garlin Pl pardone me if i am wrong somewhere regarding this topic %Windir%\Servicing\Sessions\Sessions.xml plus %Windir%\Servicing\Sessions\SessionsBackup.xml retrieves the info about removed componenets using any software on offline either online OS image.


Staff member
Correct, Sessions.xml captures both offline & online component changes. But why bother when /forcelistcomponents does the same work on any loaded image for removals? DISM commands can list installed features & updates.

Servicing logs are too large to read, unless you know how to write a parser script.

Deployment Troubleshooting and Log Files