An upgrade that runs for an hour, restarts, and then drops you back into your old Windows with “The installation failed in the FIRST_BOOT phase with an error during SYSPREP operation” is one of the more demoralising Windows messages. Nothing is broken. Nothing has changed. You are exactly where you started.
The good news is that the message is far more specific than it looks. It tells you which stage of Setup failed and what Setup was doing at the time — and Windows has already written a diagnosis to your disk.
This guide decodes the error first, then works through the fixes Microsoft actually recommends for it, starting with the one that resolves it most often. It applies to Windows 10 and Windows 11 upgrades alike, since both use the same Setup engine and the same error codes.
This error means Windows Setup rolled back during the first restart, while it was running SYSPREP. It is almost always a device driver that stopped responding. Disconnect every peripheral except your mouse, keyboard and display, get updated drivers from your PC maker, free up at least 20 GB, and retry with “Download and install updates” accepted. Run SetupDiag to name the exact culprit.
What the FIRST_BOOT phase error is telling you
When an upgrade fails, Windows Setup returns two codes rather than one. Microsoft’s upgrade error code reference calls them the result code and the extend code, written together like 0xC1900101 - 0x30018.
The result code says what went wrong. The extend code says exactly where.
A result code of 0xC1900101 is, in Microsoft’s words, generic — it means a rollback occurred, and in most cases the cause is a driver compatibility issue.
The extend code is where the detail is. In 0x30018, the leading 3 is the phase (SP_EXECUTION_FIRST_BOOT) and the trailing 18 is the operation (SP_EXECUTION_OP_SYSPREP). That is literally where the on-screen wording comes from.
Microsoft’s resolution procedures for this code are more specific still: it occurs when a device driver stops responding to setup.exe during the upgrade. So the real question is never “how do I fix FIRST_BOOT” — it is “which driver stopped responding?”
Find the exact code and the exact driver first
Read SetupDiag’s verdict — Windows already ran it
SetupDiag is Microsoft’s tool for reading Setup’s logs and naming the cause of a failed upgrade. You almost certainly already have its output.
Windows Setup extracts SetupDiag to %SystemDrive%\$Windows.~bt\Sources, and after a failed upgrade it runs automatically and writes its findings to %WinDir%\Logs\SetupDiag\SetupDiagResults.xml, plus the registry key HKLM\SYSTEM\Setup\SetupDiag\Results. Open the XML in Notepad or a browser and read the failure description before you change anything.
To run it yourself against the current system, download the latest SetupDiag, then from an elevated Command Prompt:
SetupDiag.exe /Output:C:\SetupDiag\Results.logIt needs .NET Framework 4.7.2 or newer. Run with no parameters and it only prints its help text, which catches people out.
Where the useful logs live
Setup writes its logs to a different folder in each phase, which is why so much generic advice sends people to the wrong place. Microsoft’s Setup log file reference maps them out.
The $Windows.~BT folder is hidden, so turn on hidden items in File Explorer first.
For this error, Microsoft calls out three files in $Windows.~bt\Sources\Rollback as the useful ones: setupact.log, the minidump setupmem.dmp, and the device install log at setupapi\setupapi.dev.log. That last one is the most direct route to a name — open it and look at the last device Setup was installing before everything stopped.
Start with Microsoft’s own fix for this code
For 0xC1900101 - 0x30018 specifically, Microsoft lists three mitigations, in this order:
- Disconnect every peripheral attached to the PC except the mouse, keyboard and display.
- Contact your hardware vendor for updated device drivers.
- Make sure Download and install updates (recommended) is accepted at the start of the upgrade.
Do these before anything more elaborate. Between them they resolve the majority of FIRST_BOOT rollbacks.
Every connected device loads a driver during SYSPREP. Docks, external drives, printers, capture cards, USB audio interfaces and phone-tethering drivers are all common culprits. Unplugging them does more than reduce the risk — if the upgrade then completes, you have identified the offending device without reading a single log.
Update the drivers that matter most
Four categories cause most of these rollbacks: graphics, storage (including RAID and NVMe controllers), chipset, and network. Get them from your PC or motherboard manufacturer’s support page rather than a general-purpose driver utility, and restart after installing.
Open Device Manager first and look for any device carrying a yellow warning mark. Microsoft’s quick-fix list recommends either updating that device’s driver or uninstalling the device outright.
If a problem driver has no newer version available, uninstall the device in Device Manager before you upgrade and reinstall it afterwards. An upgrade that succeeds without the device is a far better outcome than a fourth rollback.
Microsoft notes that this class of failure is often caused by drivers or by non-Microsoft disk encryption software. If you use a third-party encryption product, suspend or remove it before upgrading — and make sure you have your recovery key before you touch anything.
Free up enough disk space
Microsoft’s stated minimum free space on the system drive is 16 GB for a 32-bit Windows and 20 GB for a 64-bit one. Treat those as floors, not targets — an upgrade that is scraping the minimum is an upgrade with no room to roll back cleanly.
Run Disk Cleanup as an administrator and clear temporary files, the Windows Update cache and the recycle bin. After a failed upgrade the single biggest item is usually the old Windows installation left behind by the rollback: see how to delete the previous version of Windows safely.
More ways to reclaim space on the system drive before you retry.
Remove third-party antivirus for the upgrade
Microsoft’s quick-fix guidance is to temporarily uninstall non-Microsoft antivirus software rather than just disable it, and to rely on Microsoft Defender during the upgrade. Security software hooks deeply enough into the system that a disabled product can still block SYSPREP.
Note your product key or account details first so you can reinstall afterwards. Defender turns itself back on automatically once the third-party product is gone.
Repair Windows before you retry
A damaged file system or component store will fail the upgrade repeatedly no matter how many drivers you update. Run these three, in this order, from an elevated Command Prompt:
chkdsk /F
sfc /scannow
DISM.exe /Online /Cleanup-image /Restorehealthchkdsk /F will ask to schedule itself for the next restart — type Y and reboot, and let it finish before loading Windows. sfc /scannow repairs protected system files. DISM ... /Restorehealth repairs the component store that sfc draws its replacement files from, which is why it is worth running even when sfc reports success.
Do a clean boot, then retry
Microsoft recommends performing a clean boot before starting the upgrade, so that Setup runs with a minimal set of drivers and startup programs.
Press Windows + R, run msconfig, and on the Services tab tick Hide all Microsoft services then Disable all. Disable startup items in Task Manager, restart, and run the upgrade again. Undo both afterwards.
If it still rolls back
At this point you have a named driver or you do not. If SetupDiag and setupapi.dev.log both came back inconclusive, try the upgrade from mounted installation media instead of Windows Update, choosing the option to keep your files and apps. It sometimes clears a stuck Windows Update component that the in-place path keeps tripping over.
Check your PC maker’s support pages for a compatibility notice on your exact model before assuming the fault is yours. Manufacturers do publish upgrade blocks and firmware fixes.
A clean install is the last resort, not the second step. Back up your files first, and only reach for it once you have read the logs.
The rollback minidump points at a stop code — here is how to read one.
Common mistakes to avoid
- Deleting
$Windows.~BTstraight away. That folder holds every log you need. Read them first, then let Disk Cleanup remove it. - Retrying the same upgrade unchanged. A rollback is deterministic. If nothing about the machine changed, the next attempt fails the same way.
- Trusting a driver-updater utility. Generic driver packs are a common cause of exactly this failure. Use the manufacturer’s own files.
- Only disabling antivirus. Its filter drivers still load. Uninstall it for the duration.
- Leaving a dock or external drive connected because “it always worked before”. It did not have to survive SYSPREP before.
Frequently Asked Questions
Does this error mean my PC is damaged?
No. A rollback is Setup working as designed: it detected a failure and restored your previous Windows, including your files and programs. The machine is in the same state it was in before you started.
Where do I find the exact 0x code?
Three places: the rollback screen itself, Settings → Windows Update → Update history, and SetupDiag’s results at %WinDir%\Logs\SetupDiag\SetupDiagResults.xml. The last one is the most reliable, because it survives the restart.
Is 0x30018 always a driver problem?
Not always, but that is where Microsoft’s guidance points first. It also names non-Microsoft disk encryption software as a common cause, and notes that outright hardware failure can produce the same result. Work through drivers and encryption before suspecting hardware.
Can I just delete the $Windows.~BT folder?
Eventually, yes — but not until you have read the logs inside it. Once you are done, remove it with Disk Cleanup rather than deleting it by hand, so Windows tidies up its own references properly.
Does any of this change for a Windows 11 upgrade?
No. Windows 11 uses the same Setup engine, the same phases and the same result and extend codes, so the decoding and the fixes are identical. If you are upgrading from Windows 10 because of end of support, it is worth knowing how long security updates continue while you work through this.
Getting the upgrade to finish
“Installation failed in the FIRST_BOOT phase” reads like a dead end, but it is one of the more informative Windows errors once you know how to read it. The phase digit tells you when it failed and the operation digits tell you what it was doing.
Work in order: read SetupDiag, unplug everything you can, update the four driver categories that matter, make room on the disk, and clear the security software out of the way. Retry only after you have changed something specific.
Most of these upgrades go through on the second properly-prepared attempt.
One Response
Good