Where are the SCCM failed install logs?

The primary location for SCCM (System Center Configuration Manager) failed install logs on a client machine is C:\Windows\CCM\Logs.

Key Log Files for Troubleshooting Failed Installs

When an application or package installation fails in SCCM, the most critical information is typically found within the client's logs. These logs provide detailed insights into the deployment process, from content download to execution and return codes.

Primary Log File: AppEnforce.log

For application and package deployments, the AppEnforce.log file is your go-to resource. This log meticulously records the entire installation process, including:

• The detection method used.
• The command line executed for the installation.
• The return code from the installer, which often indicates the reason for failure (e.g., a specific error code like 1603 for a generic installation error).
• Whether the application was successfully installed or failed detection after execution.

Reviewing AppEnforce.log is crucial as it directly reflects what happened during the actual installation attempt.

Supporting Log Files

While AppEnforce.log is paramount, several other log files located in C:\Windows\CCM\Logs can provide supplementary information to help diagnose installation failures:

• AppDiscovery.log: Shows how SCCM discovers applications and their compliance state on the client. Useful if the application is not detected as required.
• CAS.log (Content Access Service): Tracks content download activities from distribution points. Essential if the installer package itself cannot be retrieved.
• ContentTransferManager.log: Manages content transfer jobs. Provides details on how content is being downloaded to the client cache.
• DataTransferService.log: Records background intelligent transfer service (BITS) activities for content downloads.
• execmgr.log: Monitors program and advertisement executions. Provides high-level status of package deployments.
• PolicyAgent.log: Records policy retrieval and processing. Important if the client is not receiving deployment policies correctly.
• Locationservices.log: Helps determine if the client can locate a management point and distribution point.
• UpdatesDeployment.log & WUAHandler.log: While primarily for software updates, some application deployments might leverage the Windows Update Agent, making these relevant.

Common Log File Locations

Here's a quick reference for the primary log directory:

Troubleshooting Tips

When investigating failed installations, keep the following in mind:

1. Use CMTrace: This SCCM log viewer tool (available in the SCCM installation directory under \Tools\CMTrace.exe) is highly recommended for viewing logs. It color-codes errors and warnings, can merge multiple logs, and auto-refreshes. You can find more information about CMTrace from Microsoft's documentation.
2. Work Backwards: Start with AppEnforce.log and look for the final error or return code. Then, trace backwards through other relevant logs using timestamps to understand the sequence of events leading to the failure.
3. Check Timestamps: Ensure you are looking at the most recent entries by matching timestamps across different log files.
4. Interpret Return Codes: Non-zero return codes in AppEnforce.log (especially 1603, 1648, 1612, etc., which are common Windows Installer errors) are crucial indicators. Research these specific codes for detailed meaning.
5. Examine Application Requirements: Ensure the client machine meets all specified deployment type requirements (e.g., OS version, architecture).
6. Verify Content Availability: Confirm that the application content is correctly distributed to the distribution points and accessible by the client.