Capture logs from a failed build (run Decolla-Diag)

Step 1. If a build fails - the 'Windows 11 installation has failed' box, a machine stuck on a Setup screen, or a login that will not accept the password - do NOT reformat the stick or keep rebooting. The Decolla stick carries a one-touch diagnostic that grabs everything support needs. Leave the failed machine exactly as it is. Mark done

Step 2. Open a command prompt on the failed machine. During Windows Setup or at the failure box: press Shift+F10 - on most laptops you must add the Fn key, so Shift+Fn+F10 (see the 'Boot a machine from the Decolla stick' guide for that Fn-key trap). If the machine has already booted into Windows instead, just open the USB stick in File Explorer. Mark done

Step 3. Run the diagnostic. In the black command prompt, type the USB's drive letter then \DIAG - for example D:\DIAG - and press Enter. In Windows, double-click DIAG.cmd on the USB. It asks Windows for administrator rights itself - choose Yes when Windows asks, signing in with an administrator account if it asks for one - and a second window opens and does the capture. You do NOT need to know the USB's drive letter for the capture itself - the tool locates itself and writes back to its own stick. Mark done

Step 4. Wait for the word DONE. On a machine that is already running Windows and is managed by Intune, the tool first asks Windows to check in with Intune and waits up to two minutes to see whether it does. It then sweeps every drive for every Windows Setup log (Panther, $WINDOWS.~BT, DISM, CBS) and every Decolla provisioning log, plus a read-only machine snapshot (disk layout, boot config, hardware), and copies them into a timestamped folder on the USB named 'Decolla-Diag'. On a running Windows it also collects Microsoft's own management report and diagnostic bundle and the BitLocker status, so there is no second tool to run, and it finishes with three plain answers on the screen, straight above DONE: whether the Intune enrolment checked in after the tool asked, whether BitLocker settings from Intune are on the machine, and whether Windows has recorded the recovery key as backed up. If the first answer says the Intune enrolment did not check in, the capture shows the machine as of its last check-in, which that answer names; pressing Sync in Windows Settings (under Accounts, then Access work or school) is the way Microsoft documents to make it check in. The tool itself changes nothing on the machine and touches no partitions: asking for that check-in is the one thing it asks Windows to do. It leaves the organisation's keys behind: the build's settings are copied with every ticket and password blanked out. Mark done

Step 5. Bring the stick back. Take the USB to any normal PC, or email the whole 'Decolla-Diag' folder from it to Decolla support. That folder contains everything needed to diagnose the failure - you will not be asked to type any more commands. Mark done

Step 6. Optional, to read it yourself: the plain-English summary is 'Decolla-Diag\<machine>_<timestamp>\INDEX.txt'. Its first lines say whether the capture ran as an administrator, and its last section, NOT COLLECTED, lists anything it could not reach and why. Just above that, under INTUNE, are the same three answers the screen ended with. The actual Windows failure reason is usually the last lines of a 'setuperr.log' inside one of the '-BT-Panther' or '-Windows-Panther' subfolders; a Decolla provisioning failure is in the '-Decolla-logs' subfolder's provisioning.log. Mark done