Detect Windows 11 Upgrade Method: WU vs Manual

No single command. Forensic chain instead.

Method 1 — Panther setupact.log (most reliable)

Log lives at:

C:\Windows\Panther\setupact.log

Search it:

Select-String -Path "C:\Windows\Panther\setupact.log" -Pattern "cmd line|commandline|/auto upgrade|MediaPath" | Select-Object -First 20

• WU-driven: entries reference MoSetup, wuauclt, no /MediaPath
• Manual ISO: /MediaPath, drive letter, /auto upgrade, or UNC path in the command line

Method 2 — BlueBox.log (WU-specific, definitive)

Only exists when upgrade came through WU or WSUS.

Test-Path "C:\Windows\Logs\MoSetup\BlueBox.log"

• Present → WU/WSUS driven
• Absent → manual ISO/media

Method 3 — Registry Upgrade History

Shows build chain with timestamps. Clean installs have no SourceOS entries.

$(gci "HKLM:\System\Setup" | Where-Object {$_.Name -match "\\Source\s"}) | ForEach-Object {
    [PSCustomObject]@{
        ProductName = $_.GetValue("ProductName")
        Build       = $_.GetValue("CurrentBuild")
        InstallTime = [datetime]::FromFileTime($_.GetValue("InstallTime"))
    }
} | Sort-Object InstallTime

Decision Tree