Forum Discussion
Windows 11 23H2 → 25H2 in-place upgrade fails in SAFE_OS / MIGRATE_DATA
I'm trying to in-place upgrade a Windows 11 23H2 system to 25H2 and consistently get a rollback in the SAFE_OS / MIGRATE_DATA phase with 0x8007042B – 0x2000D. After a lot of analysis (Panther logs, SetupDiag, DISM, etc.), the failure always points to migration problems around Microsoft-Windows-TPM-Driver-WMI (CCSIAgent) and, secondarily, Microsoft-Windows-DirectoryServices-ADAM-Client (adammigrate.dll).
I'd like to confirm whether this is a known 25H2 migration issue (especially on Education) and if there is any supported workaround short of a clean install.
---
ENVIRONMENT
- OS: Windows 11 Education 23H2, Build 22631.6276
- Edition: Education (confirmed via winver and Settings → System → About)
- Target: Windows 11 25H2 (26200.6584, "2025 Update")
- Upgrade method tried:
- Windows Update feature enablement
- Windows 11 Installation Assistant
- Official 25H2 ISO (26200.6584.250915-1905.25h2_ge_release_svc_refresh_CLIENT_CONSUMER_x64FRE_en-us.iso) mounted locally → setup.exe
- Hardware:
- Motherboard: Gigabyte Z690 AORUS PRO (BIOS F31)
- SSD: WD_BLACK SN770 NVMe (firmware 731130WD, WD Dashboard reports "Healthy", no errors)
- TPM 2.0: Intel PTT (firmware TPM) enabled
- Secure Boot: Enabled
- BitLocker on C: OFF (fully decrypted)
---
SYMPTOM
Every full in-place upgrade attempt (23H2 → 25H2) behaves as follows:
1. Setup runs, copies files, reboots to SAFE_OS phase.
2. During MIGRATE_DATA, setup fails and rolls back to 23H2.
3. Message on screen:
"0x8007042B – 0x2000D
The installation failed in the SAFE_OS phase with an error during MIGRATE_DATA operation"
In C:\$WINDOWS.~BT\Sources\Panther\setuperr.log / setupact.log, the failure is always in SAFE_OS / MIGRATE_DATA and includes:
V2VArbitrate: Source migration unit <System>\Microsoft-Windows-TPM-Driver-WMI (CCSIAgent)
is not supported on the destination machine and it will not be restored
V2VArbitrate: Source migration unit is critical, arbitration will fail
V2V Arbitration failed. Last error: 0x00000032
pSPExecuteApply: Apply operation failed. Error: 0x0000002C
Apply (machine-independent apply, offline phase): Migration phase failed. Result: 44
ExecuteOperations: Failed execution phase Safe OS. Error: 0x8007042B
On some runs, just before the TPM arbitration failure, there are also errors related to DirectoryServices-ADAM-Client:
Failure while calling IPostApply->ApplySuccess for
Plugin="Microsoft-Windows-DirectoryServices-ADAM-Client\adammigrate.dll"… Error: 0x80070002
Error READ, 0x00000002 while gathering/applying object: apply-success, Action,CMXEXmlPlugin,
C:\$WINDOWS.~BT\Sources\ReplacementManifests, Microsoft-Windows-DirectoryServices-ADAM-Client\adammigrate.dll…
However, the ADAM plugin errors are logged as "ignore" in some traces, while the actual rollback is always tied to the critical TPM-Driver-WMI migration unit.
---
WHAT I HAVE ALREADY TRIED
I've tried to rule out all the usual suspects and a bit more:
1. Health checks & storage
- sfc /scannow → no integrity violations
- DISM /Online /Cleanup-Image /ScanHealth / CheckHealth / RestoreHealth → clean
- chkdsk C: /scan → no file system / bad sector issues
- WD Dashboard extended test → drive healthy, no SMART warnings
2. Drivers, TPM, AV, services
- TPM:
- Device: "Trusted Platform Module 2.0" (ACPI\MSFT0101\1)
- Driver provider: Microsoft (inbox TPM driver), no OEM TPM drivers
- pnputil /enum-drivers | findstr /i tpm shows only Microsoft TPM entries; any OEM/TMP-related oem*.inf were removed.
- Legacy / problematic drivers:
- Removed old Intel CougarPoint USB driver (oem25.inf) via pnputil /delete-driver oem25.inf /uninstall /force.
- Antivirus / security:
- McAfee WebAdvisor fully uninstalled.
- Kaspersky products uninstalled via standard uninstallers and then cleaned with Kaspersky's kavremover in Safe Mode.
- No Kaspersky services, drivers, files, or uninstall entries remain.
- Currently only Microsoft Defender is active.
- Telemetry:
- Connected User Experiences and Telemetry (DiagTrack) service set to Manual and Running to avoid telemetry-related cancellation (0x800704C7).
3. Upgrade artefacts / component cleanup
- Deleted:
- C:\$WINDOWS.~BT
- C:\$GetCurrent
- C:\$WINDOWS.~WS
- C:\Windows\SoftwareDistribution\Download
- Ran:
- DISM /Online /Cleanup-Image /StartComponentCleanup /ResetBase
- Then again DISM /Online /Cleanup-Image /RestoreHealth and sfc /scannow
4. ISO & media verification
- 23H2 ISO: Win11_23H2_English_x64.iso (official multi-edition ISO, SHA-256 verified).
- 25H2 ISO: 26200.6584.250915-1905.25h2_ge_release_svc_refresh_CLIENT_CONSUMER_x64FRE_en-us.iso (official 25H2 ISO, SHA-256 verified).
- Both mounted locally; upgrade run via setup.exe from the ISO (no third-party media tools).
- Tried with Dynamic Update enabled and disabled (/DynamicUpdate Disable).
5. Compatibility scan vs full upgrade behavior
- Running from 25H2 ISO:
setup.exe /Compat ScanOnly /DynamicUpdate Disable
→ completes WITHOUT logging the earlier TPM-Driver-WMI / MIGRATE_DATA critical failures.
- However, when running a FULL in-place upgrade (same ISO, same environment, DynamicUpdate disabled, "Keep personal files and apps"), the upgrade still fails in SAFE_OS / MIGRATE_DATA with the same TPM-Driver-WMI critical arbitration error and rollback.
So, compatibility scan looks clean, but the real SAFE_OS/MIGRATE_DATA phase still hits the TPM-Driver-WMI migration problem.
6. ADAM / DirectoryServices-ADAM-Client state
- DISM shows DirectoryServices-ADAM-Client feature as Disabled.
- The ADAM migration plugin (adammigrate.dll) logs 0x80070002 during IPostApply->ApplySuccess on some runs.
- As suggested in other cases, I have tried:
- dism /online /enable-feature /featurename:DirectoryServices-ADAM-Client /norestart → reboot
- dism /online /disable-feature /featurename:DirectoryServices-ADAM-Client /norestart → reboot
- The ADAM error sometimes disappears or is logged as "ignored", but the TPM-Driver-WMI critical arbitration error persists and still causes rollback.
7. Attempt to repair TPM-Driver-WMI as a package (failed)
Following the idea that TPM-Driver-WMI might be a partially removed servicing package, I:
- Ran:
DISM /Online /Get-Packages | findstr /i "TPM-Driver-WMI"
→ NO ENTRIES. There is no Microsoft-Windows-TPM-Driver-WMI-Package~… installed as a standalone package.
- Mounted Win11_23H2_English_x64.iso as G: and searched for *TPM-Driver-WMI*.cab:
→ No such cab found anywhere in the ISO.
- Mounted install.wim (index 4, Education) read-only and inspected Windows\servicing\Packages, and ran offline DISM /Image:... /Get-Packages | findstr TPM:
→ No Microsoft-Windows-TPM-Driver-WMI package or mum/cab.
Only the component payload exists in WinSxS (amd64_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_10.0.22621.1...), but there is no installable package to feed into DISM /Add-Package.
So there is NO STANDALONE TPM-Driver-WMI package that I can re-add or repair via DISM; it appears baked into the base image.
---
CURRENT SITUATION
- TPM driver: Microsoft inbox, no OEM TPM drivers.
- AV: only Defender.
- Component store: DISM /RestoreHealth and sfc /scannow are clean.
- Storage: healthy.
- Telemetry service: running.
- ADAM client: "enable → disable" cycle tried.
- 25H2 compatibility scan: now passes without TPM migration errors.
- Full upgrade: still fails in SAFE_OS / MIGRATE_DATA with:
- Source migration unit <System>\Microsoft-Windows-TPM-Driver-WMI (CCSIAgent) is not supported on the destination machine and it will not be restored
- Source migration unit is critical, arbitration will fail
- V2V Arbitration failed. Last error: 0x00000032
- pSPExecuteApply: Apply operation failed. Error: 0x0000002C
- ExecuteOperations: Failed execution phase Safe OS. Error: 0x8007042B
At this point, the only remaining options I can see are:
- In-place repair install of 23H2 using the 23H2 ISO (setup.exe → keep apps & data), to rebuild the whole servicing/migration stack, and then retry 25H2;
- Or clean install 25H2 from scratch.
Before I go down that path, I'd like to know:
---
QUESTIONS
1. Is this a known migration issue in Windows 11 25H2 (especially for Education) involving Microsoft-Windows-TPM-Driver-WMI (CCSIAgent)?
In other words, is the "not supported on the destination machine" for this migration unit an expected symptom of a current 25H2 bug or a misconfiguration on my side?
2. Is there any supported way to reset/repair/ignore the TPM-Driver-WMI migration unit on the source side, given that:
- there is no standalone Microsoft-Windows-TPM-Driver-WMI-Package~*.cab in the 23H2 ISO, and
- DISM /Get-Packages does not list such a package?
3. Is an in-place repair install of 23H2 the recommended next step in this scenario, or is the official guidance to perform a clean install of 25H2 when SAFE_OS / MIGRATE_DATA fails on a critical migration unit like this?
4. Is there any known difference between consumer vs Education/volume 25H2 media that could affect whether the TPM-Driver-WMI migration manifest is present on the target image?
Any official guidance or confirmation (e.g., "this is a known issue; wait for an updated 25H2 image or cumulative update" vs "your 23H2 install is irreparably corrupted, clean install recommended") would be very helpful before I commit to a wipe-and-reinstall.
Thank you in advance.
19 Replies
Hello,
We found a solution that works.- Open/Extract the Windows 11 25H2 ISO file Open the ISO file and navigate to the Path –sources\Replacementmanifests folder. In that, delete the file \sources\replacementmanifests\tpmdriverwmi-replacement.man from the Windows installation media.
- - On the affected system, we would instruct Windows not to try replacing the manifest from 25H2 ISO file. Concurrently, the file handling the manifest is \Windows\WinSxS\migration.xml.
- - Open the file using Notepad. The file would have a lot of <file></file> tags. - Search for microsoft-windows-tpm-driver-wmi. There would be 2 entries. Delete both of them
The steps outlined by SumtDhiman did work allowing me to upgrade from 23H2 to 25H2. However, once the upgrade was complete, I began to do normal check and installs of Win11 updates. They worked for a couple of iterations, then 25H2 crashed. The system would not boot after that. I wound up restoring with my drive from a good 23H2 backup. My 23H2 has tpm.sys at 10.0.22621.6274.. On another PC with 25H2, tpm.sys is at 10.0.26100.7705. Should I have manually updated tpm.sys to a 25H2 flavor immediately after the upgrade and before any new Win updates are installed?
The Microsoft Devs I've been in communication with have said they are still investigating the issue and have not yet found a clear solution, but have acknowledged that this is a wide-spread issue that appears during the Migration and SafeOS phase of the upgrade, specifically when attempting a migration from 23H2 to 25H2. When I looked it up, it turns out 25H2 has changed the way certain optional components are made available/installed, while other components are outright stripped from the image that are trying to be migrated from 23H2, causing failures/errors. 24H2 did not make these changes, so I am able to upgrade to 24H2 just fine, while then installing the small 25H2 enablement package in my final task sequence step/reboot. This seems to be the only solution at this time. A jump to 25H2 works at random but isn't reliable and seems unstable in the backend/payload migration process. Shame on the MS Devs for releasing this build without proper testing.
We're experiencing the same IPU issue from 23H2 to 25H2, which began after our December company freeze. Previously, we imaged over 600 workstations without problems, but since our last IPU in November, every IPU attempt has failed with the same ADAM error—manual upgrade included. We've tried all suggested solutions without success and suspect a November/December update may have caused corruption. Microsoft is currently investigating. If anyone has found a solution, please advise as I will.
I came across a few cases about the error and no solution yet, very poor experience.
We are also facing a lot of issue with the adammigrate.dll - upgrading from 23H2 to 24H2 with Enterprise ISO - will try another ISO Version and keep you updated
Yes we are still having major issues during the migration of components and experiencing failures during the SafeOS phase. I've opened an Enterprise ticket with Microsoft and have followed all their directions, with no solution identified. Seems they're also unsure as to why this is happening...
Unfortunately the 25H2 December release did not resolve the issue for me. SafeOS phase still giving errors during migration.
Hello - I am having these same issues with the Enterprise ISO image. I've gone through all the same troubleshooting as you, attempted different install WIMs and setup.exe parameters, but it always fails at the same place (with McAfee/Trellix AV uninstalled from the machine). If Trellix DLP is detected, then that causes the migration to fail during the SafeOS portion due to locked registry keys (thanks, Trellix), but otherwise, I'm experiencing the same headaches you are.
Annoyingly, I have had intermittent upgrade success from 23H2 to 25H2 on a handful of random devices/VMs, but most fail consistently. Good to see (unfortunately), that it's not just me with this issue. I'm hoping the December release will resolve the issues.- http://yourwindowsguide.com/2025/12/25h2-repair-install-failed.html#gsc.tab=0
Open/Extract the Windows 11 25H2 ISO file
Open the ISO file and navigate to the Path – sources\Replacementmanifests folder. In that, delete the file \sources\replacementmanifests\tpmdriverwmi-replacement.man from the Windows installation media.
On the affected system, we would instruct Windows not to try replacing the manifest from 25H2 ISO file. Concurrently, the file handling the manifest is \Windows\WinSxS\migration.xml. Take Ownership of the file as Step 1Open the file using Notepad. The file would have a lot of file tags.
Search for microsoft-windows-tpm-driver-wmi. There would be 2 entries.
Clear the upgrade cache by deleting the $WINDOWS.~BT folder in Windows C drive.
Disconnect the system from the internet to keep the upgrade environment offline.
Restart the upgrade process and proceed with the repair install again.Assuming the above is successful, what happens after upgrade is complete?
Will DCIM SFC fail down the road? Will tmpdriver ever get updated? Do I need to restore migration.xml?
is it a school pc
if it is, the update might be locked
We use the Enterprise version in a corporate environment.
Enterprise -> might still be blocked
As of now, there are no publicly documented widespread issues specifically linked to in-place upgrades to Windows 11 25H2 on Education editions involving these exact components. However, given the complexity of the migration process, especially with TPM and Directory Services.
We have switched from using the November ISO release to the December ISO release by Microsoft. This has provided us with successes. One observation is MS included KB5043080 as a prerequisite to the cumulative updates for 24H2 but not 25H2. That is until the December updates. Now it is included with 25H2 as well. This makes sense as 24H2 and 25H2 share the same core.
We are using the Enterprise version and are experiencing the same issue. It's a 23H2 to 25H2 upgrade.
Do we know if this issue is expected to be fixed in the coming days, or should I proceed with a clean install of Windows? Based on your experience, could you provide an estimation of whether this is likely to be resolved within, for example, a year?
Try clean install as a last oasis
If 23H2 still works, stick to it.
