What did Claude actually do versus the engineer?

Claude read logs, dumps and error codes, proposed hypotheses and read-only verification commands, and drafted fix scripts and procedure documents. The engineer executed every command, decided whether reboots were acceptable, and owned the outcome.

Did Claude always get the diagnosis right?

No. In one case Claude's first hypothesis about a firewall GPO blocking WMI was wrong, and a single look at ccm.log showed the server-side push had succeeded and the client log ended with return code 7. The lesson was to have Claude state what the logs would show if its guess were right, then check.

What safeguards were put around Claude's scripts?

Scripts were wrapped in a script block so a return stops the whole block, and they fail closed: if a connection or credential check fails, they abort. Prerequisites were checked in code, and procedures were issued one step at a time with execution location and expected result.

Large Language ModelsAI Coding AssistantsZenn AI/ML11h agoNov 4, 2026, 06:00 JST

Claude diagnoses Windows 11 rollout failures, including DWUC1294.sys

Send on LINE

3 Key Points

What happened
An engineer fed error codes, logs and command output to Claude, which narrowed causes, wrote verification commands and built fix scripts. It traced a 0xC1900101-0x40021 rollback to the old driver DWUC1294.sys via a memory dump, and all affected machines were upgraded.
Why it matters
Work that once took an experienced engineer hours — reading dumps and logs to pin down a cause — was handled in short order, with the engineer still executing every command and judging when a reboot was safe.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, every morning.

Get these free every morning

Context & Analysis

The setup itself was constrained: about 40 Windows 11 Pro machines across two sites, update delivery through Microsoft Configuration Manager, and terminals whose firewalls accepted traffic from only one management server. One site could not be visited, and the machines were in daily business use, so they could not be rebooted during the day. The 24H2 support for the Pro edition had already ended, adding pressure to move to a newer version.

The working pattern kept Claude away from the devices entirely. The engineer pasted error codes, log excerpts and command output; Claude returned several hypotheses plus read-only commands to test them; the engineer ran those and pasted back the output. This loop also surfaced things the engineer might not have checked, such as the nightly 0:00 shutdown task installed across all machines during provisioning, which kept terminals powered off during the 1:00–6:00 maintenance window. The fix was to disable that task remotely and distribute a 0:30 reboot task through Group Policy Preferences.

Not every case ended in a confirmed root cause. For the 0x8024200D cumulative-update failures, a cache-clearing batch built after Microsoft support suggested a hash mismatch did not help on the first machine, so the team bypassed the delivery path and applied the MSU files directly with DISM. That script was later reused for another site's refresh and for the move to 25H2 via the enablement package KB5054156, suggesting the value lay as much in reusable, staged automation as in any single diagnosis.

FAQ

What did Claude actually do versus the engineer?: Claude read logs, dumps and error codes, proposed hypotheses and read-only verification commands, and drafted fix scripts and procedure documents. The engineer executed every command, decided whether reboots were acceptable, and owned the outcome.
Did Claude always get the diagnosis right?: No. In one case Claude's first hypothesis about a firewall GPO blocking WMI was wrong, and a single look at ccm.log showed the server-side push had succeeded and the client log ended with return code 7. The lesson was to have Claude state what the logs would show if its guess were right, then check.
What safeguards were put around Claude's scripts?: Scripts were wrapped in a script block so a return stops the whole block, and they fail closed: if a connection or credential check fails, they abort. Prerequisites were checked in code, and procedures were issued one step at a time with execution location and expected result.

Zenn AI/MLRead Original Article

Send on LINE

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Get it free

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.