diff --git a/installer/setup.ps1 b/installer/setup.ps1
index e7449d4..61440b3 100644
--- a/installer/setup.ps1
+++ b/installer/setup.ps1
@@ -4,9 +4,36 @@ param(
   [string]$ServerUrl,
   [string]$InstallDir
 )
-$cfgDir = Join-Path $env:ProgramData "vantage"
-New-Item -ItemType Directory -Force -Path $cfgDir | Out-Null
-$cfg = @"
+
+$ErrorActionPreference = "Stop"
+$logDir = Join-Path $env:ProgramData "vantage"
+New-Item -ItemType Directory -Force -Path $logDir | Out-Null
+$log = Join-Path $logDir "install.log"
+
+function Write-Log($msg) {
+  $line = "{0} {1}" -f (Get-Date -Format "s"), $msg
+  Add-Content -Path $log -Value $line
+}
+
+# Fail native-exe (nssm) calls loudly: check $LASTEXITCODE after each call
+function Invoke-Native {
+  param([string]$File, [string[]]$Args)
+  Write-Log ("RUN: {0} {1}" -f $File, ($Args -join " "))
+  $out = & $File @Args 2>&1
+  if ($out) { Write-Log ("OUT: {0}" -f ($out -join "`n")) }
+  if ($LASTEXITCODE -ne 0) {
+    throw ("{0} exited {1}" -f $File, $LASTEXITCODE)
+  }
+}
+
+try {
+  Write-Log "=== setup start ==="
+  Write-Log ("ServerId={0} ServerUrl={1} InstallDir={2}" -f $ServerId, $ServerUrl, $InstallDir)
+
+  $cfgDir = Join-Path $env:ProgramData "vantage"
+  New-Item -ItemType Directory -Force -Path $cfgDir | Out-Null
+
+  $cfg = @"
 server_url: "$ServerUrl"
 server_id: "$ServerId"
 pre_reg_token: "$Token"
@@ -14,12 +41,29 @@ agent_token: ""
 poll_interval: 30s
 tls: true
 "@
-Set-Content -Path (Join-Path $cfgDir "config.yaml") -Value $cfg -Encoding utf8
-# Lock down ACL: SYSTEM + Administrators only
-icacls (Join-Path $cfgDir "config.yaml") /inheritance:r /grant:r "SYSTEM:F" "Administrators:F" | Out-Null
+  $cfgPath = Join-Path $cfgDir "config.yaml"
+  Set-Content -Path $cfgPath -Value $cfg -Encoding utf8
+  Write-Log "wrote $cfgPath"
 
-$nssm = Join-Path $InstallDir "nssm.exe"
-$exe  = Join-Path $InstallDir "vantage-agent.exe"
-& $nssm install VantageAgent $exe
-& $nssm set VantageAgent Start SERVICE_AUTO_START
-& $nssm start VantageAgent
+  # Lock down ACL: SYSTEM + Administrators only
+  Invoke-Native -File "icacls" -Args @($cfgPath, "/inheritance:r", "/grant:r", "SYSTEM:F", "Administrators:F")
+
+  if (-not $InstallDir) { $InstallDir = $PSScriptRoot }
+  $nssm = Join-Path $InstallDir "nssm.exe"
+  $exe  = Join-Path $InstallDir "vantage-agent.exe"
+
+  if (-not (Test-Path $nssm)) { throw "nssm.exe not found at $nssm" }
+  if (-not (Test-Path $exe))  { throw "vantage-agent.exe not found at $exe" }
+
+  Invoke-Native -File $nssm -Args @("install", "VantageAgent", $exe)
+  Invoke-Native -File $nssm -Args @("set", "VantageAgent", "Start", "SERVICE_AUTO_START")
+  Invoke-Native -File $nssm -Args @("start", "VantageAgent")
+
+  Write-Log "=== setup ok ==="
+  exit 0
+}
+catch {
+  Write-Log ("ERROR: {0}" -f $_.Exception.Message)
+  Write-Log ($_.ScriptStackTrace)
+  exit 1
+}
diff --git a/installer/vantage-agent.wxs b/installer/vantage-agent.wxs
index e810429..715dfcd 100644
--- a/installer/vantage-agent.wxs
+++ b/installer/vantage-agent.wxs
@@ -54,7 +54,7 @@
          actual Windows machine before this is trusted in production. -->
     <SetProperty Id="WriteConfig"
       Before="WriteConfig" Sequence="execute" Condition="NOT Installed"
-      Value='cmd.exe /c powershell -ExecutionPolicy Bypass -File "[INSTALLDIR]setup.ps1" -ServerId "[SERVERID]" -Token "[TOKEN]" -ServerUrl "[SERVERURL]" -InstallDir "[INSTALLDIR]"' />
+      Value='cmd.exe /c powershell -ExecutionPolicy Bypass -File "[INSTALLDIR]setup.ps1" -ServerId "[SERVERID]" -Token "[TOKEN]" -ServerUrl "[SERVERURL]"' />
 
     <CustomAction Id="WriteConfig" Directory="INSTALLDIR" ExeCommand="[WriteConfig]"
       Execute="deferred" Impersonate="no" Return="check" />