diff --git a/test/new-e2e/tests/windows/domain-test/domain_test.go b/test/new-e2e/tests/windows/domain-test/domain_test.go
index aedec91ceb83..495284576e25 100644
--- a/test/new-e2e/tests/windows/domain-test/domain_test.go
+++ b/test/new-e2e/tests/windows/domain-test/domain_test.go
@@ -16,9 +16,11 @@ import (
 
 	scenwindows "github.com/DataDog/datadog-agent/test/e2e-framework/scenarios/aws/ec2/windows"
 	awsHostWindows "github.com/DataDog/datadog-agent/test/e2e-framework/testing/provisioners/aws/host/windows"
+	agentclient "github.com/DataDog/datadog-agent/test/e2e-framework/testing/utils/e2e/client/agentclient"
 	"github.com/DataDog/datadog-agent/test/new-e2e/tests/windows"
 
 	"github.com/stretchr/testify/assert"
+	testifysuite "github.com/stretchr/testify/suite"
 
 	"github.com/DataDog/datadog-agent/test/e2e-framework/testing/e2e"
 	"github.com/DataDog/datadog-agent/test/e2e-framework/testing/environments"
@@ -129,12 +131,14 @@ func (suite *testUpgradeSuite) TestGivenDomainUserCanUpgradeAgent() {
 	suite.Require().NoError(err, "should succeed to install Agent on a Domain Controller with a valid domain account & password")
 
 	tc := suite.NewTestClientForHost(suite.Env().RemoteHost)
+	suite.setLogLevelDebug(tc)
 	platformCommon.CheckAgentBehaviour(suite.T(), tc)
 
 	_, err = suite.InstallAgent(host,
 		windowsAgent.WithPackage(suite.AgentPackage),
 		windowsAgent.WithInstallLogFile(filepath.Join(suite.SessionOutputDir(), "TC-UPG-DC-001_upgrade.log")))
 	suite.Require().NoError(err, "should succeed to upgrade an Agent on a Domain Controller")
+	suite.setLogLevelDebug(tc)
 
 	tc.CheckAgentVersion(suite.T(), suite.AgentPackage.AgentVersion())
 	platformCommon.CheckAgentBehaviour(suite.T(), tc)
@@ -144,3 +148,51 @@ func (suite *testUpgradeSuite) TestGivenDomainUserCanUpgradeAgent() {
 		assert.NotEmpty(c, stats)
 	}, 5*time.Minute, 10*time.Second)
 }
+
+// setLogLevelDebug sets the running Agent's log level to debug, to get more detail in the
+// collected agent logs if this test fails (see AfterTest below). This is a runtime setting,
+// so it must be re-applied after the Agent process restarts (e.g. after the upgrade step).
+func (suite *testUpgradeSuite) setLogLevelDebug(tc *platformCommon.TestClient) {
+	_, err := tc.AgentClient.ConfigWithError(agentclient.WithArgs([]string{"set", "log_level", "debug"}))
+	suite.Require().NoError(err, "should set log_level to debug")
+}
+
+// AfterTest collects the Agent logs when the test fails, to help debug issues like the
+// fakeintake connectivity failures tracked in WINA-3019.
+func (suite *testUpgradeSuite) AfterTest(suiteName, testName string) {
+	if afterTest, ok := any(&suite.BaseAgentInstallerSuite).(testifysuite.AfterTest); ok {
+		afterTest.AfterTest(suiteName, testName)
+	}
+
+	if suite.T().Failed() {
+		suite.collectAgentLogs()
+	}
+}
+
+// collectAgentLogs downloads the agent log folder from the remote host into the session
+// output dir. Best-effort: missing logs are surfaced as assertion failures but do not
+// abort test cleanup.
+func (suite *testUpgradeSuite) collectAgentLogs() {
+	vm := suite.Env().RemoteHost
+	suite.T().Logf("Collecting agent logs")
+
+	logsFolder, err := vm.GetLogsFolder()
+	if !suite.Assert().NoError(err, "should get logs folder") {
+		return
+	}
+	entries, err := vm.ReadDir(logsFolder)
+	if !suite.Assert().NoError(err, "should read log folder") {
+		return
+	}
+	for _, entry := range entries {
+		sourcePath := filepath.Join(logsFolder, entry.Name())
+		destPath := filepath.Join(suite.SessionOutputDir(), entry.Name())
+
+		if entry.IsDir() {
+			err = vm.GetFolder(sourcePath, destPath)
+		} else {
+			err = vm.GetFile(sourcePath, destPath)
+		}
+		suite.Assert().NoError(err, "should download %s", entry.Name())
+	}
+}