Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Windows 10 / How to Read Windows Update Logs on Windows 10 and 11

March 17, 2024

How to Read Windows Update Logs on Windows 10 and 11

In current builds of Windows 10 and 11, the wuauserv Windows Update service logs are not written directly to the WindowsUpdate.log text file. Instead, binary Event Trace Log (ETL) files are used and Windows Update sends events using Event Tracing for Windows. You can also use Event Viewer to read information about the actions of the Windows Update agent and the update installation history on your computer. In this article, we will look at how to find the Windows Update Agent logs and how to get the history of update installations.

Contents:
  • Reading Windows Update Logs in Event Viewer
  • Get WindowsUpdate.log File on Windows 10 and 11
  • How to Check Windows Update History

Reading Windows Update Logs in Event Viewer

The Windows Update service writes a fairly detailed log of all the actions it performs to the Event Viewer logs (eventvwr.msc). When analyzing the installation logs for Windows Update, the administrator will find the following event logs to be useful:

  • Applications and Services Logs -> Microsoft -> Windows –> WindowsUpdateClient -> Operational – WindowsUpdate client logs (lets you know when the client has checked for updates and downloaded new files from the update server);WindowsUpdateClient event log
  • Windows Logs -> Setup – contains installation logs for Windows Update packages (CAB or MSU files). For example:
    Package KB5034122 was successfully changed to the Installed state

    Windows Update install logs in Event Viewer

You can use the Get-WinEvent PowerShell cmdlet to select events from Windows Update logs.

List the most recent errors in the Windows Update client log:

$filter = @{ ProviderName="Microsoft-Windows-WindowsUpdateClient"; level=1,2,3}
Get-WinEvent -FilterHashtable $filter | Select-Object -ExpandProperty Message -First 10

PowerShell: list windows update errors

List the recently installed Windows updates:

Get-WinEvent -filterHashtable @{ LogName = 'Setup'; Id = 2 }| Format-List Message, TimeCreated, MachineName

List Windows update installation events with Get-WinEvent

Get WindowsUpdate.log File on Windows 10 and 11

Starting with Windows 10, Windows Update Agent logs are no longer written in real-time to the %windir%\WindowsUpdate.log text file. If you try to open this file, you will see that the log format has been changed:

Windows Update logs are now generated using ETW (Event Tracing for Windows).
Please run the Get-WindowsUpdateLog PowerShell command to convert ETW traces into a readable WindowsUpdate.log.
For more information, please visit http://go.microsoft.com/fwlink/?LinkId=518345

empty windowsupdate.log file in windows 10 and windows server 2016/2019

Instead, Windows Update logs are written to *.ETL files in the %windir%\Logs\WindowsUpdate directory. You can use the Get-WindowsUpdateLog cmdlet to convert the ETW traces from ETL files to a plain text WindowsUpdate.log file:

Get-WindowsUpdateLog -logpath C:\PS\Logs\WindowsUpdate.log

Get-WindowsUpdateLog powershell cmdlet to generete plain text windowsupdate.log file

In previous operating systems (before Windows 10 1709 version and Windows Server 2016), the computer must have direct Internet access to the Microsoft Symbol Server (msdl.microsoft.com) to convert ETW traces.

If Internet access is restricted on a computer, you can copy the ETL files to a computer that is running a new build of Windows 10/11 and generate a WindowsUpdate.log file using the command:

Get-WindowsUpdateLog -ETLPath "C:\Temp\WindowsUpdateETL\" -LogPath "C:\Temp\WindowsUpdate.log

Now you can open a plain Windows Update log file using Notepad:

Notepad C:\PS\Logs\WindowsUpdate.log

open windowsupdate.log file on Windows 10 and 11

Tip. Please note that the WindowsUpdate.log file that you created is static and is not updated in real-time as it was in previous versions of Windows.

The resulting WindowsUpdate.log file is quite difficult to analyze. This is because it collects data from many sources:

  • AGENT – Windows Update agent events;
  • AU – automatic update;
  • AUCLNT – user interaction;
  • HANDLER – update installer management;
  • MISC – common WU info;
  • PT – synchronization of updates with local datastore;
  • REPORT – reports collection;
  • SERVICE – wuauserv service start/stop events;
  • SETUP – installing new versions of the Windows Update client;
  • DownloadManager – downloading updates to the local cache using BITS;
  • Handler, Setup – installer headers (CBS, etc.);
  • and many others.

For example, you can find the most recent Windows Update Agent (Agent) events by using a simple PowerShell regular expression to search for text in a file:

Select-String -Pattern '\sagent\s' -Path C:\PS\Logs\WindowsUpdate.log | Select-Object -Last 30

parsing windowsupdate.log with powershell

Similarly, you can parse the log file for events by KB number, or error (FAILED, Exit Code, FATAL).

You can use the WindowsUpdate.log log to find out if your computer is getting updates from Windows Update or a local WSUS server, if there are problems with Internet access, if a system proxy is being used, etc.

How to Check Windows Update History

The list of installed updates is available in the Settings app on Windows 10/11 and Windows Server 2019/2022.

Go to Settings -> Update & Security -> Windows Update -> View update history (or run the command ms-settings:windowsupdate-history ).

View Windows Update history in Settings app

This section contains the installation history for Windows Updates. From here, you can uninstall the specific update if it causes problems

You can also get the update installation history in Windows using PowerShell. To find out when the latest updates were installed on your computer, use the following CIM Class:

Get-CimInstance win32_quickfixengineering |sort installedon -desc

list installed updates with win32_quickfixengineering class

Or, you can use the Get-WUHistory cmdlet from the PSWindowsUpdate module.

Get-WUHistory: view last update installation events

1 comment
1
Facebook Twitter Google + Pinterest
PowerShellWindows 10Windows 11Windows Server 2019
previous post
Unable to Unmount/Delete VMFS Datastore: The Resource Is in Use
next post
How to Disable UAC Prompt for Specific Applications in Windows

Related Reading

How to Disable UAC Prompt for Specific Applications...

March 11, 2024

Fix: Photos App in Windows 10 Opens Extremely...

April 19, 2023

Protecting Remote Desktop (RDP) Host from Brute Force...

February 5, 2024

How to Install Only Specific Apps in Office...

March 12, 2024

Software RAID1 (Mirror) for Boot Drive on Windows

February 24, 2025

How to Get My Public IP Address with...

October 24, 2023

How to Upgrade Windows Build from an ISO...

November 7, 2024

How to Connect L2TP/IPSec VPN Server From Windows

September 22, 2023

1 comment

sivaram October 29, 2020 - 2:59 pm

Thank you very much. Its saved my day, could fix the issue PS CLI cmds helped.

Reply

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • Managing Printers and Drivers on Windows with PowerShell
  • Protecting Remote Desktop (RDP) Host from Brute Force Attacks
  • How to Set a User Thumbnail Photo in Active Directory
  • Implementing Dynamic Groups in Active Directory with PowerShell
  • Match Windows Disks to VMWare VMDK Files
  • How to Measure Storage Performance and IOPS on Windows
  • Disks and Partitions Management with Windows PowerShell
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top