How to Check Update History Logs in Windows 11 Update & Security

How to access Windows Update logs in 🪟 Windows 11 and 🪟 Windows 10

You can read your update records in the graphical interface or export a raw text file for deeper analysis. The quickest view is in the Settings ⚙️ app. Open Settings, select Windows Update 🔃, then select Update history. In Windows 11 this page is under Windows Update 🔃, not the “Update & Security” section that Windows 10 used. It lists recent installs and whether each one succeeded or failed.

That summary is handy for a quick check. The raw log files go further, giving you minute-by-minute debugging data when you need to work out why something failed.

Viewing Windows Update logs using the Event Manager

Event Viewer records background actions the operating system takes, including update attempts. It shows a detailed history of past installations without any extra software. You can open it from the Start menu ⊞ search bar 🔍 by typing event viewer and pressing Enter, or from the Start button ⊞ as described below.

1. Right-click the Start button on your taskbar 🖥️ and select Event Viewer. The Event Viewer window opens with a folder tree on the left.

   

2. Expand Applications and Services Logs in the left-hand pane.
3. Click the arrow next to Microsoft to expand it.
4. Click the arrow next to Windows to reveal its subfolders. The list is long, so expect a lot of entries.
5. Scroll down and select WindowsUpdateClient.

   

6. Click Operational. The central pane now lists update events and errors, newest first.

Click any entry to read its details in the lower pane. Event ID 19 normally marks a successful install and Event ID 20 a failed one. To narrow a long list, use Filter Current Log in the right-hand Actions pane and tick Error and Warning.

Exporting Windows Update log files using Get-WindowsUpdateLog (PowerShell)

Windows stores raw update data as ETW (Event Tracing for Windows) traces, a binary format you cannot open in Notepad. To read them, convert the traces into a plain text file with PowerShell. The command below gathers the trace data and writes it out as a readable log.

1. Right-click the Start button and select Terminal (Admin). Click Yes if User Account Control asks for permission. Windows 11 opens this in PowerShell by default. If you use Command Prompt instead, type powershell first, because the command is a PowerShell cmdlet.
2. Type the following command and press Enter: Get-WindowsUpdateLog
3. Wait while PowerShell processes the tracing files and assembles the document. This can take a minute or more, and a progress message may appear.
4. Open File Explorer and go to your desktop. You should find the new WindowsUpdate.log file there.

Run the command again after a new update attempt to get a fresh copy. You can delete the file whenever you like, because the source traces are not affected.

Filtering Get-WindowsUpdateLog output

The generated file often holds thousands of lines, so reading it top to bottom is not practical. Use the search function in your text editor to jump straight to the problem entries.

1. Open WindowsUpdate.log in a text editor such as Notepad.
2. Press Ctrl + F to open the Find box.
3. Type Fault or Error and press Enter to jump to failed installation events. Press Enter again to move to the next match.
4. Look for hexadecimal status codes, such as 0x80240fff. The code points to the exact failure reason.

Copy the full code and search for it on Microsoft's support site. Read a few lines above and below each hit, since the cause is often logged just before the failure.

Generating WindowsUpdate.log

Windows continuously writes tracing data to binary event trace log files deep inside system directories. The conversion command reads those files and translates them into an ASCII text file you can open and search.

If you run it in a standard user window without elevated rights, the conversion cannot access the source tracing files and fails. If that happens, close the window and reopen it as administrator.

Windows Update log components

The text output is split into distinct parts that separate processes, time zones, and individual components. Knowing what each part means lets you read the log without being overwhelmed by raw data.

Windows Update log structure

Every line in a processed update log follows the same layout: metadata tags first, then the event message. Once you recognize that pattern, you can skip routine background maintenance lines and focus on the updates you actually installed or tried to install.

Time stamps

The time stamp comes first on each entry. It shows the date, hour, minute, second, and fraction of a second, and it relates to Coordinated Universal Time (UTC). Compare these time stamps with your system clock so you can line up update events with things like crashes or network drops. If the log times look off, check your time zone's offset from UTC.

Process ID and thread ID

Process IDs and thread IDs appear as numbers right after the time stamp. They show which service or worker thread performed each action. Searching for one thread ID lets you follow a single installation from start to finish, even when other entries are mixed in.

Component name

The component name labels the sub-system handling the task, such as the downloader, the installation orchestrator, or the cryptographic validation service. Use it to filter out routine telemetry and focus on the installation engine itself.

Update identifiers

Microsoft gives every piece of software it distributes through Windows Update a unique tracking number. These identifiers appear throughout the logs and let you tell feature upgrades, cumulative security patches, and minor driver updates apart.

Update ID and revision number

The Update ID is a unique string assigned to one software package. It is paired with a revision number that counts how many times Microsoft has reissued that package. The logs use these numbers to show whether your PC pulled the latest corrected version.

Revision ID

The Revision ID is an internal catalog number the update agent uses to verify package integrity. It also helps keep superseded or vulnerable builds from being installed.

Local ID

The Local ID identifies the installation package instance on your own machine. It separates multi-user session states from background deployment queues, so you can tell which request an entry belongs to.

Inconsistent terminology

Log files often use internal engineering terms that differ from the names shown in Settings. A patch listed as a security update in the graphical interface may appear in the raw log under a project codename or registry identifier. When a name does not match, search by the update's KB number or its ID instead.

Windows Setup log files analysis using SetupDiag tool

When a major feature update fails and Windows rolls back to the previous version, the standard update logs often do not explain why. SetupDiag is a Microsoft diagnostic tool that examines the setup log files and works out the reason for the failed upgrade. It scans the setup folders automatically and writes a clear error summary.

1. Download the official SetupDiag utility from the Microsoft website.
2. Create a new folder on your desktop and move the downloaded executable file into it.
3. Right-click the SetupDiag executable and select Run as administrator.
4. Let the tool scan the hidden system directories for setup logs. A console window stays open while it works.
5. Open the generated summary text file in the same folder. It is usually named SetupDiagResults.log. It shows the exact error code and the offending driver or application.

Advanced Log Parsing and Automated Batch Auditing

If you manage several local user accounts or run scheduled audits, reading text files by hand gets slow. You can pipe PowerShell log queries into text filtering tools and have the warning flags pulled out for you. This also avoids opening heavy graphical applications.

Command-line filtering works well on remote or resource-constrained machines where a graphical session is awkward. Combining PowerShell filters with string matching lets you build a custom diagnostic report in seconds.

Troubleshooting common issues using update logs

When an update stalls at a specific percentage or throws a generic error, the logs point to the component that is blocking it. Reading them lets you pinpoint software conflicts and resolve the failure without guessing.

Match the error codes from your logs against Microsoft's support documentation. That lets you apply a targeted fix, such as resetting the update data store or clearing the software distribution cache, rather than reinstalling Windows.

Troubleshooting fleets of Windows devices with centralized logging

Enterprise environments collect update logs from many machines into a single administrative dashboard. Network administrators use forwarded event subscriptions and management tools to check update history across hundreds of endpoints at once.

This approach saves administrators from running PowerShell commands or opening Event Viewer on every workstation on the network.

What to do next

You should now be able to find, export, and read your system update records to diagnose installation errors. As a next step, learn how to clear corrupted update caches or manually reset the Windows Update components to clear stuck patch queues.