How to Read Windows Update Logs in Windows 11

Do you ever wonder why your computer is acting up after an update? Sometimes you need to check the Windows Update logs to see exactly what happened behind the scenes. This guide will show you how to read those logs in Windows 11.

Why read Windows Update logs?

Windows updates can sometimes fail due to network issues, corrupted files, or conflicts with other software. By reading these logs, you can identify specific error codes that explain why an update stopped. This saves you from guessing and helps you fix the root cause quickly.

What happens when done?

You will have a clear, readable text file on your desktop or a detailed list in the Event Viewer. You will be able to see exactly when an update started, if it encountered a specific error, and if it finished successfully.

Understanding Log Structure and Syntax

Windows uses Event Tracing for Windows (ETW) to create diagnostic files. These files are saved in the C:\Windows\Logs\WindowsUpdate folder. These files are in a special format called ETL files. Because they are binary, you cannot open them with Notepad directly. You must convert them to a readable format first.

A typical log entry looks like this:

2023-10-27 10:00:00.1234567 1234 5678 Agent  * START * Finding updates

Breakdown:

• Timestamp: The exact date and time the event occurred.
• PID (Process ID): The unique number assigned to the Windows Update service.
• TID (Thread ID): The specific task thread running the update.
• Component: The part of the system (like the Agent) performing the action.
• Message: The actual status or error description.

References:

• Windows Update log files
• Get-WindowsUpdateLog (WindowsUpdate)
• Troubleshoot problems updating Windows – Microsoft Support

Option One: Read logs using PowerShell

This method converts raw ETL data into a simple text file on your desktop.

1. Open the Start menu, type PowerShell, right-click it, and select Run as administrator. (Requires Admin privileges)
2. Copy and paste the following command and press Enter:

Get-WindowsUpdateLog -Destination C:\Users\Public\Desktop\WindowsUpdate.log

Windows Update log files

Pro-tip: If you are troubleshooting a current issue, use the -ForceFlush parameter to ensure all pending data is written to the log file before conversion.

Option Two: Read logs using Event Viewer

If you prefer a visual interface, use the built-in Event Viewer.

1. Press the Windows key, type eventvwr.msc, and press Enter.
2. In the left pane, expand Applications and Service Logs > Microsoft > Windows > WindowsUpdateClient.
3. Click on Operational to see a list of recent events.

Difference between Event Viewer and WindowsUpdate.log: Event Viewer shows real-time, high-level events, while the WindowsUpdate.log file provides a deep, granular history of the update process, which is better for complex troubleshooting.

Troubleshooting Common Errors

If your log file is empty or unreadable, it is often because the Windows Update service is not running or the log path is restricted. Ensure you are running your tools with administrative rights. If you see error codes like 0x80070005, it usually means ‘Access Denied,’ suggesting a permissions issue.

Advanced Tools: SetupDiag

For persistent failures, Microsoft provides a tool called SetupDiag. It automatically scans your logs and identifies why an update failed. It is much faster than reading thousands of lines of text manually.