How to Read Windows Update Logs in Windows 11
Windows Update logs record every system action and error code generated while your Windows 11 PC downloads and installs system updates. These plain text records track background downloads, component replacements, and installation failures so you can troubleshoot update errors like KB5012345.
Reading these logs lets you pinpoint why a feature failed to install or why your computer behaves strangely after a system restart. PowerShell commands format the raw log data into readable files on your desktop.
To read Windows Update logs, open PowerShell as an administrator and run Get-WindowsUpdateLog. This command converts the raw diagnostic files into a readable WindowsUpdate.log text file saved to your desktop. Alternatively, use Event Viewer by typing eventvwr.msc and navigating to WindowsUpdateClient Operational
Why read Windows Update logs?
Windows updates can sometimes fail due to network issues, corrupted files, or conflicts with other software. By reading these logs, you can identify specific error codes that explain why an update stopped. This saves you from guessing and helps you fix the root cause quickly.
What happens when done?
The log file, created by following the update log reading steps, presents a clear, readable text document on your desktop. This log file details when a Windows Update started, if the update met a specific error code, and if the update finished successfully.
Understanding Log Structure and Syntax
Windows update logs are stored as ETL files at 📁C:\
A typical log entry looks like this:
2023-10-27 10:00:00.1234567 1234 5678 Agent * START * Finding updates
Breakdown:
- Timestamp: The exact date and time the event occurred.
- PID (Process ID): The unique number assigned to the Windows Update service.
- TID (Thread ID): The specific task thread running the update.
- Component: The part of the system (like the Agent) performing the action.
- Message: The actual status or error description.
References:
Option 1Read logs using PowerShell
PowerShell lets you read Windows Update logs by running a built-in command that converts the raw ETL files into a normal text file on your desktop. This method is the best way to view your complete update history in a standard text editor so you can search through the entries and troubleshoot failed updates easily.
- Open the Start menu, type PowerShell, right-click it, and select Run as administrator. (Requires Admin privileges)
- Copy and paste the following command and press Enter:
Get-WindowsUpdateLog -Destination C:\Users\Public\Desktop\WindowsUpdate.log
If you are troubleshooting a current issue, use the -ForceFlush parameter to ensure all pending data is written to the log file before conversion.
Option 2Read logs using Event Viewer
Event Viewer (a built-in Windows tool that displays detailed system logs) gives you a visual way to read Windows Update logs by showing recent events in a clear list. You do not need to convert any files or use text commands with this method, making it the fastest way to check what happened with your recent system updates.
- Press the Windows key, type eventvwr.msc, and press Enter.
- In the left pane, expand Applications and Service Logs > Microsoft > Windows > WindowsUpdateClient.
- Click on Operational to see a list of recent events.
Comparing Event Viewer and WindowsUpdate.log: Event Viewer offers a look at real-time, high-level events. In contrast, the WindowsUpdate.log file provides a detailed, granular history of the update process, making it ideal for in-depth troubleshooting.
Troubleshooting Common Errors
If your Windows Update logs are empty or unreadable, you can troubleshoot by checking if the Windows Update service is running and ensuring you have administrative rights to the log path.
Advanced Tools: SetupDiag
For persistent failures, Microsoft provides a tool called SetupDiag. It automatically scans your logs and identifies why an update failed. It is much faster than reading thousands of lines of text manually.
How to see update logs?
To see Windows Update logs in Windows 11, you can open PowerShell as an administrator and use the 'Get-WindowsUpdateLog' command to convert the diagnostic files into a readable text file saved on your desktop.
Can I see Windows Update history?
Yes, you can view your Windows Update history in Windows 11 by going to the Settings menu, selecting Windows Update, and then clicking on 'Update history' for a summary of installed and failed updates.
Where is the Windows Update log stored?
The raw diagnostic files used for Windows Update logs are stored in the '%windir%\Logs\WindowsUpdate' folder on your system drive. Because these files are encoded in an ETW format, you must use the 'Get-WindowsUpdateLog' PowerShell command to convert them into a readable text file on your desktop.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!