How to Read Windows Update Logs in Windows 11
Windows Update logs help you understand what happened during updates on your PC.
These logs are text files that record every action Windows Update takes, including successful installs, errors, and downloads.
For example, you can check these logs to see if a specific update, like KB5012345, installed correctly or if it caused a problem.
Accessing these logs can pinpoint why a new feature isn’t working or why your computer is acting strangely after an update.
To read Windows Update logs, open PowerShell as an administrator and run Get-WindowsUpdateLog. This command converts the raw diagnostic files into a readable WindowsUpdate.log text file saved to your desktop. Alternatively, use Event Viewer by typing eventvwr.msc and navigating to WindowsUpdateClient > Operational.
Why read Windows Update logs?
Windows updates can sometimes fail due to network issues, corrupted files, or conflicts with other software. By reading these logs, you can identify specific error codes that explain why an update stopped. This saves you from guessing and helps you fix the root cause quickly.
What happens when done?
The log file, created by following the update log reading steps, presents a clear, readable text document on your desktop. This log file details when a Windows Update started, if the update met a specific error code, and if the update finished successfully.
Understanding Log Structure and Syntax
Windows update logs are special files found at 📁C:\Windows\Logs\WindowsUpdate that record your update history. These logs, which are in ETL format (a type of diagnostic log file), cannot be opened by Notepad. To read these logs, a special tool is required. This tool interprets the information so you can see entries like ‘2023-10-27 10:00:00.1234567 1234 5678 Agent * START * Finding updates’.
A typical log entry looks like this:
2023-10-27 10:00:00.1234567 1234 5678 Agent * START * Finding updates
Breakdown:
- Timestamp: The exact date and time the event occurred.
- PID (Process ID): The unique number assigned to the Windows Update service.
- TID (Thread ID): The specific task thread running the update.
- Component: The part of the system (like the Agent) performing the action.
- Message: The actual status or error description.
References:
Option 1Read logs using PowerShell
PowerShell can read Windows update logs by running a command that converts the raw log files into a readable text file for your desktop. This method helps you see the update history in a clear text format, making it easier to understand what happened. To start, open the Start menu, type PowerShell, right-click the result, and select ‘Run as administrator’.
- Open the Start menu, type PowerShell, right-click it, and select Run as administrator. (Requires Admin privileges)
- Copy and paste the following command and press Enter:
Get-WindowsUpdateLog -Destination C:\Users\Public\Desktop\WindowsUpdate.log
-ForceFlush parameter to ensure all pending data is written to the log file before conversion.Option 2Read logs using Event Viewer
The Event Viewer gives you a visual way to check Windows update logs, showing recent events in a clear list without needing to convert any files. It’s a handy tool for quickly seeing what happened with your updates. To use it, press the Windows key, type eventvwr.msc, and press Enter to open the tool.
- Press the Windows key, type eventvwr.msc, and press Enter.
- In the left pane, expand Applications and Service Logs > Microsoft > Windows > WindowsUpdateClient.
- Click on Operational to see a list of recent events.
Comparing Event Viewer and WindowsUpdate.log: Event Viewer offers a look at real-time, high-level events. In contrast, the WindowsUpdate.log file provides a detailed, granular history of the update process, making it ideal for in-depth troubleshooting.
Troubleshooting Common Errors
If your Windows Update logs are empty or unreadable, you can troubleshoot by checking if the Windows Update service is running and ensuring you have administrative rights to the log path.
Advanced Tools: SetupDiag
How to see update logs?
To see Windows Update logs in Windows 11, you can open PowerShell as an administrator and use the ‘Get-WindowsUpdateLog’ command to convert the diagnostic files into a readable text file saved on your desktop.
Can I see Windows Update history?
Yes, you can view your Windows Update history in Windows 11 by going to the Settings menu, selecting Windows Update, and then clicking on ‘Update history’ for a summary of installed and failed updates.
Where is the Windows Update log stored?
The raw diagnostic files used for Windows Update logs are stored in the ‘📂%windir%\Logs\WindowsUpdate’ folder on your system drive. Because these files are encoded in an ETW format, you must use the ‘Get-WindowsUpdateLog’ PowerShell command to convert them into a readable text file on your desktop.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!