How to Read Windows Update Logs in Windows 11

Understanding Log Structure and Syntax

Windows Update 🔃 logs are stored as ETL files at 📁C:\Windows\Logs\WindowsUpdatecopy. You can’t open them directly in Notepad, because ETL is a binary diagnostic format. To read them you have to convert them to text, or use a tool such as Event Viewer that translates the data for you.

Once converted, a typical log entry looks like this:

2023-10-27 10:00:00.1234567 1234 5678 Agent  * START * Finding updates

Breakdown:

• Timestamp: The exact date and time the event occurred.
• PID (Process ID): The unique number assigned to the Windows Update service.
• TID (Thread ID): The specific task thread running the update.
• Component: The part of the system (like the Agent) performing the action.
• Message: The actual status or error description.

When you scan a long log, read the Component and Message columns first. Lines that share a PID and TID belong to the same task, so you can follow one operation from start to finish.

References:

• Windows Update log files
• Get-WindowsUpdateLog (WindowsUpdate)
• Troubleshoot problems updating Windows - Microsoft Support

Option 1Read logs using PowerShell

PowerShell can read Windows Update logs by running a built-in command that converts the raw ETL files into a normal text file on your desktop. This is the best way to see your complete update history in a standard text editor, where you can search it and trace failed updates. It works the same on Windows 11 Home and Pro.

1. Open the Start menu and type PowerShell.
2. Right-click the result and select Run as administrator. (Requires Admin privileges)
3. Click Yes if the User Account Control prompt appears. A PowerShell window opens, possibly inside Windows Terminal, with "Administrator" in the title bar.
4. Copy the following command, paste it into the window, and press Enter:

Get-WindowsUpdateLog -LogPath C:\Users\Public\Desktop\WindowsUpdate.log

The command can take a minute or more, because it processes every ETL file. Wait until the prompt returns. A new log file then appears on your desktop. Double-click it to open it in Notepad.

Further detail on this command is available here: Windows Update log files

If you run the update again, run the command again to get the newest entries. To undo anything, just delete the text file from your desktop. The original ETL files are not changed.

Option 2Read logs using Event Viewer

Event Viewer is a built-in Windows tool that displays detailed system logs. It gives you a visual way to read Windows Update logs, with recent events in a clear list. You don't need to convert any files or type commands, so it is the fastest way to check what happened with your recent updates.

1. Press the Windows key, type eventvwr.msc, and press Enter. Event Viewer opens.
2. In the left pane, expand Applications and Service Logs › Microsoft › Windows › WindowsUpdateClient
3. Click Operational. A list of recent update events appears in the middle pane.
4. Click any event to see its details in the pane below the list. Look at the General tab for the update name and any error code.

Events marked Error or Warning are the ones to look at first. You can also use Filter Current Log in the right pane to show only those levels.

Event Viewer and the converted log serve different purposes. Event Viewer gives you high-level, near real-time events, such as "installation started" or "installation failed". In contrast, the WindowsUpdate.log file gives a detailed, granular history of the update process, which makes it better for in-depth troubleshooting. A good approach is to find the failing update and its error code in Event Viewer, then search for that code in the text log to see what happened around it.

Troubleshooting Common Errors

If your Windows Update logs are empty or unreadable, check two things:

• The Windows Update service. Open Services from the Start menu and find Windows Update. It may show as stopped when no update is running, which is normal. If it is disabled, set it back to its default so updates can run and write new entries.
• Administrative rights. Make sure you opened PowerShell with Run as administrator, and that you are signed in with an account that has admin rights to the log path.

If the log is still empty, try an update check first so there is fresh activity to record, then convert the log again.

Advanced Tools: SetupDiag

For persistent failures, Microsoft provides a tool called SetupDiag. It automatically scans your logs and identifies why an update failed. It is much faster than reading thousands of lines of text manually, and it is most useful when a major feature update fails to install or rolls back.