Amazon Banner

Friday, April 29, 2016

Viewing Windows Update logs in Windows 10

For many years, dating back at least to Windows XP, Windows Update has kept a text format log in the Windows directory, which could provide useful information when troubleshooting update issues.  Beginning in Windows 10, this log file (C:\Windows\WindowsUpdate.log) Is no longer used.  If you look for it in the Windows directory, you'll see that the file is still there, but is only 275 bytes, compared to the 1-2MB log files of the past.  The contents of this file now explain that it isn't used anymore, and list a powershell command to get a readable windows update log:

As you can see, there is a simple solution in the form of a new powershell cmdlet.  Simply run "get-windowsupdatelog" in powershell, and wait.  You'll see various input and output files scroll by in the powershell window as it parses the new "ETW" (Event Tracing for Windows" formatted logs, located in "c:\windows\logs\windowsupdate\".  When the cmdlet finishes, it will create a new windowsupdate.log file on the desktop:

Note that get-windowsupdatelog uses publicly available symbols to decode the ETL files and create the text formatted log.  The first time you run the command, you may have to accept terms to access Microsoft's internet based symbol store.  

If you're running a preview build, this commnand may not be able to decode the output, as the symbols for most preview builds aren't made available publicly.  In that case, you'll still get a windowsupdate.log file on your desktop, but the information in it will be less than helpful:

For more information on reading the windows update logs in Windows 10, check out KB3036646.