Key Points
How to Access Windows Update Logs
- Using Event Viewer
- Right-click Start → Select Event Viewer
- Navigate to:
Applications and Service Logs → Microsoft → Windows → WindowsUpdateClient - Click Operational to view logs
- Using PowerShell (Get-WindowsUpdateLog)
- Open PowerShell (Admin)
- Run: Get-WindowsUpdateLog
- Logs are saved to WindowsUpdate.log on your Desktop
How to Filter Windows Update Logs
- Search for errors only: Get-Content “C:\WindowsUpdate.log” | Select-String “Error”
- Search for a specific update ID (e.g., KB1234567): Get-Content “C:\WindowsUpdate.log” | Select-String “KB1234567”
Note: These commands assume that WindowsUpdate.log is located in C:\. If the file was generated on your Desktop or in another location, update the file path in the command accordingly.
This comprehensive guide demonstrates how to read Windows Update logs in Windows 11 and Windows 10 and explains how to use them to troubleshoot problems with your Windows PC. It includes step-by-step instructions for accessing Windows logs, information about what logs mean, and tips for interpreting them.
Troubleshooting Windows Update can be tricky, and being able to read and understand the contents of Windows Update logs will assist you in solving issues faster, with less guesswork.
See exactly how log-reading works by watching this short video: Complete Guide: How to Read Windows Update Logs.
An overview of Windows Update logs and their importance
A log (or log file) is a record of actions taken by a computer program that can later be used to see what it did and when (and sometimes, why). Log files are usually plain text files with one line of text per log entry. This information, contained in logs, can be later used to troubleshoot issues, confirm that an action was successful, or audit the behavior of programs and users to monitor for unauthorized or malicious activity.
Windows Update generates log files that contain detailed information about the Windows Update process to assist with troubleshooting, including the following data:
- Timestamp: The date and time the log entry was created.
- Process ID: The ID of the process that generated the log entry.
- Thread ID: The ID of the thread that generated the log entry.
- Component: The Windows Update component that generated the log entry.
- Message: A message describing what action was taken.
Here’s what a series of log entries in a Windows Update log file looks like when exported as text:
2024/11/22 10:13:34.567 12345 67890 Shared * START * Checking for updates
2024/11/22 10:13:35.678 12345 67890 Handler Downloading update KB1234567
2024/11/22 10:13:36.789 12345 67890 Handler Successfully downloaded update KB1234567
2024/11/22 10:14:10.123 12345 67890 Handler ERROR: 0x711f123f Failed to install update
Keeping Windows up-to-date is vital to protect against malware and cybersecurity threats. Windows Update also keeps your drivers and other Windows features up to at, ensuring you have the latest stability bug fixes and get the best possible performance from your hardware.
If Windows Update stops functioning properly, it is important to resolve the issue as quickly as possible, and its log files will contain detailed information to assist with this.
How to access Windows Update logs in Windows 11 and Windows 10
The steps to view Windows Update logs are the same in Windows 11 and Windows 10.
You will need to be logged in as an Administrator to perform the actions below.
Viewing Windows Update logs using the Event Viewer
The Windows Event Viewer provides an interface for viewing logs from Windows and other applications. The Event Viewer can be used to browse and export logs, and includes the ability to search and filter logs by date and type.
- Right-click on the Start button.
- Click Event Viewer.
- Navigate to Applications and Service Logs\Microsoft\Windows\WindowsUpdateClient in the navigation tree in the left panel.
- Expand the WindowsUpdateClient item and click Operational to view the Windows Update events in the log.
You can click an event to view more details, and use the Filter Current Log function to narrow your search.
Exporting Windows Update log files using Get-WindowsUpdateLog (PowerShell)
Note that you’ll need to open an elevated PowerShell prompt to use this command.
The Get-WindowsUpdateLog PowerShell command merges and exports Windows Update logs into a file on your desktop:
- Right-click on the Start button.
- Click Terminal (Admin) if you are running Windows 11, or select Windows PowerShell (Admin) if you’re using Windows 10.
- In the PowerShell window, enter the command Get-WindowsUpdateLog followed by the Enter key.
- Windows Update logs will be exported to the file log on your desktop.
The format of this file will match the example log text shown earlier in this article (note that there are no column headings included in the file).
Filtering Get-WindowsUpdateLog output
As the .log file generated by Get-WindowsUpdateLog is just a text file, you can use PowerShell’s built-in utilities to quickly search it. In the example below, Select-String is used to output only the lines that contain the text “Error”.
Get-Content “C:\WindowsUpdate.log” | Select-String “Error”
Note: This command assumes that WindowsUpdate.log is located in C:\. If the file was generated on your Desktop or in another location, update the file path in the command accordingly.
If you only want to get log entries for a specific date, you could replace the text “Select-String searches for” with the required date. Because of the way dates are formatted, you can filter to the hour or minute by expanding the text search. PowerShell can be used to automate many system tasks, enabling quick log file exports and scans for potential failed updates or other issues.
Event Viewer or PowerShell: Which should you use?
Both methods provide information about Windows Update activity, but they access and present different logging data. Which one makes sense depends on what you’re trying to do.
| Criteria | Event Viewer | PowerShell (Get-WindowsUpdateLog) |
| Best for | Checking one device, browsing visually | Exporting logs, scripting, or searching in bulk |
| Skill level needed | Beginner-friendly | Comfortable with basic commands |
| Filtering | Built-in filter and search tools in the interface | Filter with Select-String after export |
| Output format | Structured list, click for event details | Single merged text file (WindowsUpdate.log) |
| Automation | Manual, one device at a time | Can be scripted across multiple devices |
| Requires admin rights | Depends on log permissions | Yes (elevated PowerShell) |
If you’re troubleshooting a single failed update on your own machine, start with Event Viewer. If you need to pull logs from several machines, search across a large log file, or feed the output into another script or tool, PowerShell is the faster path.
How to read and interpret Windows Update logs
The easiest way for most users to understand Windows Update logs is to use the Event Viewer method, as it provides a graphical, user-friendly way to explore the logs, with all information labeled and searchable.
The Date, Severity, Event ID, and log Message are the most relevant pieces of information included. If you notice Windows Updates are failing in the Windows Settings App, you can use the Event Viewer to find errors for the date those updates failed and see if the message includes any additional information.
Windows Update entries can have different severity levels, including Information, Warning, and Error. You can start by looking for errors associated with the failure and, if they don’t reveal the cause, review related warning and informational events for additional context.
If you know the ID of the update that is failing (for example, KB0123456), you can search for that ID to find related events that may provide additional information about the failure. In Event Viewer, the update ID may also appear in the event details, depending on the event.
Troubleshooting common issues using update logs
If the information you find in the error log is ambiguous and doesn’t plainly tell you what went wrong, you can search for the update ID online for more information.
Searching for the Event ID and the Source of the error listed in the Event Viewer will also help you identify potential issues. It will also tell you at what stage of the update process they occurred. If you decide to share the contents of your logs online so that others can help you troubleshoot, make sure you limit them to only the relevant log entries, nd carefully read through them to make sure no private information is included.
Below are some common Windows Update errors that can be identified using the Event Viewer:
- Network connectivity problems: An unreliable internet connection can cause problems when checking for or downloading updates.
- Not enough disk space: Updates will fail to install if there is not enough disk space.
- Missing or corrupted Windows system files: If your Windows system files are corrupted, updates may fail. You can attempt to fix this by running sfc /scannow from an elevated PowerShell prompt.
- Software conflict or outdated drivers: Old drivers may conflict with new driver installations. Conflicting software can be uninstalled if an update attempts to replace it and fails.
- Pending restart: An update may fail if previous updates are waiting for your system to restart to complete their installation.
Common Windows Update error codes
| Error code | Likely cause | Quick fix |
| 0x80070643 | Failed installation, often tied to a .NET Framework update | Uninstall the problematic update, then reinstall it manually from the Microsoft Update Catalog |
| 0x8024402C | Network or proxy issue reaching Windows Update servers | Check your internet connection, then run the Windows Update Troubleshooter |
| 0x800f0922 | Insufficient disk space, or a VPN interfering with the update process | Free up disk space and disconnect any active VPN before retrying |
| 0x80070005 | Access denied, often caused by permissions issues or antivirus interference | Re-run the update as Administrator, and temporarily disable third-party antivirus software |
| 0x8007000e | Low memory or low disk space during installation | Restart the device to clear memory, then free up disk space and retry |
| 0x80244019 | Windows Update client is blocked from contacting the update server | Check firewall and proxy settings, and confirm Windows Update services are running |
| 0x80073712 | A file needed by Windows Update is missing or corrupted. | Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth from an elevated prompt |
| 0x800705b4 | The update process timed out, often after a long-running scan. | Restart the device and retry; if it persists, run the Windows Update Troubleshooter |
Note: If your error code isn’t listed here, search for it directly online along with “Windows Update”. Microsoft and community forums maintain more exhaustive, frequently updated lists as new issues surface.
The specific fix for a failed update will depend on the update and the reason it failed. Usually, the resolution can be found online. If a driver update has failed, downloading the latest driver directly from the manufacturer may resolve the issue. Windows updates can also be manually downloaded if ongoing connectivity issues are causing Windows Update to fail.
Troubleshooting fleets of Windows devices with centralized logging
Pre-empting system issues by monitoring Windows Update logs and troubleshooting when something goes wrong can greatly reduce the time and effort required to keep a fleet of Windows devices healthy.
While PowerShell can be used to automate the process to some extent, it still requires manual scripting and maintenance, as well as additional infrastructure for collecting log files.
The NinjaOne Endpoint Management platform lets you centrally monitor and maintain tens of thousands of Windows, Apple, and Android devices from one console. NinjaOne Autonomous Patch Management helps keep devices up to date and automatically flags update issues to support remediation.
