Windows Update Read Windows Update Logs in Windows 11

  • Thread starter Thread starter Brink
  • Start date Published: Start date Updated Updated:

Windows_Update_banner.png

This tutorial will show you how to read the Windows Update logs for your Windows 10 or Windows 11 PC.

Windows Update client now uses Event Tracing for Windows (ETW) to generate diagnostic logs saved as .etl files in the "%windir%\Logs\WindowsUpdate" folder. This method improves performance and reduces disk space usage. However, the logs are not immediately readable as written.

References:


Contents

  • Option One: Read Windows Update Logs in "WindowsUpdate.log" file using PowerShell
  • Option Two: Read Windows Update Logs in Event Viewer




Option One

Read Windows Update Logs in "WindowsUpdate.log" file using PowerShell


1 Open Windows Terminal, and select Windows Powershell.

2 Copy and paste the command below into Windows Terminal, and press Enter. (see screenshots below)

Get-WindowsUpdateLog

3 When finished, open the WindowsUpdate.log file created on your desktop to read your Windows Update logs.

It will take a few moments to finish creating the log file.



Get-WindowsUpdateLog-1.png
Get-WindowsUpdateLog-2.png





Option Two

Read Windows Update Logs in Event Viewer


1 Open Event Viewer (eventvwr.msc).

2 Perform the following steps in the left pane of Event Viewer: (see screenshot below)
  1. Expand open Applications and Service Logs.
  2. Expand open Microsoft.
  3. Expand open Windows.
  4. Expand open WindowsUpdateClient.
  5. Click/tap on Operational to open it in the middle pane.
3 You can now select event logs in the middle pane of Event Viewer to see their details. (see screenshot below)

Windows_Update_event_logs.png



That's it,
Shawn Brink


 
Last edited:
IN order to check log files I tried to install the update again. Of course it failed the same way. So then I started looking at the various Windows log files after checking the ones mentioned above. I didn't find anything in those that seemed helpful, but I did find these 2 messages in the Windows/Ststem group:

The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well.

Installation Failure: Windows failed to install the following update with error 0x800F0983: 2025-05 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5058411).

This suggests to me there might be something wrong with some sort of timing device on my system's motherboard. Of course I have no idea what that might be or if it is even correct. I'm posting this only to see if anyone else has any idea what these messages might mean.
 

My Computer My Computer

At a glance

Win11 ProAMD Ryzen 5 5500U16 GBRadeon 2100
OS
Win11 Pro
Computer type
PC/Desktop
Manufacturer/Model
BeeLink SER Mini
CPU
AMD Ryzen 5 5500U
Motherboard
BeeLink SER
Memory
16 GB
Graphics Card(s)
Radeon 2100
Sound Card
none
Monitor(s) Displays
Primary: Phillips 4K; Secondary: LG 4K
Screen Resolution
Both 3860 x 2160
Hard Drives
C: NVme 500 GB Windows only
D: 128 GB NVme User data + Windows Temp via Junction Link
PSU
External
Case
Mini
Cooling
Internal fan
Keyboard
Logitech Wireless Lighted
Mouse
Kensington ExpertMouse wireless trackball
Internet Speed
500/500
Browser
Brave
Antivirus
Windows Defender

Latest Support Threads

Back
Top Bottom