Uninstall history log


M

montagi

New member
Local time
11:08 AM
Posts
3
OS
Windows 11
Not exactly an install query, more about sanity checking the success of Windows 11 update backouts.

Windows Update history gives good detail on successful MS update installs, however where is the history retained for uninstalls of updates?
The MS suggestion to look at the Win update uninstall selection, and if the uninstalled KB is no longer on that list then it was successfully backed out is a little superficial, surely its events are logged.
I have checked the service logs, though due to the volume of windows system messages I have added filters using more obvious event sources - such as WindowsUpdateClient and MsiInstaller. These two didn't capture uninstall details.
Does anybody know where uninstall logs are located, or which event sources to select in a log filter to check the success?

Thanks in advance.
 
Windows Build/Version
24H2 (OS build 26100.4770)

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
The main part you can find in the Windows Update - History of updates (successful or not) list.

Since every update comprised of many parts; That is done by the WindowsUpdateClient. Inside the eventviewer you can find all those parts in Logbooks for Application and Services - Microsoft - Windows - WindowsUpdateClients - Operational as you already found out. The source (etl files) can be found in C:\Windows\Logs\WindowsUpdate directory but on certain moments those .etl file are deleted and its info added in the eventviewer logs. The list of events can be quite extensive. It is active at random times and sometimes it shows what it found, sometime you'll see further information. Otherwise it just says 1,4 or 46 updates with no details. Tedious to look trough. When it does find a KB then the process is downloading it first into C:\Windows\SoftwareDistribution\Download directory by the download agent. It then it's getting installed into the C\Windows\SxS Component Store. by the Trusted Installer. The latest few event can be seen in the C:\Windows\SoftwareDistribution\ReportingEvents.log file.

Basically there is nothing to install or deinstall or to delete. The Update proces is shortening any file when to large, deletes stuff automatically. Only the final results is kept in the Component Store. That can be checked by DISM scanHealth/Restorehealth/AnalyzeComponentStore/StartComponentCleanup commands. The status of any update can been seen in the history of updates.
 

My Computers My Computers

System One System Two

  • At a glance

    Win 11 Pro 25H2 Build 26200.8737, Zorin OS ProIntel® Core™ i7-12700KF 12th Gen. (S1700)32GB DDR5 5600-36 Vengeance (2x16)PCIe4.0 Asus NVIDIA RTX3060Ti
    OS
    Win 11 Pro 25H2 Build 26200.8737, Zorin OS Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self built
    CPU
    Intel® Core™ i7-12700KF 12th Gen. (S1700)
    Motherboard
    ASUS Prime Z690-A, BIOS v4505 (Z690 Intel Chipset)
    Memory
    32GB DDR5 5600-36 Vengeance (2x16)
    Graphics Card(s)
    PCIe4.0 Asus NVIDIA RTX3060Ti
    Sound Card
    Onboard; Realtek
    Monitor(s) Displays
    34" LG 34UC79G-B Curved 21:9 144Hz
    Screen Resolution
    2560x1080 (No HDR)
    Hard Drives
    250Gb Samsung 870PRO NVMe (Win 11 Pro)
    1Tb Samsung 980PRO NVMe
    1Tb Samsung 970EVO NVMe
    2Tb Samsung 990PRO NVMe with heatsink.
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    3Tb WDC WD30EFRZ Red SATA (Int.)
    256Gb Samsung 840PRO SSD (RHEL 9,5)
    256Gb Samsung 850PRO SSD (Zorin OS Pro 18)
    PSU
    Coolermaster 850W V2 Gold with internal 12cm exaust fan
    Case
    Be-Quiet Pure Base 600.
    Cooling
    3x Be-Quiet! 12/14cm "Silent Wings 4" casefans, 1x Arctic Freezer i35 CPU towerblock with fan.
    Keyboard
    Steelseries APEX 7 keyboard.
    Mouse
    Logitech G-502 Hero
    Internet Speed
    1Gb
    Browser
    Brave
    Antivirus
    F-Secure
    Other Info
    No Noise system.
    256Gb Kingston Travler USB 3.0 drive.
    64Gb Sandisk USB 3.2 drive. (Ventoy)
    8Gb Philips USB 3.0 drive. (Win. Inst.)
    8Gb Philips USB 3.0 drive. (Rescue disk)
    2Tb WD USB 3.0 Passport drive.
    USB Ext. 500Gb WD SATA drive.
    External USB 3.0 C.A. CD/DVD* burner.

  • At a glance

    Windows 11 Pro 25H2Intel® Core™ i7-6700K 6th Gen. (S1151)32Gb DDR4 2400 Corsair Vengeance (4x8)ASUS GeForce GTX1080
    Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Selfbuild
    CPU
    Intel® Core™ i7-6700K 6th Gen. (S1151)
    Motherboard
    ASUS Maximus VIII Ranger (Intel Chipset Z170)
    Memory
    32Gb DDR4 2400 Corsair Vengeance (4x8)
    Graphics card(s)
    ASUS GeForce GTX1080
    Sound Card
    Onboard; Realtek
    Monitor(s) Displays
    LG IPS277L 27" WideLED, IPS
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro SSD
    PSU
    Zalman ZM600-HP with internal exhaust fan. Heatpipes & Modular cables.
    Case
    Cooler Master Aero
    Cooling
    Scythe Mugen 4 dual fan towerblock.
    Keyboard
    Red Dragon
    Mouse
    Red Dragon
    Internet Speed
    1Gb
    Browser
    Chrome
    Antivirus
    F-Secure
I ran a quick test by uninstalling KB5054156 from Windows Update / Update history / Uninstall updates.

The only place I found a reference to KB5054156 being uninstalled was the CBS.log. WU only cares about checking for, downloading, and installing new updates. It really doesn't care about the user removing an already installed update.

Knowing that, we can work backwards to an unique search pattern.
Code: 
findstr /c:"Uninstall package" C:\Windows\Logs\CBS\CBS.log

Reviewing the filtered CBS.log, we can see after a clean install, Windows sneakily runs a scheduled task to remove WMIC right before the first user logon. WMIC is actually enabled in the 24H2 base image, but MS removes it to discourage you from using WMIC.

Since we know it happened, it's a good confirmation this search pattern works to find uninstalled updates.

Code: 
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.5733
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-Package~31bf3856ad364e35~amd64~~10.0.26100.5733
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-Package~31bf3856ad364e35~amd64~~10.0.26100.5733, Update: a96124dbabb1600f5e1fd188b61a647a
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.5733
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1, Update: f56825df4b33e360892d6ad2f8bf2e18
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.5733
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-FoD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.5733
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-FoD-Package~31bf3856ad364e35~wow64~~10.0.26100.5733
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.5733
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.5733, Update: 1dedf471e09c4dfb5a24eac12122ada0
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-FoD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.5733
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-FoD-Package~31bf3856ad364e35~wow64~en-US~10.0.26100.1
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-WOW64-Package~31bf3856ad364e35~wow64~en-US~10.0.26100.1
2025-08-18 23:14:39, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-WMIC-WOW64-Package~31bf3856ad364e35~wow64~en-US~10.0.26100.1, Update: ecc9fbe244be6c592945daece33f8f72
2025-08-20 21:09:56, Info                  CBS    Exec: Uninstall package: Windows-Defender-AM-Default-Definitions-Package~31bf3856ad364e35~amd64~~10.0.26100.1
2025-08-20 21:09:56, Info                  CBS    Exec: Uninstall package: Windows-Defender-AM-Default-Definitions-Package~31bf3856ad364e35~amd64~~10.0.26100.1, Update: 705d28449bc04bbee2e2d693cb759650
2025-08-21 10:28:17, Info                  CBS    Exec: Uninstall package: Package_for_KB5054156~31bf3856ad364e35~amd64~~26100.5503.1.1
2025-08-21 10:28:17, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Package~31bf3856ad364e35~amd64~~10.0.26100.5503
2025-08-21 10:28:17, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Payload-Package~31bf3856ad364e35~amd64~~10.0.26100.5503
2025-08-21 10:28:17, Info                  CBS    Exec: Uninstall package: Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Payload-Package~31bf3856ad364e35~amd64~~10.0.26100.5503, Update: 0cdea13d89a08a9a952e692e271b6c2
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Why is this so interesting? This is the normal working of the CBS engine. During normal KB updates where it Build is getting higher (e.a. 26100.4770 -> 26100.4946) packages inside the Component Store old package are uninstalled and replaced by a newer and higher version all the time. There is no need to keep track off them. (You can issue the following command to see what's it's inside the Component Store and their current version; DISM /ONLINE /GET-PACKAGES /FORMAT:TABLE > "C:\<path>\Packages.txt" It's show you the list off packages (and their version), it's State, the Release Type and their Install time.) I always look inside the CBS.log if there are failures. The CBS.log gives me a clue what went wrong. At the end off an update the result must always be [HRESULT = 0x00000000 - S_OK], but is it fails you see something different like; [HRESULT = 0x800f0991 - PSFX_E_MISSING_PAYLOAD_FILE] The same errror code is also mentioned in the history of the updates.

During any SFC or DISM command the Trusted installer is started and depending of the DISM command you can see in the CBS.log what it checking, evaluating etc. When your issuing a DISM /RestoreHealth command it first is checking if everything is OK, in the second part if there were errors found it tries to fix them. That behavior is always the case; a /CheckHealth command only does the checking part but do not repair anything. Normally if everything is OK it will replies with "No component store corruption detected." If anything else appears then a /RestoreHealth is needed. This can be a lengthy proces sometimes. Some users complain that their system is hanging. But it isn't. It's quite busy downloading, checking, repairing. To see what the CBS engine is doing can be seen by starting a powershell as admin and issuing the following command; Get-Content C:\Windows\Logs\CBS\CBS.log -tail 10 -wait

So there is no need to track individual packages down. You can't deinstall them (The only thing you can do is deleting them. Without any knowledge I would not advise that; your system can be corrupted by this way. There is no way to letting the updating proces know that you did that) You can not install the individual packages also. The only thing you can do is to see what is currently inside the Component Store by viewing that packages.txt listing.
 

My Computers My Computers

System One System Two

  • At a glance

    Win 11 Pro 25H2 Build 26200.8737, Zorin OS ProIntel® Core™ i7-12700KF 12th Gen. (S1700)32GB DDR5 5600-36 Vengeance (2x16)PCIe4.0 Asus NVIDIA RTX3060Ti
    OS
    Win 11 Pro 25H2 Build 26200.8737, Zorin OS Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self built
    CPU
    Intel® Core™ i7-12700KF 12th Gen. (S1700)
    Motherboard
    ASUS Prime Z690-A, BIOS v4505 (Z690 Intel Chipset)
    Memory
    32GB DDR5 5600-36 Vengeance (2x16)
    Graphics Card(s)
    PCIe4.0 Asus NVIDIA RTX3060Ti
    Sound Card
    Onboard; Realtek
    Monitor(s) Displays
    34" LG 34UC79G-B Curved 21:9 144Hz
    Screen Resolution
    2560x1080 (No HDR)
    Hard Drives
    250Gb Samsung 870PRO NVMe (Win 11 Pro)
    1Tb Samsung 980PRO NVMe
    1Tb Samsung 970EVO NVMe
    2Tb Samsung 990PRO NVMe with heatsink.
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    4Tb WDC WD40EZRZ Blue SATA (Int.)
    3Tb WDC WD30EFRZ Red SATA (Int.)
    256Gb Samsung 840PRO SSD (RHEL 9,5)
    256Gb Samsung 850PRO SSD (Zorin OS Pro 18)
    PSU
    Coolermaster 850W V2 Gold with internal 12cm exaust fan
    Case
    Be-Quiet Pure Base 600.
    Cooling
    3x Be-Quiet! 12/14cm "Silent Wings 4" casefans, 1x Arctic Freezer i35 CPU towerblock with fan.
    Keyboard
    Steelseries APEX 7 keyboard.
    Mouse
    Logitech G-502 Hero
    Internet Speed
    1Gb
    Browser
    Brave
    Antivirus
    F-Secure
    Other Info
    No Noise system.
    256Gb Kingston Travler USB 3.0 drive.
    64Gb Sandisk USB 3.2 drive. (Ventoy)
    8Gb Philips USB 3.0 drive. (Win. Inst.)
    8Gb Philips USB 3.0 drive. (Rescue disk)
    2Tb WD USB 3.0 Passport drive.
    USB Ext. 500Gb WD SATA drive.
    External USB 3.0 C.A. CD/DVD* burner.

  • At a glance

    Windows 11 Pro 25H2Intel® Core™ i7-6700K 6th Gen. (S1151)32Gb DDR4 2400 Corsair Vengeance (4x8)ASUS GeForce GTX1080
    Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Selfbuild
    CPU
    Intel® Core™ i7-6700K 6th Gen. (S1151)
    Motherboard
    ASUS Maximus VIII Ranger (Intel Chipset Z170)
    Memory
    32Gb DDR4 2400 Corsair Vengeance (4x8)
    Graphics card(s)
    ASUS GeForce GTX1080
    Sound Card
    Onboard; Realtek
    Monitor(s) Displays
    LG IPS277L 27" WideLED, IPS
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro SSD
    PSU
    Zalman ZM600-HP with internal exhaust fan. Heatpipes & Modular cables.
    Case
    Cooler Master Aero
    Cooling
    Scythe Mugen 4 dual fan towerblock.
    Keyboard
    Red Dragon
    Mouse
    Red Dragon
    Internet Speed
    1Gb
    Browser
    Chrome
    Antivirus
    F-Secure
Thanks Garlin and Hader, That is precisely the sort of low level information I was searching for.
Most appreciated!
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
You must log in or register to reply here.

Similar threads

Uninstall or remove (KB5063060) update from Windows 11!
2
Replies
22
Views
3K
spapakons
spapakons
Optional Update still Appearing in Update History despite Uninstalling it
Replies
4
Views
3K
Helmut
H
Windows updates not showing in update history after manually installing them
Replies
5
Views
11K
garlin
G
  • Article Article
System Uninstall AI Components on Windows 11 PC
Replies
2
Views
531
hauomu
hauomu
Defender Definitions missing in Update History
Replies
8
Views
1K
echo2446
echo2446

Latest Support Threads

Latest Tutorials

Back
Top Bottom