Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. Logs
  4. WindowsUpdate
FolderRisk: Caution

WindowsUpdate C:\Windows\Logs\WindowsUpdate

Folder of Windows Update .etl trace files, to convert with Get-WindowsUpdateLog into a readable log.

Updated on By AltF4 Formation

What it’s for

Windows Update no longer writes a WindowsUpdate.log directly: the agent goes through Event Tracing for Windows (ETW) and produces .etl files, which land in this folder. You have to convert them before you can read anything.

What it contains

  • WindowsUpdate.<date>.<time>....etl trace files, unreadable as is.
  • Other update-related traces, such as UpdateSessionOrchestration.etl or NotificationUxBroker.etl.
  • No text log: the readable WindowsUpdate.log is generated on demand.

Risks and best practices

  • Deleting these files does not break Windows, but it erases the history diagnosis needs.
  • Get-WindowsUpdateLog merges the .etl files into a single WindowsUpdate.log. It is a static copy, so regenerate it when you want fresh data.
  • Cross-check update errors with CBS.log and the System log.

Useful commands

Fenêtre de terminal
# List the traces
Get-ChildItem "$env:windir\Logs\WindowsUpdate" -Force | Sort-Object LastWriteTime -Descending | Select-Object -First 10 Name, Length, LastWriteTime


# Generate a readable log on the Desktop
Get-WindowsUpdateLog -LogPath "$env:USERPROFILE\Desktop\WindowsUpdate.log"

Folder contents

Logs 1

Report a mistake