Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Setup.evtx
LogRisk: Caution

Setup.evtx C:\Windows\System32\winevt\Logs\Setup.evtx

"Setup" event log: installation and configuration of Windows components (updates, roles, features). .evtx format.

Updated on By AltF4 Formation

What it’s for

Setup.evtx is the “Setup” log in Event Viewer. It records the installation and configuration of components: updates installed, roles and features added, servicing actions. It complements CBS.log without replacing it: here you get one line per operation, succeeded or failed, there the technical detail. The neighboring logs cover other subjects, Application.evtx for programs and System.evtx for Windows and its drivers.

What it contains

  • Servicing events (provider Microsoft-Windows-Servicing), for example the installation of an update, successful or not.
  • Little volume, since the log only records one-off operations.

Risks and best practices

  • The Windows Event Log service manages the file, so export or clear the log with wevtutil (as administrator), never by touching the file, and export before clearing.
  • It names packages and KBs. Nothing dangerous in itself, but useful to an attacker looking for missing fixes, so protect any export.

Useful commands

Fenêtre de terminal
# Latest 20 events in the Setup log
Get-WinEvent -LogName Setup -MaxEvents 20 | Select-Object TimeCreated, Id, ProviderName, Message


# Servicing events only (updates, roles, features)
Get-WinEvent -FilterHashtable @{LogName="Setup"; ProviderName="Microsoft-Windows-Servicing"} -MaxEvents 30


# The log's maximum size and retention mode
wevtutil gl Setup


# Export a copy of the log
wevtutil epl Setup "$env:USERPROFILE\Desktop\Setup-copy.evtx"

Format

Binary XML file (.evtx) managed by the Windows Event Log service. Each event carries an ID, a level, a provider, a timestamp and a message. A text editor cannot read it.

Rotation and archiving

Maximum size and retention are set per log (Event Viewer, Group Policy or wevtutil sl), and wevtutil gl Setup shows the values in force. Archive by exporting with wevtutil epl.

How to read it

In Event Viewer, open Windows Logs > Setup, then filter by source (Microsoft-Windows-Servicing) or level. In PowerShell, Get-WinEvent -LogName Setup does the same, and Get-WinEvent -Path .\Setup.evtx reads a file copied from another machine. For an install or update failure, cross-check with CBS.log and setupact.log.

Report a mistake