Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Microsoft-Windows-WindowsUpdateClient%4Operational.evtx
LogRisk: Caution

Microsoft-Windows-WindowsUpdateClient%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx

Microsoft-Windows-WindowsUpdateClient/Operational log: update installation history (event 19 success, 20 failure, 21 restart required).

Updated on By AltF4 Formation

What it’s for

The Microsoft-Windows-WindowsUpdateClient/Operational channel in Event Viewer gives a readable history of what Windows Update downloaded and installed, update by update, without going through the ETW traces.

What it contains

  • 19: installation succeeded, with the update title (KB).
  • 20: installation failed, with the error code.
  • 21: a restart is required to finish the installation.
  • 43 and 44: start of installation and start of download of an update.
  • The update title and GUID appear in the message text or the event data.

Risks and best practices

  • Its maximum size is limited, so on a busy server old events get overwritten. Check it with wevtutil gl and export it before clearing.
  • It tells you that an installation failed and with which code, not why: the cause is in CBS.log or WindowsUpdate.log.
  • For a fleet, query it remotely with Get-WinEvent -ComputerName instead of copying files around.

Useful commands

Fenêtre de terminal
# Last 50 events of the channel
Get-WinEvent -LogName 'Microsoft-Windows-WindowsUpdateClient/Operational' -MaxEvents 50


# Successful and failed installations over 30 days
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WindowsUpdateClient/Operational'; Id=19,20; StartTime=(Get-Date).AddDays(-30)} |
    Select-Object TimeCreated, Id, Message


# Log configuration
wevtutil gl "Microsoft-Windows-WindowsUpdateClient/Operational"

Format

Binary XML file (.evtx). The “/” in the channel name becomes “%4” in the file name.

Rotation and archiving

Maximum size and behavior when full are set in the log properties or through Group Policy. wevtutil epl exports the channel to an .evtx file for archiving.

How to read it

In Event Viewer, go to Applications and Services Logs, Microsoft, Windows, WindowsUpdateClient, Operational. Filter on IDs 19, 20 and 21 to get the history, then match the time of a failure (20) against CBS.log.

Report a mistake