Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Users
  3. <utilisateur>
  4. Desktop
  5. WindowsUpdate.log (generated)
LogRisk: Safe

WindowsUpdate.log (generated) C:\Users\<utilisateur>\Desktop\WindowsUpdate.log

No longer written since Windows 10: Windows Update traces are .etl files that Get-WindowsUpdateLog converts to WindowsUpdate.log, on the Desktop by default.

Updated on By AltF4 Formation

What it’s for

Up to Windows 8.1 and Windows Server 2012 R2, C:\Windows\WindowsUpdate.log was a plain text log written continuously by the Windows Update agent. Since Windows 10, nothing is written there: Windows Update records its traces as ETL files in C:\Windows\Logs\WindowsUpdate. To read them, convert them with Get-WindowsUpdateLog, which by default produces a WindowsUpdate.log on the Desktop. So do not look for this file in C:\Windows on a recent system: its absence is normal.

What it contains

  • A text file generated on demand from the .etl traces: every Windows Update phase (detection, download, installation) and the HRESULT error codes.
  • Nothing Windows reads or updates: it is a snapshot of the traces at the time of the command. -LogPath picks a location other than the Desktop.

Risks and best practices

  • Delete it freely: Windows Update does not depend on it. The source .etl files in C:\Windows\Logs\WindowsUpdate are what count.
  • It cites update identifiers (KB, GUID) and URLs. That is harmless, but review it before sharing.

Useful commands

Fenêtre de terminal
# Generate a readable log from the ETL traces
Get-WindowsUpdateLog -LogPath "$env:TEMP\WindowsUpdate.log"


# Errors and HRESULT codes
Select-String -Path "$env:TEMP\WindowsUpdate.log" -Pattern 'FATAL|WARNING|0x8[0-9a-f]{7}' | Select-Object -Last 30


# Installation failures and successes in Event Viewer (IDs 20 and 19)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WindowsUpdateClient/Operational'; Id=19,20} -MaxEvents 20 |
    Select-Object TimeCreated, Id, Message

Format

Plain text, one line per event: date, time, process and thread IDs, component (Agent, DownloadManager, Handler and so on), then the message.

Rotation and archiving

There is no rotation: each generation overwrites the previous one. Windows keeps the source .etl files in C:\Windows\Logs\WindowsUpdate under its own rotation policy. If you are documenting a failure, copy the generated file before running the command again.

How to read it

Generate the file right after the failure, then filter on the component or the error code. Match update identifiers against the CBS log and the update history in the Settings app.

Report a mistake