How to Retrieve Windows Update Log Files

Issue

You need to collect the Windows Update log from a device — to troubleshoot a patch failure or a stuck update, or to attach to a support ticket. On Windows 10, Windows 11, and Windows Server 2016 and later, the log is not a plain-text file you can open directly: the update client writes binary trace files, and you convert them into a readable WindowsUpdate.log with a single PowerShell command.

Environment

• Automox-managed Windows devices installing Windows (first-party) updates
• On-device: an elevated PowerShell session (Run as administrator)

Resolution

Windows 10 / 11 and Windows Server 2016 or later

1. On the device, open PowerShell as administrator.

2. Run:

   Get-WindowsUpdateLog -LogPath "$env:USERPROFILE\Desktop\WindowsUpdate.log"

   This converts the update client's trace files into a single readable WindowsUpdate.log on the desktop. Add -ForceFlush to include activity that has not been written to disk yet:

   Get-WindowsUpdateLog -ForceFlush -LogPath "$env:USERPROFILE\Desktop\WindowsUpdate.log"

3. Open the resulting WindowsUpdate.log, or attach it to your Automox support ticket.

Older Windows (before Windows 10 / Server 2016)

No conversion is needed — open the live log directly at C:\Windows\WindowsUpdate.log.

Also collect CBS.log for install failures (optional)

When an update downloads but fails to install, the servicing log usually names the specific file or component that blocked it. Collect it from %systemroot%\Logs\CBS\CBS.log (typically C:\Windows\Logs\CBS\CBS.log) alongside WindowsUpdate.log.

To locate a specific failure, search the log for the update's KB number or for Windows Update error codes (they commonly begin with 8024). For code meanings, see Common Windows Update Error Codes or Microsoft's Windows Update error reference.

Notes

• The WindowsUpdate.log you generate is a point-in-time snapshot — it does not refresh on its own. Re-run Get-WindowsUpdateLog to capture newer activity.
• The first run on a device can be slow because it downloads the symbol files needed to decode the trace data; later runs are faster.
• For a quick look without generating a file, review Windows Update events in Event Viewer under Applications and Services Logs Microsoft Windows WindowsUpdateClient Operational.