I'm parsing history.log from debian hosts to produce a csv with dates/packages/versions. After running a suite of tests in testing environment, I then update those packages on actual hosts.

I want to do the same thing for Windows Server.
I have generated a .log file using Get-WindowsUpdateLog PowerShell command but apparently, I can't get any useful info out of there, except timestamps. As far as I understood, to be able to see lines in log that actually correspond to installation sessions (packages X,Y & Z installed on this date), I need to enable verbose Windows Update Logs, but how do I do that? I also need to know the actual name of update, not ID. AFAIK, I can manually copy the Update IDs into Microsoft Update Catalog, but I'd like to avoid that. Could enabling verbose logging solve this too? Or it would be too easy?


Use the nice PSWindowsUpdate Powershell Module from PowerShell Gallery: link

There you have a command Get-WUHistory which does want you are looking for.


According to a quick search "Windows Update Logs" (I haven't come across this until this query), it looks like the Windows Update client now uses Event Tracing for Windows (ETW) to generate diagnostic logs. These are saved in binary file format ETL though.

However, how old is your Windows OS?

You can either view ETL files, or you can use a log collector such as NXLog (am involved in that project) to collect ETW data and write them out as JSON messages. Usually you need to find out what the ETW Provider name is to start logging them. For example, Microsoft-Windows-WindowsUpdateClient is the name of the ETW Provider for Windows Server 2016.

  • Get-WindowsUpdateLog will convert ETL to textfiles. That's what OP did. The log just doesn't contain the info he is looking for. – duenni Apr 12 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.