Understanding the Event Log Source
The primary source for update information on modern Windows systems is the Microsoft-Windows-WindowsUpdateClient/Operational event log. While the Settings app provides a user-friendly view, it does not offer a direct export feature for plain text lists. By accessing the underlying event log, you can extract precise data about what was installed, when, and with what result.
This method relies on two key event identifiers. Event ID 19 indicates that an update was successfully installed, while Event ID 20 signifies that an installation failed. By filtering for these specific events, you can create a comprehensive history of all update activities on your machine.
Executing the PowerShell Command
To generate the desired output, open PowerShell as an administrator. This elevation is necessary because reading system event logs requires elevated privileges. Once the console is open, you can use the Get-WinEvent cmdlet to query the log.
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WindowsUpdateClient/Operational'; Id=19} | Select-Object -Property TimeCreated, Message | Format-ListThe command above filters the log for successful installations (ID 19). The Select-Object parameter ensures that only the timestamp and the message content are returned, stripping away unnecessary XML metadata. However, this initial output may still contain multiple lines per update due to the structure of the Message property.
Formatting Output for Plain Text
To achieve the "one update per line" requirement, you need to process the message field more aggressively. The following script retrieves both successful and failed updates, formats them into a single string, and outputs them cleanly.
$updates = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WindowsUpdateClient/Operational'; Id=@(19,20)} -ErrorAction SilentlyContinue
foreach ($update in $updates) {
$time = $update.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')
$msg = $update.Message -replace '\r\n', ' ' -replace '\s+', ' '
Write-Output "$time - $msg"
}This script iterates through each event, extracts the creation time, and cleans up the message text by removing newlines and collapsing multiple spaces. The result is a stream of text where each line represents a distinct update event. You can redirect this output to a file using the > operator if you wish to save it.
Handling Large History Sets
If your system has been running for several years, the event log may contain thousands of entries. Processing all of them at once can be slow and may consume significant memory. To mitigate this, you can limit the query to recent dates or a specific number of events.
For example, adding -MaxEvents 50 to the Get-WinEvent command will only retrieve the most recent 50 updates. This is useful for quick checks or when generating reports for troubleshooting recent issues. If you suspect a specific update caused problems, such as those discussed in our guide on Windows 10 Update Stuck: XX% - Fixes, focusing on recent events is often more effective than reviewing the entire history.
Alternative Methods
While PowerShell is the most flexible tool, some users prefer using the wusa.exe utility. Running wusa /uninstall:<KBNumber> allows you to uninstall specific updates, but it does not provide a history list. Another option is the systeminfo command, which lists installed hotfixes, but it lacks timestamps and detailed status messages.
For users who frequently manage update histories, combining this PowerShell script with scheduled tasks can automate the generation of daily or weekly reports. This ensures you always have a plain text record available for auditing purposes.
Common Issues and Troubleshooting
Sometimes, the event log may be empty or inaccessible. This can happen if the Windows Update service is disabled or if the log has been cleared. Ensure that the Wuauserv service is running. Additionally, if you encounter permission errors, double-check that you are running PowerShell with administrative rights.
In rare cases, corrupted event logs can cause Get-WinEvent to fail. If this occurs, you may need to clear the log via the Event Viewer or restart the service. For more complex system issues, such as kernel failures, refer to our article on Resolving Kernel Security Check Failure to ensure your system integrity is not compromised.
Frequently Asked Questions
How do I save the output to a text file?
You can append > C:\UpdateHistory.txt to the end of your PowerShell command. This redirects the standard output to a file named UpdateHistory.txt in the root of your C drive. Ensure the path is writable by your current user account.
Can I filter updates by a specific date range?
Yes, you can add -StartTime and -EndTime parameters to the Get-WinEvent cmdlet. For example, -StartTime (Get-Date).AddDays(-7) will only return updates from the last seven days. This helps narrow down the results for recent troubleshooting.
Why are some updates missing from the list?
Some minor updates or driver installations may not generate Event ID 19 or 20 in the client log. They might be recorded elsewhere or handled silently. Additionally, if the log was manually cleared, historical data will be lost. Regular backups of the event log are recommended for complete auditing.
Is this method compatible with Windows Server?
Yes, the same PowerShell commands work on Windows Server editions. The event log structure is consistent across client and server versions of Windows. However, server environments may have different update policies, so the volume of events might vary significantly.
What should I do if the PowerShell command returns no results?
First, verify that the event log exists by checking Event Viewer under Applications and Services Logs. If the log is present but empty, ensure the Windows Update service is active. If the log is missing entirely, you may need to enable it via Group Policy or re-register the event provider.