When a Windows update fails, the answer is almost always in the logs — but in Windows 11 and 10 those logs aren't a single text file anymore. This guide shows you exactly where Windows Update logs live and the three ways to read them, plus where to look when a feature upgrade (not just a regular update) fails.
Quick answer: Open PowerShell and run
Get-WindowsUpdateLog. It merges the binary trace logs fromC:\Windows\Logs\WindowsUpdate\into a single readableWindowsUpdate.logfile on your Desktop. For a quick history without PowerShell, openC:\Windows\SoftwareDistribution\ReportingEvents.log, or check Event Viewer.
Where Are Windows Update Logs Stored?
Since Windows 10, Microsoft changed how update logging works, so there are a few different places depending on what you need:
| Source | Location | Best for |
|---|---|---|
| ETL trace logs | C:\Windows\Logs\WindowsUpdate\*.etl |
Full detail (binary — read with Get-WindowsUpdateLog) |
| ReportingEvents.log | C:\Windows\SoftwareDistribution\ReportingEvents.log |
A quick, readable milestone history |
| Event Viewer | WindowsUpdateClient logs | A GUI view of successes and failures |
| Upgrade/setup logs | C:\Windows\Panther\ |
Failed feature upgrades (e.g. 22H2 → 23H2) |
Method 1: Get-WindowsUpdateLog (PowerShell)
This is the main method. In Windows 10 and 11, the detailed update logs are written as ETL (Event Trace Log) files in C:\Windows\Logs\WindowsUpdate\, which aren't human-readable on their own. The Get-WindowsUpdateLog cmdlet decodes and merges them into one plain-text file.
Open PowerShell as administrator and run:
Get-WindowsUpdateLog
By default this creates WindowsUpdate.log on your Desktop. To send it somewhere specific:
Get-WindowsUpdateLog -LogPath "C:\Temp\WindowsUpdate.log"
Open the resulting file in Notepad and search for FATAL, error, or an 0x8024... code to find where the update broke.
Method 2: ReportingEvents.log (Quick History)
If you just want a fast, readable timeline of update activity without running PowerShell, open this file directly:
C:\Windows\SoftwareDistribution\ReportingEvents.log
Each line records a milestone — agent started, update found, download started, installation succeeded or failed — with a timestamp and a result code. It's less detailed than the full Get-WindowsUpdateLog output but excellent for a quick "what happened and when."
Method 3: Event Viewer
Event Viewer gives you a GUI view of update results, which is handy when you don't want to read raw logs.
The simplest view — the System log:
- Open Event Viewer (search for it in the Start menu).
- Go to Windows Logs → System.
- Filter the current log by the source WindowsUpdateClient.
Look for these key Event IDs:
- Event ID 19 — update installed successfully
- Event ID 20 — update installation failed (the description includes the error code)
- Event ID 43 / 44 — download/installation started
For more detail — the Operational log:
Event Viewer → Applications and Services Logs → Microsoft → Windows → WindowsUpdateClient → Operational
What Happened to C:\Windows\WindowsUpdate.log?
If you're looking for the old C:\Windows\WindowsUpdate.log text file, it's effectively gone. Before Windows 10 this single file held all update logging. From Windows 10 onward, Windows switched to ETL tracing, and the file at that path is now just a placeholder that tells you to run Get-WindowsUpdateLog instead. So on Windows 11 and 10, Get-WindowsUpdateLog is the replacement for the classic WindowsUpdate.log.
Windows Update Logs vs Windows Upgrade (Setup) Logs
This trips a lot of people up. A monthly quality update and a feature upgrade (for example, moving from Windows 11 22H2 to 23H2, or Windows 10 to 11) are logged in completely different places. If a feature upgrade fails, the logs above won't have the answer — look in the Panther folders instead:
| Stage | Log location |
|---|---|
| After upgrade (succeeded or rolled back) | C:\Windows\Panther\setupact.log and setuperr.log |
| During upgrade (in progress) | C:\$WINDOWS.~BT\Sources\Panther\setupact.log |
setupact.log is the detailed action log; setuperr.log contains only the errors, so check it first. These are the files to read when an upgrade rolls back with an error code like 0xC1900101.
Converting Raw ETL Logs Manually
Get-WindowsUpdateLog is the recommended way to read the ETL files, but if you need to convert a single .etl file manually you can use the built-in tracerpt tool:
tracerpt "C:\Windows\Logs\WindowsUpdate\WindowsUpdate.20260101.000000.000.1.etl" -o "C:\Temp\readable.xml"
In almost all cases, though, Get-WindowsUpdateLog is faster and produces a cleaner, merged result.
Finding Why an Update Failed
When an update fails, work through the logs in this order:
- Event Viewer → System — find the Event ID 20 entry and note the error code (for example
0x8024402cor0x80073712). - Get-WindowsUpdateLog — open the generated
WindowsUpdate.log, search for that code or forFATALto see the failing step in context. - Research the code — search the specific error code; many have known fixes. For example, see our guide on troubleshooting Windows Update error 0x8024402c.
Frequently Asked Questions
Where is the Windows Update log located in Windows 11?
The detailed logs are ETL trace files in C:\Windows\Logs\WindowsUpdate\. Run Get-WindowsUpdateLog in PowerShell to merge them into a readable WindowsUpdate.log on your Desktop. A quick readable history is also available at C:\Windows\SoftwareDistribution\ReportingEvents.log.
How do I read the Windows Update log?
Run Get-WindowsUpdateLog in an elevated PowerShell window. It produces WindowsUpdate.log on your Desktop, which you can open in Notepad and search for FATAL or an 0x8024... error code.
Why can't I find C:\Windows\WindowsUpdate.log?
Since Windows 10, that classic single log file was replaced by ETL tracing. The path may still exist as a placeholder pointing you to Get-WindowsUpdateLog, which is now the supported way to generate a readable update log.
How do I see Windows Update history in Event Viewer?
Open Event Viewer → Windows Logs → System and filter by the source WindowsUpdateClient. Event ID 19 means an update installed successfully; Event ID 20 means it failed and includes the error code. For more detail, see Applications and Services Logs → Microsoft → Windows → WindowsUpdateClient → Operational.
Where are the logs for a failed Windows 11 upgrade?
Feature upgrade logs are separate from update logs. Check C:\Windows\Panther\setuperr.log (errors only) and setupact.log (full detail) after the upgrade, or C:\$WINDOWS.~BT\Sources\Panther\ while an upgrade is in progress.
Do these methods work on Windows 10?
Yes. Get-WindowsUpdateLog, ReportingEvents.log, Event Viewer, and the Panther upgrade logs all work the same way on Windows 10 and Windows 11.