Troubleshooting Windows Update with a Little PowerShell Magic

Let’s suppose you’ve just joined a computer to a WSUS server, but Windows Update has decided it doesn’t feel like downloading patches today.

Naturally, your first instinct is to check the logs. But who wants to spend their afternoon digging through files looking for an error?

Fortunately, PowerShell can do the dirty work for us.

Back in the day, Windows Update maintained a nice, readable log file. Finding warnings was as simple as:

Get-ChildItem C:\Windows -Filter '*update*.log' -File -Recurse -ErrorAction SilentlyContinue |
    Select-String 'warning'

One line, and PowerShell searches for matching log files, reads their contents, and displays anything containing the word “warning.”

In my case, the result was rather revealing:

WARNING: Failed to find updates with error code 800B0001
WARNING: Digital Signatures are not trusted: Error 0x800b0001
WARNING: SelfUpdate check failed, error = 0x800B0001
WARNING: Skipping scan, self-update check returned 0x800B0001

Aha! There’s our culprit: 0x800B0001, pointing toward a digital signature verification issue.

But wait, it’s not 2013 anymore!

Modern Windows versions (Windows 10, Windows 11, and newer Windows Server releases) no longer maintain the same continuously updated text log. Instead, they use Event Tracing for Windows (ETW).

Not quite as convenient, but PowerShell still has our backs.

First, generate a readable log:

Get-WindowsUpdateLog -LogPath "$env:TEMP\WindowsUpdate.log"

Then search it:

Select-String "$env:TEMP\WindowsUpdate.log" -Pattern 'warning','error','failed'

Or, if you’re feeling particularly efficient, skip the log file altogether and query the Windows Update event log:

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-WindowsUpdateClient/Operational'
    Level = 2,3
} -MaxEvents 20 | Select-Object TimeCreated, Message

That retrieves up to 20 recent error and warning events, without opening Event Viewer.

And yes, these approaches work with Windows PowerShell 5.1 and modern PowerShell 7 versions.

One last trick

For traditional text logs that are actively being written, you can still watch for errors in real time:

Get-Content C:\Logs\Application.log -Tail 20 -Wait |
    Select-String 'warning','error'

Just remember that this trick doesn’t work directly with modern Windows Update’s binary ETW traces.

The moral of the story?

Windows Update may have changed how it keeps its secrets, but PowerShell is still remarkably good at getting them out.

Happy troubleshooting!