Windows Update Diagnostics Bundle

A read-only PowerShell collector that turns Windows Update event records, service state, reboot indicators, and installed hotfix metadata into one reviewable support bundle.

Why this exists

Current Windows versions store the detailed Windows Update trace in ETL files instead of maintaining a continuously readable WindowsUpdate.log. Microsoft provides Get-WindowsUpdateLog to create a static readable copy, while useful failure details also appear in Windows event logs. This project collects both layers without resetting components, stopping services, or installing updates.

Requirements

• Windows 10 or Windows 11
• Windows PowerShell 5.1 or PowerShell 7+
• Administrator rights are recommended for complete log access

No third-party modules are required.

Usage

Collect events, service state, reboot indicators, and hotfix metadata:

.\Export-WindowsUpdateDiagnostics.ps1

Also convert the current ETL traces and create a ZIP archive:

.\Export-WindowsUpdateDiagnostics.ps1 `
    -Days 30 `
    -IncludeMergedLog `
    -CreateZip

Get-WindowsUpdateLog can take several minutes. This collector deliberately does not use -ForceFlush, because Microsoft documents that option as stopping the Update Orchestrator and Windows Update services.

Collected data

• Windows Update Client operational and system events
• HRESULT-like error tokens found in event messages
• State and startup mode of update-related services
• Component servicing, Windows Update, and file-rename reboot indicators
• Installed hotfix IDs, descriptions, and dates
• Optional readable WindowsUpdate.log converted from ETL traces
• JSON, CSV, and Markdown summaries

The collector does not change update configuration or trigger an update scan.

Privacy

Textual output redacts the current user name, profile path, computer name, email-like strings, and Windows SIDs by default. The optional merged log is created as a temporary file, rewritten line by line to WindowsUpdate.redacted.log, and then the raw copy is removed.

Use -NoRedaction only for private troubleshooting. Review every generated file before sharing it; generic redaction cannot identify all possible personal or organization-specific values.

Testing

Run the dependency-free test suite:

.\tests\Run-Tests.ps1

GitHub Actions runs the tests in Windows PowerShell 5.1 and PowerShell 7.

References

• Windows Update log files
• Get-WindowsUpdateLog
• Get-WinEvent

License

MIT