Get Windows Update History Using PowerShell or CMD

Have you ever wondered which Windows updates are installed on your computer, when they were installed, or why a particular update failed? You can find this information without digging through multiple Windows settings pages. PowerShell and Command Prompt (CMD) give you additional ways to check Windows update information directly.

Windows Update History is useful when troubleshooting failed updates, checking whether a security patch was installed, or preparing to fix an update-related error. You can also use command-line tools to view installed update packages and retrieve update event logs.

The main thing to understand is that PowerShell and CMD do not provide exactly the same update history information. PowerShell can query update records through available Windows components, while CMD can help you list installed hotfixes and packages. For a more complete picture, you may need to combine these methods with the Windows Update history page.

In this guide, you’ll learn how to get Windows Update history using PowerShell or CMD in Windows 10 and Windows 11. 

Get Windows Update History Using PowerShell or CMD

To get Windows Update history using PowerShell, open PowerShell and query the Windows Update history API or review Windows Update event logs. 

To check installed updates using CMD, run wmic qfe list on systems where WMIC is available, or use systeminfo and dism commands for additional update information.

Keep in mind that installed hotfix listings do not necessarily include every update shown in Windows Update History. 

Some updates, such as certain Defender intelligence updates, driver updates, and feature updates, may require a different method to view their details.

Step 1: Open PowerShell as an Administrator

First, open PowerShell. This is where you’ll run commands to retrieve Windows update information.

Click the Start button or press the Windows key on your keyboard. Type PowerShell in the search box. When Windows PowerShell appears in the results, right-click it and select Run as administrator.

If a User Account Control prompt appears, click Yes to continue. You should now see a PowerShell window with a command prompt where you can enter commands.

Some history queries work without administrator privileges, but opening PowerShell as an administrator can help when you’re inspecting system logs or other protected information.

If you’re using Windows 11, you may see Windows Terminal instead. You can open it as an administrator and select a PowerShell tab. The commands in this guide will work in a standard PowerShell session unless a step says otherwise.

Step 2: View Windows Update History Using PowerShell

PowerShell can retrieve Windows Update history through the Windows Update Agent COM interface. This is useful when you want to see the updates recorded by the Windows Update service, including their titles and installation results.

In the PowerShell window, copy and paste the following command:

$Session = New-Object -ComObject Microsoft.Update.Session

Press Enter. This creates a session for communicating with the Windows Update Agent.

Next, enter:

$History = $Session.CreateUpdateSearcher().QueryHistory(0, 50)

Press Enter again. This retrieves up to 50 recent update history entries.

Now display the results by running:

$History | Select-Object Date, Title, ResultCode

PowerShell will display the update date, update title, and result code. You can use the title to identify the update and the date to see when it was recorded.

The ResultCode value indicates the outcome of the update operation. Common values include 2 for succeeded, 3 for succeeded with errors, 4 for failed, and 5 for aborted. A result code describes the recorded operation, not necessarily the current status of the update on your PC.

If you want to retrieve more than 50 entries, replace 50 with a larger number. For example, use 100 to query up to 100 records.

Step 3: Display Update History in a More Readable Format

The previous command provides the basic information. However, you may prefer a more readable view when checking several updates or troubleshooting a failed installation.

In PowerShell, run this command:

$History | Select-Object Date, Title, ResultCode | Format-Table -AutoSize -Wrap

This displays the date, title, and result code in a table. The -AutoSize option adjusts column widths, while -Wrap helps display longer update titles across multiple lines.

If you only want to see updates that failed, run:

$History | Where-Object {$_.ResultCode -eq 4} | Select-Object Date, Title, ResultCode

PowerShell will filter the results and display entries with a failed result code.

If no entries appear, it does not necessarily mean Windows has never experienced an update problem. The history query may not contain the failed operation you’re investigating, or the relevant details may be available in another log.

Step 4: Export Windows Update History to a CSV File

If you want to save your Windows Update history for future reference, PowerShell can export the results to a CSV file. You can open this file in Microsoft Excel or another spreadsheet application.

Run the following command:

History|Select-ObjectDate,Title,ResultCode|Export-Csv”env:USERPROFILE\Desktop\WindowsUpdateHistory.csv” -NoTypeInformation

Press Enter and wait for PowerShell to finish.

Open your desktop and look for a file named WindowsUpdateHistory.csv. Double-click it to open the file in Excel or another compatible application.

The exported file contains the update dates, titles, and result codes from the history query. You can sort the records by date, search for an update title, or share the file with a support technician.

If the file does not appear on your desktop, check that the command completed without an error and that your Windows profile uses the expected desktop location.

Step 5: Get Installed Updates Using Command Prompt (CMD)

If you prefer Command Prompt, you can use it to check installed hotfixes. This method is helpful when you want to verify whether certain Windows updates are installed.

Open the Start menu, type Command Prompt, right-click the result, and select Run as administrator.

Enter the following command:

wmic qfe list

Press Enter and wait for the results.

If WMIC is available on your system, CMD will display installed hotfix information, including details such as the hotfix ID, description, and installation date.

To make the output easier to read, run:

wmic qfe list brief

This displays a shorter list of installed hotfixes.

However, WMIC is deprecated and may not be available on newer Windows installations. If CMD reports that wmic is not recognized, don’t worry. You can use PowerShell or DISM instead.

Also, remember that the hotfix list is not a complete copy of Windows Update History. It mainly reports updates represented as hotfixes, so some update types may not appear.

Step 6: Check Installed Updates Using PowerShell

If WMIC isn’t available, PowerShell provides a straightforward alternative for listing installed hotfixes.

Open PowerShell and run:

Get-HotFix

Press Enter and review the output.

You’ll typically see the hotfix ID, description, installation date, and the account associated with the installation when that information is available.

To display only the most useful columns, run:

Get-HotFix | Select-Object HotFixID, Description, InstalledOn

This command produces a cleaner list that is easier to read.

If you’re looking for a particular update, replace the general command with a filtered query. For example:

Get-HotFix -Id KB503xxxx

Replace KB503xxxx with the actual KB number you want to check. The example is a placeholder, not a real update identifier.

If PowerShell returns an error saying the hotfix cannot be found, the update may not be represented in the hotfix inventory. Check Windows Update History or use the DISM method below before concluding that the update is missing.

Step 7: Check Windows Update Event Logs

When you’re troubleshooting an update that failed, event logs can provide additional information about what happened.

Press Windows + R, type eventvwr.msc, and press Enter to open Event Viewer.

Expand Applications and Services Logs, then open Microsoft > Windows > WindowsUpdateClient > Operational.

Review the events listed in the log. Select a recent event to view its details, including the event ID, timestamp, and message. Look for warnings or errors that occurred around the time the update failed.

You can also query the Windows Update Client operational log through PowerShell. For example, run:

Get-WinEvent -LogName “Microsoft-Windows-WindowsUpdateClient/Operational” -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-List

This command displays up to 50 recent events with their timestamps, IDs, severity levels, and messages.

Some events may be informational rather than errors. Focus on messages that match the time of the failed update, and use the event details to narrow down the cause.

Check Installed Windows Packages Using DISM

DISM is another Windows command-line tool that can list installed packages. It is useful when you need more information about packages installed in the operating system.

Open Command Prompt as administrator and run:

DISM /Online /Get-Packages /Format:Table

Press Enter and wait for the command to finish.

Windows will display a list of packages, their package identities, and their states. Depending on your Windows version, the output may include servicing packages and other system components.

To inspect a particular package, copy its full package identity from the results and run:

DISM /Online /Get-PackageInfo /PackageName:”PACKAGE_ID”

Replace PACKAGE_ID with the exact package identity you copied. Keep the quotation marks around the name, especially if it contains special characters.

DISM package information is different from Windows Update History. A package may represent a component or servicing update rather than a single update-history entry. Use this method when you need to investigate installed packages, not as a replacement for every update record.

FAQs

1. Can I view Windows Update history without opening Settings?

Yes. PowerShell can query update history through the Windows Update Agent, and PowerShell or CMD can list certain installed updates. You can also inspect Windows Update event logs for troubleshooting details.

2. What is the difference between Get-HotFix and Windows Update History?

Get-HotFix lists updates represented in the Windows hotfix inventory. Windows Update History records update operations and may include items that do not appear in the hotfix list. The two lists are related, but they are not identical.

3. Why does WMIC not work on my Windows 11 PC?

WMIC is deprecated and may be removed or unavailable in newer Windows installations. Use Get-HotFix in PowerShell to list installed hotfixes, or use the Windows Update Agent query to view update history.

4. Can I check failed Windows updates using PowerShell?

Yes. Query update history and filter entries with a ResultCode of 4 to find operations recorded as failed. You can also inspect Windows Update Client event logs for additional error information.

5. Can I save Windows Update history for later?

Yes. Use PowerShell’s Export-Csv command to save the date, title, and result code of retrieved update-history entries to a CSV file. You can then open the file in Excel.

Summary

Getting Windows Update history using PowerShell or CMD is a practical way to check installed updates and troubleshoot update problems.

Use the Windows Update Agent query in PowerShell when you want to view recent update operations and their result codes. Use Get-HotFix or CMD’s wmic qfe list command to check installed hotfixes, and use Event Viewer or Get-WinEvent when you need more details about update failures.

For package-level information, DISM can show installed Windows packages and their states.