What WU Methods actually write the Update History in Win 10/11

All

Been reviewing different "methods" to better manage Windows updates for a small office layout that I manage. There are a couple of servers along with about a dozen Win 10/11 workstations.

For the last several years - I stood up a WSUS server and it's been fine, but I am starting to wonder about the longer term as it seems that MS has long since given up on this.

My layout is too small for InTune and definitely not a candidate for something like Software Center/Configuration Manager. But not small enough to just let users click "Check for Updates" on a non-managed Windows Update on the workstations.

I am now testing ManageEngine Endpoint Central and Powershell scripting using PSWindowsUpdate (which is actually quite good).

But my question today revolves around the OS actually "recording" what updates have been applied to a specific machine - the data that usually appears under "Settings->Windows Update->Update History.

When I install updates via WSUS - there is a full history entry for each update - just as would appear if I did the update manually by clicking "Check for Updates->Install".

When I install updates via ManageEngine Endpoint Central - there is a "basic" entry for each update - listing something like (Security Update KB5043226) or similar. Not as good as the MS entry but better than nothing.

Finally - when I install updates via Powershell scripting using PSWindowsUpdate - there is nothing at all in the Update history area. I am assuming that the system knows it is up to date - but I have no way of confirming this.

Knowing what has been installed to a machine is valuable but I am wondering if anyone knows what actually process does the "updating" of this Update History database when it records a specific update installation.

Cheers

Sonic.

Maybe this Microsoft How Windows Update works article will help explain the process?

Reading between the lines it appears that it's Orchestrator's 'arbiter' process that makes the decisions and, presumably, logs the updates in the order it schedules them for installation?

Hope this helps...

USO (Orchestrator) does the work of logging Update History.

1. Windows Update -> USO
2. WSUS is WU using an internal staging server, but still -> USO
3. PSWindowsUpdate and a few of the old scripts use DLL functions to install updates. Presumably the direct functions don't update the formal history.
4. No idea how ManageEngine does updates.

garlin said:

USO (Orchestrator) does the work of logging Update History.

1. Windows Update -> USO
2. WSUS is WU using an internal staging server, but still -> USO
3. PSWindowsUpdate and a few of the old scripts use DLL functions to install updates. Presumably the direct functions don't update the formal history.
4. No idea how ManageEngine does updates.

Fascinating article in this - and yes - makes total sense.

My takeaway is any use of tech that is not the stock OS Windows Update OR WSUS will result in no "standard" update history.

In the grand scheme of things - it's not a huge deal. I need to focus on the method that results in solid, timely (and controlled) patching with the least amount of manual work - while ensuring the endpoints are up to date and working correctly.

History would be nice to have - but it's definitely not a deal breaker.

Cheers!

Sonic.

Try3 said:

What an interesting article about all the cogs & wheels within WU.

You are very welcome. I found it a fascinating insight.

Try3 said:

I have not found any omissions in the Event viewer records.

I use three Event viewer, Custom views of WU events. This file contains the view definitions
EventViewer, Custom views, WU.zip
To import each one:
1 Unzip the file

Before importing them, you can read each unzipped xml file in Notepad or, for a better presentation of its contents, by right-clicking and opening in a browser.

2 Open Event viewer, click on Import Custom view [on the right-hand side],
3 Browse to and select the xml, Open,
4 Change the name if you want to then OK,
5 You can see the records, on the left-hand side, within the group Custom views.

You can then select each Custom view in Event viewer's left-hand pane.


All the best,
Denis

Denis

Thanks! Will give this a try.

Sonic.