Windows Update: Does Windows record which updates are installed? If so, where?

Question

Particularly interested in Windows XP, but all versions of Windows would be useful (if they differ).

EDIT: How does Windows/Windows Update know what to apply and what it has already done? Does it compare .dll/.exe versions or something else?

score 3 · Answer 1 · edited Aug 31 '11 at 05:56

3

There is a log file located at %windir%\Windowsupdate.log which should have all information about updates performed on the system. Alternatively you could check the Add/Remove programs dialog and check off the Show Updates checkbox to see which ones are installed.

alt text

edited Aug 31 '11 at 05:56

Gaff

18,569
15
57
68

answered Mar 02 '10 at 16:49

John T

163,373
27
341
348

However, WindowsUpdate.log can be deleted. So can the %WINDIR%\Software Distribution\ directory which contains WU downloads. Add/Remove Progs doesn't seem to contain all updates (for example, the Malicious Software Removal Tool). – Umber Ferrule Mar 02 '10 at 17:18

score 1 · Answer 2 · edited Aug 31 '11 at 05:57

1

When you click on Windows Update in XP, you'll see a link to view your update history.

alt text

edited Aug 31 '11 at 05:57

Gaff

18,569
15
57
68

answered Mar 02 '10 at 17:53

raven

5,355
7
39
51

Interesting - I never knew you could review this here. However, it doesn't necessarily list all WU. – Umber Ferrule Mar 02 '10 at 22:02

score 0 · Accepted Answer · answered Mar 03 '10 at 13:23

I've just come across the following Microsoft web page which sheds some light on the question: Command-line switches for Windows software update packages

Under the heading, Overview of the installation process, it states:

The [hotfix] installation program registers the software update under one of the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Updates\<operating system>\<service pack level>\KB<nnnnnn>

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Hotfix\Q<nnnnnn>

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Hotfix\KB<nnnnnn>

and

Removal information for the software update is stored in a hidden folder named:

$NtUninstallQnnnnnn$ or $NtUninstallKBnnnnnn$ in %Systemroot%

Windows Update: Does Windows record which updates are installed? If so, where?

3 Answers3