SOLVED: How To Determine The Source Of Your Windows Updates on Windows 10

UPDATE: VALIDATED THIS PROCESS ON WINDOWS 10 1909 – SEPT 18 2020

If you have Windows 10 clients on a WSUS server and you want to confirm that they are receiving patches from that WSUS server and not going directly to Microsoft to update, you used to just read the %SystemRoot%\WindowsUpdate.log.  Under Windows 10 however, that log now looks like:

Windows Update logs are now generated using ETW (Event Tracing for Windows).
Please run the Get-WindowsUpdateLog PowerShell command to convert ETW traces into a readable WindowsUpdate.log.
For more information, please visit http://go.microsoft.com/fwlink/?LinkId=518345

This is quite frustrating because it is the only way to easily confirm that your clients are taking updates from WSUS.  The really good news is that when you run the command they suggest to build a log, it requires a “symbols” to be installed which is just another big pain in the butt.  To get around this I found a blog that suggested the following command in POWERSHELL (ADMIN):

 wuauclt /detectnow

Get-WindowsUpdateLog -SymbolServer https://msdl.microsoft.com/download/symbols -LogPath C:\windowsupdate.log

UPDATE: Oct 13, 2016: Microsoft Partner Support tells me that at least on Windows 10, specifying the SYMBOL SERVER is not required as it will automatically pull down any missing symbols without the switch so you can use:

wuauclt /detectnow

Get-WindowsUpdateLog -LogPath C:\windowsupdate.log

I have tested this and found it definitely works on Windows 10 1607.

If you want to run this on a remote machine use:

Get-WindowsUpdateLog -ETLPath \\<HOSTNAME>\C$\windows\Logs\WindowsUpdate -SymbolServer https://msdl.microsoft.com/download/symbols -LogPath C:\LOGS\windowsupdate_<HOSTNAME>.log

You can then open the log with notepad and look for “WSUS” like:

…
2016-09-22 15:08:04.9264690 724   25384 Agent           WSUS server: http://ch-ms:8530
2016-09-22 15:08:04.9264694 724   25384 Agent           WSUS status server: http://ch-ms:8530
2016-09-22 15:08:04.9264697 724   25384 Agent           Target group: (Unassigned Computers)
…

or the URL of your WSUS Server like:

…
2016-09-22 15:08:05.9325837 724   24984 ProtocolTalker  ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCBB7}, Server URL = http://ch-ms:8530/ClientWebService/client.asmx
…

If you want to look further into your Windows 10 client’s you can check the registry to see what it:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

but that is only a confirmation that your Windows 10 PC received the registry entries from your GPO… not that it is paying attention to that GPO.  For instance, I am currently troubleshooting all my customers Windows 10 Enterprise 1607 Anniversary PC’s that have the GPO applied (according to GPRESULT /R) and the correct registry entry but NOT taking updates from WSUS.  When I find an answer, I will post it here.