I manage Windows 11 Pro for Workstations running version 24H2 on standalone systems at a military base. Because the machines are on isolated networks, monthly security updates are downloaded through an approved process, burned to disk, and installed manually. The systems have been patched regularly for more than a year, but I occasionally need to demonstrate that history to an auditor.
Windows 10 displayed a much longer update history, including many Microsoft Office updates. On Windows 11, the Settings history appears to show only about the past two months and mostly lists major security updates. I have also tried `wmic qfe list brief`, `Get-HotFix`, and `Get-CimInstance -Class Win32_QuickFixEngineering`, but the results are similarly limited or produce an error. Is there a reliable way to retrieve or export the older update history?
4 Answers
`Get-HotFix` and `Win32_QuickFixEngineering` are not a complete record of every update, especially Office updates and some servicing-stack or cumulative-update details. The Windows Update history query is a better option, but its results still depend on the local update database remaining intact. For an audit, combine that output with the installed-update list and your approved patch media or installation records.
Windows Update has a PowerShell history available through the Microsoft Update Session COM object. Try running this locally:
`(New-Object -ComObject 'Microsoft.Update.Session').QueryHistory('',0,500)`
The second number controls how many entries are returned, so increase it if necessary. You can also format or export the results to a file for documentation. This may include updates that do not appear in `Get-HotFix`.
The Settings app normally has the complete history under Windows Update > Update history, but the visible list is not guaranteed to be permanent. Windows can remove older entries when its update database or the `SoftwareDistribution` folder is reset or recreated. If that has happened, the old display history may no longer be recoverable from that interface.
That may explain why my systems only show the last couple of months. I will check whether the update database or SoftwareDistribution folder is being cleaned up.
Windows updates are cumulative, so the newest cumulative update generally supersedes earlier updates in the same category. For future audits, run an inventory command after each monthly patch cycle and save the output as a dated file. That gives you a rolling record even if Windows later trims its built-in history.
So the updates from the past year may not be available in the current history, but I can start preserving a record after each update going forward?
If the network blocks documentation sites, the command itself should still work because it queries the local update database rather than contacting an outside service.