How to Export a List of All Installed Windows Updates using PowerShell

Auditing Windows Server Patches

When an emergency zero-day vulnerability is announced, system administrators must rapidly verify if their servers have installed the critical security patch (often identified by a specific Knowledge Base number, like KB5022842). While you can open the “Windows Update” GUI and click “View update history,” this interface is slow, cannot be searched easily, and is useless if you need to generate a compliance report for a cybersecurity audit.

Instead, you can use PowerShell to instantly query the Windows Management Instrumentation (WMI) database to extract a perfectly formatted list of every hotfix and patch installed on the machine.

Using the Get-HotFix Cmdlet

The core command for this task is natively built into Windows PowerShell.

Get-HotFix

Running this command without any parameters will output a table directly in the terminal, displaying the HotFixID, the Description (e.g., Security Update), and the InstalledOn date for every patch applied to the operating system.

Filtering for a Specific Patch

If your Chief Information Security Officer (CISO) asks, “Did we install KB5022842 on the database server?”, you do not need to scroll through the massive list. You can ask PowerShell to find that specific ID.

Get-HotFix -Id "KB5022842"

If the patch is installed, PowerShell will return its details. If it is missing, PowerShell will return a stark red error stating Cannot find the requested hotfix, immediately alerting you that the server is vulnerable.

Exporting the Audit Report

To provide proof of compliance to an auditor, you need to export this data into a readable spreadsheet format (CSV). You can pipe the results of the Get-HotFix command directly into the Export-Csv cmdlet.

Get-HotFix | Select-Object HotFixID, Description, InstalledBy, InstalledOn | Export-Csv -Path "C:\Temp\ServerPatches.csv" -NoTypeInformation

This command grabs all updates, isolates the four most important columns of data, and writes them to a file named ServerPatches.csv in the Temp directory.

Querying Remote Servers

You don’t even need to log into the target server to run this audit. If you have administrator rights on your domain, you can query a remote server directly from your workstation using the -ComputerName parameter.

Get-HotFix -ComputerName "SQL-SRV-01" | Export-Csv -Path "C:\Temp\SQL-SRV-01-Patches.csv" -NoTypeInformation

Within seconds, you have a complete patch audit of a remote machine sitting in a clean Excel spreadsheet on your local desktop.