How to View and Export Installed Windows Updates History Using PowerShell in Windows 11

Maintaining a secure and stable Windows 11 operating system requires auditing patch levels and tracking which cumulative updates, security hotfixes, and driver updates have been applied. While the graphical Windows Settings app provides a basic update history panel, it can be slow to navigate and lacks native options to export or query specific patches. Using PowerShell, administrators and power users can quickly audit installed updates and export full reporting data into CSV or text format.

PowerShell provides built-in cmdlets and WMI classes capable of querying the Windows Component-Based Servicing architecture directly from the terminal without third-party software.

Viewing Installed Updates with Get-HotFix

The native Get-HotFix cmdlet is the quickest way to inspect recently installed Windows operating system patches, knowledge base (KB) identifiers, and installation dates.

1. Right-click the Start button on your Windows 11 taskbar and select Terminal (or PowerShell).
2. To list all installed hotfixes in the current session, type the following command and press Enter:

   Get-HotFix

3. To sort the list chronologically so the most recently installed updates appear at the top:

   Get-HotFix | Sort-Object -Property InstalledOn -Descending

4. To search for a specific Knowledge Base update number (for example, KB5044284) to confirm whether it is installed:

   Get-HotFix -Id KB5044284

Exporting Update History to a CSV File

To archive patch records for compliance, audits, or hardware inventory purposes, pipe the cmdlet output to Export-Csv:

Get-HotFix | Sort-Object -Property InstalledOn -Descending | Export-Csv -Path "$HOME\Desktop\WindowsUpdates.csv" -NoTypeInformation

This command exports a structured spreadsheet containing columns for Source, Description, HotFixID, InstalledBy, and InstalledOn directly to your desktop. You can open and review this CSV file immediately in Microsoft Excel.

For more terminal customisation techniques in Windows 11, check our guide on how to change the default startup profile in Windows Terminal.

Querying Complete Update History via WMI / CIM

While Get-HotFix primarily captures core operating system and security updates, you can also query the Win32_QuickFixEngineering class through the modern CIM infrastructure for enterprise scripting:

Get-CimInstance -ClassName Win32_QuickFixEngineering | Select-Object HotFixID, Description, InstalledOn | Format-Table -AutoSize

This approach works reliably in remote PowerShell sessions (Enter-PSSession or Invoke-Command) across networked computers on your local subnet.

Troubleshooting Missing or Incomplete Update Records

If PowerShell does not list expected updates, keep the following considerations in mind:

• Feature updates vs hotfixes: Major annual Windows 11 feature upgrades (such as updating from version 23H2 to 24H2) create a fresh operating system baseline. Hotfixes installed on the earlier OS build will not appear under Get-HotFix on the newer build, as their files have been superseded by the new OS image.
• Microsoft Store and driver updates: Get-HotFix reports Windows servicing stack and cumulative updates. Device drivers installed via Windows Update and application updates delivered via the Microsoft Store are tracked separately under Settings > Windows Update > Update history.
• Blank InstalledOn fields: Some servicing stack updates installed during initial OEM factory imaging may return an empty date value. This indicates the component was part of the slipstreamed base image rather than installed via Windows Update services.