Windows Server 2016 — WindowsUpdate.log conversion fails because ETW decoder cannot find symbols — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Get-WindowsUpdateLog on Windows Server 2016 produces an empty or partial WindowsUpdate.log file, hampering update troubleshooting.

Environment & Reproduction

Reproduces on servers without internet egress or where the SymbolServer parameter is misconfigured.

Get-WindowsUpdateLog -LogPath C:logsWindowsUpdate.log

Root Cause Analysis

The cmdlet downloads symbols from msdl.microsoft.com to decode ETW traces; without access it cannot resolve provider events.

Quick Triage

Inspect Get-WindowsUpdateLog with -Verbose to confirm symbol resolution failure.

Get-WindowsUpdateLog -Verbose 2>&1 | Tee-Object C:logswulog-verbose.txt

Step-by-Step Diagnosis

Validate connectivity to msdl.microsoft.com and SymbolServer setting.

Test-NetConnection msdl.microsoft.com -Port 443

Solution — Primary Fix

Allow outbound HTTPS to msdl.microsoft.com or supply an offline symbol store path.

Get-WindowsUpdateLog -SymbolServer 'SRV*C:symbols' -LogPath C:logsWindowsUpdate.log

Solution — Alternative Approaches

Use Tracelog.exe with locally cached PDBs when full internet egress is forbidden.

tracelog.exe -merge C:WindowsLogsWindowsUpdate*.etl C:logsmerged.etl

Verification & Acceptance Criteria

WindowsUpdate.log contains decoded entries with readable component names.

Get-Content C:logsWindowsUpdate.log | Select-Object -First 50

Rollback Plan

No code rollback required; restore previous log generation method if the new symbols cause issues.

# Revert SymbolServer override

Prevention & Hardening

Maintain an internal symbol cache shared via UNC for offline servers.

# Sync symbols periodically using symchk.exe

Related Errors & Cross-Refs

Related: ETL parsing errors, missing trace providers, and update diagnostics tool failures.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn documentation on Get-WindowsUpdateLog and symbol server configuration.