Windows update log syntax has changed

The windows update log (under C:\Windows\WindowsUpdate.log) has changed in Windows 2012, as compared with Windows 2008 server.

So for checking when the next install will happen, search for this text:

2012 says:
scheduled install attempt time

Note that this is in GMT but the timestamps are local server time.

2008 says:
Setting AU scheduled install time

To find when the server will be rebooted search for this text:

invoking RebootSystem

Bypass WSUS to install Windows updates

While trying to setup a Windows 2012 cluster (to be used by Hyper-V) I ran into an issue where the cluster validation tool failed. it said that the MPIO software versions were different on the nodes. Upon searching the net, I found the solution was to install all Windows updates.

Unfortunately our WSUS server was not working properly. Every time I would run “Download and install Updates” manually on the Hyper-V Server 2012 (core) using the server configuration screen (no GUI) I would get a message that all updates are already installed.

I had to bypass WSUS by running these commands:

REG ADD “HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU” /v UseWUServer /t REG_DWORD /d 0 /f
net stop “Windows Update”
net start “Windows Update”

After this I was able to check and install updates manually.


1. There is  no need to delete or modify this key after you are done installing the updates directly. After a reboot or whenever the Group policy gets re-applied, the key will change back to 1 (enabling WSUS again)

2. There is another tool available called WUinstall I used it on another server. It has a switch to bypass WSUS temporarily and install updates from the internet. Note that this software is available on a “Trial” basis only. I hear at some point in the past, they had a free version also….but I could not find that free version.