Forum Discussion

endakelly's avatar
endakelly
Brass Contributor
Jan 02, 2020

How can I track Windows Update installation dates with Common Events and without Update Management?

We currently have servers forwarding logs to Azure via Security Center and the Microsoft Monitoring Agent. To reduce costs our log level is set to Common Events and we're using the North Europe regio...
Azure Log Analytics
azure monitor
Noa Kuperberg's avatar
Noa Kuperberg
Icon for Microsoft rankMicrosoft
Jan 06, 2020

endakelly 

Seems to me that Event ID 20 is what you're looking for...

Can you use these queries?

Event | where Source=="Microsoft-Windows-WindowsUpdateClient"

Event | where EventID == 20
 
  • endakelly's avatar
    endakelly
    Brass Contributor
    Jan 13, 2020

    Noa Kuperberg thanks for the reply.

     

    Unfortunately. that event does not appear if Security Center is set to the Common data tier. Is there a way to add just a specific event ID to this tier without switching to the All event data tier? I am hesitant to log all events due to the volume.

     

    Thanks,

     

    Enda

Resources