Skip to main content

Windows Server Update Services (WSUS)

Log NameEvent IDSeverityDescription
Microsoft-Windows-UpdateServices-Server/Operational1000InfoWSUS service started successfully
Microsoft-Windows-UpdateServices-Server/Operational1001MediumWSUS service stopped
System7031HighWSUS Service terminated unexpectedly
Microsoft-Windows-UpdateServices-Server/Operational1200InfoWSUS configuration initialized successfully
Microsoft-Windows-UpdateServices-Server/Operational1201CriticalConfiguration corrupted or inaccessible
Microsoft-Windows-UpdateServices-Server/Operational1202HighDatabase connection failed
Microsoft-Windows-UpdateServices-Server/Operational1300InfoSynchronization started
Microsoft-Windows-UpdateServices-Server/Operational1301InfoSynchronization completed successfully
Microsoft-Windows-UpdateServices-Server/Operational1302HighSynchronization failed
Microsoft-Windows-UpdateServices-Server/Operational1303MediumSync partially completed (some updates skipped)
Microsoft-Windows-UpdateServices-Server/Operational1304MediumUpdate metadata download failed
Microsoft-Windows-UpdateServices-Server/Operational1305CriticalCatalog integrity validation failed
Microsoft-Windows-UpdateServices-Server/Operational1306InfoWSUS subscription settings updated
Microsoft-Windows-UpdateServices-Server/Operational1400InfoUpdate approved for deployment
Microsoft-Windows-UpdateServices-Server/Operational1401InfoUpdate declined
Microsoft-Windows-UpdateServices-Server/Operational1402MediumUpdate failed to install on clients
Microsoft-Windows-UpdateServices-Server/Operational1403InfoUpdate superseded or expired
Microsoft-Windows-UpdateServices-Server/Operational1404HighUpdate file missing or corrupt
Microsoft-Windows-UpdateServices-Server/Operational1405CriticalUpdate approved by unauthorized account
Microsoft-Windows-UpdateServices-Server/Operational1500InfoClient check-in initiated
Microsoft-Windows-UpdateServices-Server/Operational1501InfoClient status report received
Microsoft-Windows-UpdateServices-Server/Operational1502MediumClient failed to report status
Microsoft-Windows-UpdateServices-Server/Operational1503MediumClient version mismatch
Microsoft-Windows-UpdateServices-Server/Operational1504HighClient computer unregistered
Microsoft-Windows-UpdateServices-Server/Operational1505HighUnauthorized client attempted connection
Microsoft-Windows-UpdateServices-Server/Operational1600InfoDatabase maintenance completed successfully
Microsoft-Windows-UpdateServices-Server/Operational1601MediumDatabase cleanup failed
Microsoft-Windows-UpdateServices-Server/Operational1602MediumHigh database latency detected
Microsoft-Windows-UpdateServices-Server/Operational1603CriticalDisk space running low on WSUS content folder
Microsoft-Windows-UpdateServices-Server/Operational1604HighWSUS pool memory exceeded threshold
Microsoft-Windows-UpdateServices-Server/Operational1605MediumIIS connection timeout detected
Security4624InfoSuccessful WSUS administrative login
Security4625HighFailed WSUS admin login attempt
Security4719HighSystem audit policy modified
Security4732HighUser added to WSUS Administrators group
Security4733InfoUser removed from WSUS Administrators group
Security4738MediumUser account modified (WSUS-related access)
Microsoft-Windows-UpdateServices-Server/Operational1700HighWSUS configuration changed
Microsoft-Windows-UpdateServices-Server/Operational1701InfoWSUS configuration rollback performed
Microsoft-Windows-WindowsUpdateClient/Operational20HighInstallation failure
Microsoft-Windows-WindowsUpdateClient/Operational25HighService connectivity issue
Microsoft-Windows-WindowsUpdateClient/Operational31MediumReboot required after update
Microsoft-Windows-WindowsUpdateClient/Operational35HighUpdate metadata download failed
Microsoft-Windows-WindowsUpdateClient/Operational1001CriticalUpdate detection failed
System7031CriticalWindows Update service terminated unexpectedly