PSWindowsUpdate: Managing Windows Updates from PowerShell

It is very convenient to use the special PSWindowsUpdate module for PowerShell to manage Windows updates from the command line interface. The PSWindowsUpdate is not integrated into Windows and is a third-party module available in Technet Script Gallery. PSWindowsUpdate allows administrators to remotely check, install, remove and hide updates on Windows servers and workstations. The PSWindowsUpdate module is especially valuable to manage updates on Windows Server Core, Hyper-V editions having no graphic interface, as well as when configuring a Windows image in the audit mode.

PSWindowsUpdate: Install Windows Update PowerShell Module

You can install the PSWindowsUpdate module on Windows 10 and Windows Server 2016 from the online repository (PSGallery) using the PackageManagement with a single command:

Install-Module -Name PSWindowsUpdate

In my case, a warning appeared that PSWindowsUpdate 1.5.2.6 was already installed appeared. To install a newer module version, you need to run the command:

Install-Module -Name PSWindowsUpdate –Force

After the installation is complete, you need to check the package:

Get-Package -Name PSWindowsUpdate

If you have an older Windows version (Windows 7/8.1/Windows Server 2008 R2/2012 R2) or you don’t have direct Internet access, you can install PSWindowsUpdate manually.

This module can be installed on any supported Windows versions starting from Vista / Windows Server 2008 with PowerShell 2.0 installed (though, PoSh 3.0 or newer is recommended).

After installing the PSWindowsUpdate module on your computer, you can remotely install it on other computers or servers using the Update-WUModule cmdlet. For example, to copy the PSWindowsUpdate module from your computer to two remote servers, run the commands (you need to access the remote servers via SMB protocol, TCP port 445):

$Targets = «lon-fs02», «lon-db01»
Update-WUModule -ComputerName $Targets –Local

To save (export) the PoSh module to a shared network folder for further importing of the module on other computers, run:

Save-Module -Name PSWindowsUpdate –Path \\lon-fs02\psmodules\

Overview of PSWindowsUpdate Cmdlets

You can display the list of available cmdlets in the PSWindowsUpdate module as follows:

get-command -module PSWindowsUpdate

Let’s describe the usage of the module commands in brief:

• Clear-WUJob – use the Get-WUJob to call the WUJob in Task Scheduler;
• Download-WindowsUpdate (alias for Get-WindowsUpdate –Download ) — get a list of updates and download them;
• Get-WUInstall, Install-WindowsUpdate (alias for Get-WindowsUpdate –Install ) – install updates;
• Hide-WindowsUpdate (alias for Get-WindowsUpdate -Hide:$false ) – hide update;
• Uninstall-WindowsUpdate – remove update using Remove-WindowsUpdate;
• Add-WUServiceManager – register the update server (Windows Update Service Manager) on the computer;
• Enable-WURemoting — enable Windows firewall rules to allow remote use of the PSWindowsUpdate cmdlets;
• Get-WindowsUpdate (Get-WUList) — displays a list of updates that match the specified criteria, allows you to find and install the updates. This is the main cmdlet of the PSWindowsUpdate module. Allows to download and install updates from a WSUS server or Microsoft Update. Allows you to select update categories, specific updates and set the rules of a computer restart when installing the updates;
• Get-WUApiVersion – get the Windows Update Agent version on the computer;
• Get-WUHistory – display a list of installed updates (update history);
• Get-WUInstallerStatus — check the Windows Installer service status;
• Get-WUJob – run WUJob update tasks in the Task Scheduler;
• Get-WULastResults — dates of the last search and installation of updates (LastSearchSuccessDate and LastInstallationSuccessDate);
• Get-WURebootStatus — allows you to check whether a reboot is needed to apply a specific update;
• Get-WUServiceManager – list update sources;
• Get-WUSettings – get Windows Update client settings;
• Invoke-WUJob – remotely call WUJobs jobs in the Task Scheduler to immediately execute PSWindowsUpdate commands;
• Remove-WindowsUpdate – allows to uninstall an update by KB ID;
• Remove-WUServiceManager – disable Windows Update Service Manager;
• Set-PSWUSettings – save PSWindowsUpdate module settings to the XML file;
• Set-WUSettings – configure Windows Update client settings;
• Update-WUModule – update the PSWindowsUpdate module version (you can update the module on a remote computer by copying it from the current one, or updating from PSGallery).

PowerShell: List All Windows Updates Available for a Computer

You can list the updates available for this computer on the update server using the Get-WindowsUpdate or Get-WUList commands.

To check the list of available updates on a remote computer, run this command:

Get-WUList –ComputerName server2

You can check where your Windows should get updates from. Run the following command:

As you can see, the computer is configured to receive updates from the local WSUS server (Windows Server Update Service = True). In this case, you should see a list of updates approved for your computer.

If you want to scan your computer on Microsoft Update servers in the Internet (in addition to Windows updates, these servers contain Office and other Microsoft product updates), run this command:

You will get this warning:

To allow scanning on Microsoft Update, run this command:

Add-WUServiceManager -ServiceID «7971f918-a847-4430-9279-4a52d1efe18d» -AddServiceFlag 7

You can now scan to Microsoft Update. As you can see, in this case, additional updates were found for Microsoft Visual C ++ 2008 and Microsoft Silverlight.

To check the version of the Windows Update Agent on the computer, run the command:

To remove certain products or packages from the list of updates received by your computer, you can exclude them by:

1. Category (-NotCategory);
2. Title (-NotCategory);
3. Update number (-NotKBArticleID).

For example, let’s exclude OneDrive, drivers and the specific KB from the list of updates:

Get-WUlist -NotCategory «Drivers» -NotTitle «OneDrive» -NotKBArticleID KB4489873

Install-WindowsUpdate: Installing Windows Updates with PowerShell

To automatically download and install all available updates for your computer, run the command:

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot

The AcceptAll key accepts installation of all update packages, and AutoReboot allows Windows to automatically restart after the updates are installed.

You can save the update installation history to the log file (you can use it instead of WindowsUpdate.log file).

Install-WindowsUpdate -AcceptAll -Install -AutoReboot | Out-File «c:\logs\$(get-date -f yyyy-MM-dd)-WindowsUpdate.log» -force

You can install only the specific update packages by KB number:

Get-WindowsUpdate -KBArticleID KB2267602, KB4533002 -Install

In this case, you need to confirm the installation of each update manually.

If you want to exclude some updates from the installation list, run this command:

Install-WindowsUpdate -NotCategory «Drivers» -NotTitle OneDrive -NotKBArticleID KB4011670 -AcceptAll -IgnoreReboot

Install Windows Update on Remote Computers with PowerShell

The PSWindowsUpdate module allows you to install updates remotely on multiple workstations or servers at once (the PSWindowsUpdate must be installed/imported on these computers). It is very convenient since an administrator doesn’t have to log on manually to all servers when update installation is scheduled.

Almost all PSWindowsUpdate module cmdlets allow you to manage and install updates on remote computers. To do this, use the attribute: -Computername server1, server2, server3

In order to manage updates on remote computers, you need to add host names to your winrm trusted host list:

Install the PSWindowsUpdate module on remote computers and allow to access the process dllhost.exe via dynamic RPC ports in the Windows Defender Firewall.

The following command will install all available updates on three remote servers:

In newer versions of the PSWindowsUpdate module, use the following command to remotely install updates on multiple computers:

You can install updates on a remote computer and send an email report to the administrator:

Install-WindowsUpdate -ComputerName nysrv1 -MicrosoftUpdate -AcceptAll — IgnoreReboot -SendReport –PSWUSettings @ -Verbose

Get-WUHistory: Viewing Windows Update History using PowerShell

Using the Get-WUHistory cmdlet, you can get the list of updates installed on a computer earlier automatically or manually.

You can get the information about the date of installation of a specific update:

Get-WUHistory| Where-Object <$_.Title -match "KB4517389">| Select-Object *|ft

To find out if the update has been installed on multiple remote computers, you can use this PowerShell code:

«server1″,»server2» | Get-WUHistory| Where-Object <$_.Title -match "KB4011634">| Select-Object *|ft

Remove-WindowsUpdate: Uninstalling Windows Updates

To correctly uninstall the updates from PowerShell, you can use the Remove-WindowsUpdate cmdlet. Just specify the KB number as an argument of the KBArticleID parameter. To delay automatic computer restart, add the –NoRestart key:

Remove-WindowsUpdate -KBArticleID KB4489873 -NoRestart

Hide-WindowsUpdate: How to Hide Windows Updates with PowerShell?

You can hide the specific updates so they will be never installed by Windows Update service on your computer (most often you need to hide the driver updates). For example, to hide the KB4489873 and KB4489243 updates, run these commands:

$HideList = «KB4489873», «KB4489243»
Get-WindowsUpdate -KBArticleID $HideList –Hide

Now the next time you scan for updates using the Get-WUInstall command, the hidden updates won’t be displayed in the list of updates available for installation.

This is how you can display the list of updates hidden on this computer:

Notice that the H (Hidden) attribute has appeared in the Status column of hidden updates.

To remove an update from hidden ones, run this command:

Get-WindowsUpdate -KBArticleID $HideList -WithHidden -Hide:$false

Show-WindowsUpdate -KBArticleID $HideList

For those who feel uncomfortable in the PowerShell console, I would recommend a graphic Windows Update MiniTool to manage Windows 10 updates.

Update-List

Adds items to and removes items from a property value that contains a collection of objects.

Syntax

Description

The Update-List cmdlet adds, removes, or replaces items in a property value of an object and returns the updated object. This cmdlet is designed for properties that contain collections of objects.

The Add and Remove parameters add individual items to and remove them from the collection. The Replace parameter replaces the entire collection.

If you do not specify a property in the command, Update-List returns an object that describes the update instead of updating the object. You can submit the update object to cmdlets that change objects, such as Set cmdlets.

This cmdlet works only when the property that is being updated supports the IList interface that Update-List uses. Also, any Set cmdlets that accept an update must support the IList interface.

The core cmdlets that are installed with PowerShell do not support this interface. To determine whether a cmdlet supports Update-List , see the cmdlet Help topic.

This cmdlet was reintroduced in PowerShell 7.

Examples

Example 1: Add items to a property value

In this example we create a class that represents a deck of cards where the cards are stored as a List collection object. The NewDeck() method uses Update-List to add a complete deck of card values to the cards collection.

The Update-List cmdlet outputs the updated object to the pipeline. We pipe the output to Out-Null to suppress the unwanted display.

Example 2: Add and remove items of a collection property

Continuing with the code in Example 1, we will create instances of the Cards class to represent a deck of cards and the cards held by two players. We use the Update-List cmdlet to add cards to the players’ hands and to remove cards from the deck.

The output shows the state of the deck before the cards were dealt to the players. You can see that each player received five cards from the deck. The final output shows the state of the deck after dealing the cards to the players. Update-List was used to select the cards from the deck and add them to the players’ collection. Then the players’ cards were removed from the deck using Update-List .

Example 3: Add and remove items in a single command

Update-List allows you to use the Add and Remove parameters in a single command. In this example, Player 1 wants to discard the 4♦ and 6♦ and get two new cards.

Parameters

Specifies the property values to be added to the collection. Enter the values in the order that they should appear in the collection.

Type:	Object [ ]
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Specifies the objects to be updated. You can also pipe the object to be updated to Update-List .

Type:	PSObject
Position:	Named
Default value:	None
Accept pipeline input:	True
Accept wildcard characters:	False

Specifies the property that contains the collection that is being updated. If you omit this parameter, Update-List returns an object that represents the change instead of changing the object.

Type:	String
Position:	0
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Specifies the property values to be removed from the collection.

Type:	Object [ ]
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Specifies a new collection. This parameter replaces all items in the original collection with the items specified by this parameter.

Type:	Object [ ]
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Inputs

You can pipe the objects to be updated to Update-List .

Outputs

Objects or System.Management.Automation.PSListModifier

Update-List returns the updated object, or it returns an object that represents the update action.