Managing Windows updates with PowerShell

 

Managing Windows updates with PowerShell

Thursday, January 6, 2022

11:45 PM

How to Automate Windows Updates Using PowerShell: Short Overview

Patch management is a crucial aspect of IT infrastructure administration, just as Windows Workstation backup. With the right patch management solution, you can enhance your system by testing or installing the latest software updates and patches. Patches are regarded as temporary fixes for existing issues between full-scale software releases. If patch management is effectively performed, you can promptly address vulnerabilities of your system and mitigate any potential threats.

Windows offers its own patch management solution – Windows Update. However, many IT administrators still find the patch management process too complex and time-consuming. Moreover, system updates can affect your production workflow as they often start automatically during business hours. With PowerShell cmdlets, you can automate Windows updates, saving you effort and time.

Today’s blog post describes how you can use PowerShell to install Windows updates and includes a list of useful PowerShell commands to automate the patch management process. Patching can reduce the risk of bugs or vulnerabilities affecting your system. However, you should use a comprehensive data protection solution to ensure the full-scale security of your production workloads. NAKIVO Backup & Replication is an affordable and reliable solution which can protect your data across various platforms (physical, virtual, or cloud).

What Is PSWindowsUpdate?

To make the Windows patch management process smooth and easy, you can use the PSWindowsUpdate module developed by Michal Gajda. This module is publicly available and can be downloaded for free from the PowerShell Gallery. The main requirement is that a computer needs to run Windows OS versions starting from Vista or Windows Server 2008. Also, you need to have PowerShell 2.0 or later.

With PSWindowsUpdate, you can identify if any Windows updates are available for your computer. Moreover, this module allows you to centrally manage Windows updates across various Windows servers and workstations. This way, you can remotely control which updates are installed, removed, or hidden.

Data Protection with NAKIVO Backup & Replication

NAKIVO Backup & Replication delivers high-end data protection for SMBs and enterprises with multiple backup, replication and recovery features, including VMware Backup, Hyper-V Backup, Office 365 Backup and more.

How to Automate Windows Updates with PowerShell

Below, we will outline the PSWindowsUpdate configuration process, including how to download and install the module, as well as how to check for the commands which can help you automate Windows updates.

How to install PSWindowsUpdate

To effectively automate Windows patch management, you first need to install the PSWindowsUpdate module on your computer. For this purpose, open an elevated PowerShell prompt and enter the following command:

Install-Module -Name PSWindowsUpdate

After running this command, you will be asked whether you want to install the specified module from PSGallery. Select Yes if you wish to continue and accept all changes.

 

Once you have installed the module, you need to ensure that you can remotely access other computers. This way, you should be able to install Windows updates on remote computers, allowing you to spend minimal time and effort. For the PSWindowsUpdate module to work with remote machines, you need to save the module to your computer and share it over a network. In case other servers are able to import and deploy this module, you can set up automated Windows patch management. To this end, you should run the following cmdlet:

Save-Module -Name PSWindowsUpdate -Path

Here, you need to define the –Path parameter by specifying where you want the PSWindowsUpdate module to be stored.

How to use PSWindowsUpdate

For the next step, you will learn how to use this module in order to automate Windows updates with PowerShell cmdlets. This is a great advantage for IT administrators who need to perform the patch management process on Server Core machines with no GUI. With the use of these cmdlets, you can minimize management complexity and make the process easier and less error-prone.

To get a full list of available Windows updates, run the following PowerShell command:

Get-WindowsUpdate

You should get the output seen below on your screen:

With this information, you will know for sure which software or application needs to be updated. After that, you can install all the updates by entering the command below. Moreover, by adding the –AutoReboot parameter, you can ensure that the system will automatically restart once the update is installed.

Get-WUInstall -AcceptAll –AutoReboot

If you would not like a reboot to start (so as not to interrupt the production workflow), you can run the following cmdlet:

Get-WUInstall -AcceptAll –IgnoreReboot

On the screen, you can see the progress of the patch management process, as well as the full list of updates and their current status.

After the installation process is complete, you will see the following message in the PowerShell console: ‘Reboot is required but do it manually’. Thus, you are still required to restart the system, but you can do it at the time which best suits your schedule.

Should you wish to download only a specific update, you can add the –KBArticleID parameter to the PowerShell cmdlet. Don’t forget to specify the number of KB Article in order to download the right patch. For example, I want to install Windows Malicious Software Removal Tool x64 and Security Intelligence Update for Windows Defender Antivirus. The appropriate PowerShell command should appear as follows:

Get-WUInstall -KBArticleID KB890830, KB2267602 –AcceptAll

After running this command, I will have only two of said updates installed on my computer.

Overview of PSWindowsUpdate commands

If you are wondering which PowerShell cmdlet can work with the PSWindowsUpdate module, you should type the following command and press Enter:

Get-Command –module PSWindowsUpdate

Here, you can see a full list of the module’s commands.

Let’s cover how some of these commands work.

1. The Get-WUHistory cmdlet allows you to view the history of the latest updates. After running this command, you will receive a similar output on your screen.

2. The next cmdlet is Get-WUInstallerStatus, which can help you verify the status of the Windows Installer service. Here, you can check whether the installer is working properly or not. The output for this operation can look as follows:

3. By running the Get-WURebootStatus cmdlet, you can check whether you need to reboot the system so that a specific update is fully applied.

4. With the Get-WUServiceManager cmdlet, you can check the source of Windows updates.

As you can see, the last column demonstrates the update source (e.g. Windows Update, DCat Flighting Prod, etc.).

5. You can hide certain updates from the list in order to avoid installing them on your computer. For this purpose, you should run the Hide-WindowsUpdate command where it is possible to specify the ID of KB articles you wish to hide. The following example demonstrates how you can hide the KB2267602 update from the list:

$HideList = "KB2267602"

Hide-WindowsUpdate -KBArticleID $HideList –Hide

Before any changes are made, you will be asked to confirm the selection. Type Y to hide the KB article.

 

However, if you wish to get the list of hidden updates, you can run the cmdlet below.

Get-WindowsUpdate –IsHidden

In the Status column, you can see the letter H denoting that the update has been successfully hidden. Thus, the next time you run the Get-WUInstall command, the selected update will be automatically excluded from the list of available updates.

Should you want to roll back the changes, you can use the following cmdlet in the PowerShell console:

Hide-WindowsUpdate -KBArticleID $HideList -Hide:$false

Once again, you will be asked to confirm the changes by typing Y.

As you can see, the letter H is no longer included in the update status, meaning that this Windows update is not hidden anymore and can be downloaded on your computer.

6. Another configuration option available to you is to remove the updates you have installed on your machine. For this purpose, you can use the Remove-WindowsUpdate cmdlet and type the ID of the KB article you wish to uninstall from your computer. For example:

Remove-WindowsUpdate -KBArticleID KB4519573 –IgnoreReboot

By adding the –IgnoreReboot parameter, you ensure that the computer will not reboot automatically. Once the update is uninstalled, you can reboot the machine later.

7. Last but not least, you can scan for available Windows updates on a remote machine using the Get-WUList cmdlet.

Get-WUList –ComputerName Server5

For this cmdlet to work, you also need to install the PSWindowsUpdate module on a remote computer. This way, you can automate Windows updates for multiple machines from a single pane of glass. With PSWindowsUpdate, the patch management process is performed in a simple and efficient way. Moreover, you can reduce the management overhead that IT administrators may experience during system patching.

 

From <https://www.nakivo.com/blog/automate-windows-updates-using-powershell-short-overview/>