How do I force Windows Update from command line?

Use USOClient on Windows 10/11: Run 'usoclient scaninstallwait' to scan, download, and install all updates in one command. For PowerShell, use 'Get-WUInstall -MicrosoftUpdate -AcceptAll' after installing the PSWindowsUpdate module. On legacy systems (Windows 7/Server 2012 R2), use 'wuauclt /detectnow /updatenow'.

What's the difference between USOClient StartScan and ScanInstallWait?

'usoclient startscan' only checks for available updates without downloading or installing. 'usoclient scaninstallwait' performs a complete workflow: scans for updates, downloads them, and installs them, waiting for each step to complete. Use startscan for checking status; use scaninstallwait for full automation.

Can I schedule USOClient commands?

Yes, use Windows Task Scheduler to run USOClient commands at specific times. Create a task with 'usoclient scaninstallwait' as the action. For PowerShell automation, use 'Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -ScheduleJob (Get-Date "02:00")' to schedule updates for 2 AM.

How do I check for updates without installing them?

Use 'usoclient startscan' to scan without installing. With PowerShell, use 'Get-WUList -MicrosoftUpdate' to list available updates without installing. Add '-Verbose' for detailed output. This is useful for auditing pending updates across systems.

What PowerShell modules work with Windows Update?

The PSWindowsUpdate module is the most comprehensive option. Install it with 'Install-Module PSWindowsUpdate'. It provides cmdlets like Get-WUList, Get-WUInstall, Get-WUHistory, and Hide-WindowsUpdate. Microsoft's built-in Windows Update cmdlets are limited to Windows Server.

How do I update remote computers via command line?

With PSWindowsUpdate module: 'Get-WUInstall -ComputerName SERVER01,SERVER02 -MicrosoftUpdate -AcceptAll'. For multiple computers, use 'Invoke-WUJob' with credentials. Ensure WinRM is enabled on remote systems and you have admin rights. USOClient only works locally.

What's the WSUS command equivalent for USOClient?

For WSUS-managed clients, use 'wuauclt /reportnow' to report status immediately, and 'wuauclt /detectnow' to check for approved updates. With PowerShell, add the WSUS service: 'Add-WUServiceManager -ServiceID "3da21691-e39d-4da6-8a4b-b43877bcb1b7"' then use standard Get-WUInstall commands.

How do I view Windows Update history via command line?

Use PowerShell: 'Get-WUHistory' shows recent update history with the PSWindowsUpdate module. For native PowerShell, use 'Get-HotFix | Sort-Object InstalledOn -Descending' for installed updates. To see failed updates: 'Get-WUHistory | Where-Object {$_.Result -ne "Succeeded"}'.

How do I reset Windows Update components via command line?

Run these commands as Administrator: 'Stop-Service wuauserv, bits, cryptsvc' then 'Remove-Item C:\Windows\SoftwareDistribution -Recurse -Force' and 'Start-Service wuauserv, bits, cryptsvc'. With PSWindowsUpdate installed, simply run 'Reset-WUComponents'. This fixes most update errors.

Windows Update Commands: Force Updates via USOClient (2026)

Q: How do I install a specific KB update from command line?

With PSWindowsUpdate: 'Get-WUInstall -KBArticleID KB5034441 -AcceptAll'. For multiple KBs: 'Get-WUInstall -KBArticleID KB5034441,KB5034123 -AcceptAll'. You can also download and install MSU files manually with 'wusa.exe KB5034441.msu /quiet /norestart'.

Verified July 2026 · tested on Windows 11 24H2, Windows 10 22H2 & Server 2022/2025

Wondering whether USOClient.exe is safe? If you spotted this process in Task Manager and want to know if it's legitimate or malware, see our dedicated guide: Is USOClient.exe Safe? Windows Update Process Explained. This article focuses on the commands.

Quick Reference: Essential Commands

Need to run Windows updates right now? Here are the most common commands:

# Modern Windows 10/11/Server 2016+ (USOClient)
usoclient startscan              # Check for updates
usoclient startdownload          # Download updates
usoclient startinstall           # Install updates
usoclient scaninstallwait        # All-in-one: scan, download, install

# PowerShell (any Windows version with module)
Install-Module PSWindowsUpdate   # One-time setup
Get-WUList -MicrosoftUpdate      # List available updates
Get-WUInstall -MicrosoftUpdate -AcceptAll  # Install all updates

Which tool do you need?

Windows 10/11 or Server 2016+ → USOClient (built in, no setup)
Windows 7 / Server 2012 R2 (legacy) → WUAUCLT
Automation, remote, or bulk updates → PowerShell + PSWindowsUpdate

Jump to the section you need below, or use the generator at the top to build the command for you.

USOClient: Modern Update Management

The Update Session Orchestrator (USOClient) is the modern replacement for WUAUCLT, introduced in Windows 10 and Server 2016. It provides streamlined update management with better integration into the Windows Update service architecture.

Windows 10 (1703+)Windows 11Server 2016+⚠ Limited on some LTSC/LTSB builds

USOClient Command Reference

Command	Description
`startscan`	Initiate scan for available updates
`startdownload`	Begin downloading discovered updates
`startinstall`	Install downloaded updates
`refreshsettings`	Refresh Windows Update settings
`startinteractivescan`	Open dialog and start scanning
`restartdevice`	Restart to complete update installation
`scaninstallwait`	Scan, download, and install in sequence

USOClient Usage Examples

# Scan for available updates
usoclient startscan

# Download detected updates
usoclient startdownload

# Install downloaded updates
usoclient startinstall

# Complete workflow: scan, download, and install
usoclient scaninstallwait

Updating PowerShell Itself vs. Using PowerShell to Update Windows

People searching for "how to update Windows PowerShell" mean one of two different things, and they need different commands:

Use PowerShell to update Windows — install OS patches from a PowerShell prompt. That's the PowerShell automation section below (the PSWindowsUpdate module).
Update PowerShell itself — upgrade the app from Windows PowerShell 5.1 to PowerShell 7.

To update PowerShell itself, use winget on Windows 10/11:

# Check your current version
$PSVersionTable.PSVersion

# Install or upgrade to the latest PowerShell 7.x
winget install --id Microsoft.PowerShell --source winget

# Upgrade an existing install
winget upgrade --id Microsoft.PowerShell

If winget isn't available (Server Core or older builds), install the MSI silently:

msiexec.exe /package PowerShell-7.x.x-win-x64.msi /quiet ADD_EXPLORER_CONTEXT_MENU=1 ENABLE_PSREMOTING=1

Note: PowerShell 7 installs side-by-side as pwsh.exe — it does not replace Windows PowerShell 5.1 (powershell.exe). Both stay available, and every command in this guide works in either.

PowerShell: Advanced Update Automation

PowerShell is the most flexible option. The PSWindowsUpdate module adds automation, filtering, and reporting that WUAUCLT and USOClient can't match. Not sure which cmdlet flags you need? The generator above builds ready-to-run commands for you.

Any Windows with PowerShell 5+Local & remoteRequires PSWindowsUpdate module

Installing PSWindowsUpdate Module

# Install from PowerShell Gallery (PowerShell 5+)
Install-Module PSWindowsUpdate

# Import the module
Import-Module PSWindowsUpdate

# Add Microsoft Update service
Add-WUServiceManager -ServiceID 7971f918-a847-4430-9279-4a52d1efe18d

Essential PowerShell Update Commands

# List available updates
Get-WUList -MicrosoftUpdate

# Install all updates with automatic reboot
Get-WUInstall -MicrosoftUpdate -AcceptAll -AutoReboot

# Install updates without automatic reboot (recommended)
Get-WUInstall -MicrosoftUpdate -AcceptAll

# Check if reboot is required
Get-WURebootStatus

# View update history
Get-WUHistory

Advanced PowerShell Filtering

# Install only security updates
Get-WUInstall -MicrosoftUpdate -Category "Security Updates" -AcceptAll

# Exclude specific updates by title
Get-WUInstall -MicrosoftUpdate -AcceptAll -NotTitle "Silverlight"

# Install updates for specific products
Get-WUInstall -MicrosoftUpdate -Category "Critical Updates" -AcceptAll

Remote Computer Management

PSWindowsUpdate excels at managing updates across multiple remote computers, making it ideal for enterprise environments and MSP deployments.

# Install updates on remote computer
Get-WUInstall -ComputerName SERVER01 -MicrosoftUpdate -AcceptAll

# Install updates on multiple computers
Get-WUInstall -ComputerName SERVER01,SERVER02,SERVER03 -MicrosoftUpdate -AcceptAll

# Use credentials for remote access
$cred = Get-Credential
Invoke-WUJob -ComputerName SERVER01 -Script {Get-WUInstall -MicrosoftUpdate -AcceptAll} -Credential $cred

# Check update status on remote computers
Get-WUList -ComputerName SERVER01,SERVER02 -MicrosoftUpdate

Specific Update Management

Install, hide, or remove specific updates by KB article number for precise control over your update environment.

# Install specific KB update
Get-WUInstall -KBArticleID KB5034441 -AcceptAll

# Install multiple specific updates
Get-WUInstall -KBArticleID KB5034441,KB5034123 -AcceptAll

# Hide problematic updates
Hide-WindowsUpdate -KBArticleID KB5034441 -Confirm:$false

# Show previously hidden updates
Show-WindowsUpdate -KBArticleID KB5034441

# List all hidden updates
Get-WindowsUpdate -IsHidden

# Remove/uninstall specific update
Remove-WindowsUpdate -KBArticleID KB5034441 -NoRestart

Scheduled Automation

Automate update installation using Windows Task Scheduler for maximum flexibility and control over maintenance windows.

# Schedule update installation for 2 AM
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -ScheduleJob (Get-Date "02:00")

# Schedule with automatic reboot at specific time
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot -ScheduleReboot (Get-Date "03:00")

# Install updates after reboot using RecurseCycle
Get-WUInstall -MicrosoftUpdate -AcceptAll -RecurseCycle 3 -AutoReboot

# Create scheduled task for weekly updates
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command `"Get-WUInstall -MicrosoftUpdate -AcceptAll -AutoReboot`""
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2am
Register-ScheduledTask -TaskName "WeeklyUpdates" -Action $action -Trigger $trigger -RunLevel Highest

Email Reporting and Notifications

Configure email notifications to stay informed about update installation status and results.

# Send email report after update installation
Get-WUInstall -MicrosoftUpdate -AcceptAll -SendReport -PSWUSettings @{
    SmtpServer="smtp.company.com"
    Port=587
    To="admin@company.com"
    From="updates@company.com"
}

# Configure email settings for future use
$EmailParams = @{
    SmtpServer = "smtp.office365.com"
    Port = 587
    To = "it-team@company.com"
    From = "windowsupdates@company.com"
    Subject = "Windows Update Report - {0}" -f $env:COMPUTERNAME
}
Set-PSWUSettings @EmailParams

# Send history report
Get-WUHistory -Last 30 -SendReport

# Email report with specific format
Get-WUInstall -MicrosoftUpdate -AcceptAll -SendHistory -SendReport

Cancel or Stop a Running Update

Need to stop an update that's already downloading or installing? There's no single usoclient cancel switch — you stop the services that drive Windows Update, then clear the in-progress download. Run these from an elevated PowerShell prompt.

# Stop the update engine, orchestrator, and transfer service
Stop-Service wuauserv, usosvc, bits -Force

# Cancel every in-progress update download (BITS transfer)
Get-BitsTransfer -AllUsers | Remove-BitsTransfer

# Restart the services so future updates still work
Start-Service wuauserv, bits

What this stops — and what it doesn't: These commands halt anything still downloading or waiting to install. An update that has already reached the installing stage will finish on the next reboot; to remove it afterward, uninstall the KB with Remove-WindowsUpdate -KBArticleID KB5034441 -NoRestart.

Cancel a Running Update on Remote Computers

Invoke-Command -ComputerName SERVER01,SERVER02 -ScriptBlock {
    Stop-Service wuauserv, usosvc, bits -Force
    Get-BitsTransfer -AllUsers | Remove-BitsTransfer
    Start-Service wuauserv, bits
}

Pause Updates So They Don't Restart

Stopping the services cancels the current run, but Windows scans again on its normal schedule. To keep updates paused for a set number of days, write the pause-expiry value to the registry:

# Pause all updates for 7 days
$pauseUntil = (Get-Date).AddDays(7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" `
    -Name "PauseUpdatesExpiryTime" -Value $pauseUntil

# Resume immediately
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" `
    -Name "PauseUpdatesExpiryTime" -ErrorAction SilentlyContinue

Tip: The command builder at the top of this page generates these for you — pick Cancel a running update, Pause updates, or Resume updates and copy the exact script.

WUAUCLT: Legacy Windows Update Management

The Windows Update Automatic Update Client (WUAUCLT) was the primary command-line utility for managing Windows updates on older systems like Windows 7 and Server 2012R2. While deprecated in modern Windows versions, it remains essential for legacy system administration.

Windows 7Server 2012 R2⚠ Deprecated on Windows 10/11 & Server 2016+

Warning: WUAUCLT has been deprecated in Windows 10 and Server 2016+. Use USOClient or PowerShell for modern systems.

Essential WUAUCLT Commands

Command	Description
`/DetectNow`	Detect and download available updates
`/ReportNow`	Report status back to WSUS server
`/ResetAuthorization`	Clear update check cookie (fixes 1-hour delay)
`/UpdateNow`	Install updates immediately
`/ShowSettingsDialog`	Display Windows Update settings

Common WUAUCLT Examples

# Detect and install updates immediately
wuauclt /detectnow /updatenow

# Reset authorization cookie if updates are stuck
wuauclt /resetauthorization

# Report client status to WSUS server
wuauclt /reportnow

WSUS Integration and Enterprise Management

Windows Server Update Services (WSUS) provides centralized update management for enterprise environments. Understanding WSUS client commands is essential for troubleshooting and maintaining proper update deployment.

WSUS Client Configuration

Verify and configure WSUS server settings using registry keys and PowerShell commands.

# Check configured WSUS server
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name WUServer

# Check WSUS status server
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name WUStatusServer

# View all WSUS-related registry settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"

# Force immediate check-in with WSUS server
wuauclt /reportnow

# Reset and re-register with WSUS
wuauclt /resetauthorization /detectnow

WSUS Client Registration Issues

Fix duplicate SUSclientID issues and force client re-registration with WSUS servers.

# Stop Windows Update service
Stop-Service wuauserv

# Remove duplicate SUSclientID (fixes registration issues)
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name SusClientId -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name SusClientIdValidation -ErrorAction SilentlyContinue

# Clear authorization token
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name AccountDomainSid -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name PingID -ErrorAction SilentlyContinue

# Restart service and force re-registration
Start-Service wuauserv
wuauclt /resetauthorization /detectnow

# Verify new client ID was generated
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name SusClientId

WSUS with PowerShell

Use PSWindowsUpdate module with WSUS servers for advanced management capabilities.

# Add WSUS as update source
Add-WUServiceManager -ServiceID "3da21691-e39d-4da6-8a4b-b43877bcb1b7" -Confirm:$false

# List updates from WSUS server
Get-WUList -ServiceID "3da21691-e39d-4da6-8a4b-b43877bcb1b7"

# Install updates from WSUS
Get-WUInstall -ServiceID "3da21691-e39d-4da6-8a4b-b43877bcb1b7" -AcceptAll

# Remove WSUS service (switch back to Microsoft Update)
Remove-WUServiceManager -ServiceID "3da21691-e39d-4da6-8a4b-b43877bcb1b7"

Pro Tip: Understanding WSUS vs Microsoft Update - WSUS allows organizations to approve and control which updates are deployed. When a computer is configured to use WSUS, it will only see updates approved by your WSUS administrator. The /ReportNow command forces the client to immediately report its status to the WSUS server, which is essential for accurate reporting and compliance tracking.

WSUS Commands: Server-Side Administration

Everything above runs on the client. If you administer the WSUS server itself, you have two command-line toolsets: WSUSUtil.exe (the built-in maintenance utility) and the UpdateServices PowerShell module (installed with the WSUS role or RSAT). These are what you use to approve updates, run cleanup, and keep the server healthy.

WSUSUtil.exe Command Reference

wsusutil.exe lives in C:\Program Files\Update Services\Tools\. Run it from an elevated prompt on the WSUS server itself.

Command	Description
`wsusutil.exe checkhealth`	Check WSUS server health (results log to Event Viewer)
`wsusutil.exe reset`	Re-verify every update file and re-download anything missing or corrupt
`wsusutil.exe listinactiveapprovals`	List approvals that can never be fulfilled
`wsusutil.exe removeinactiveapprovals`	Remove those stuck approvals
`wsusutil.exe deleteunneededrevisions`	Purge superseded update revisions to shrink the database
`wsusutil.exe export package.cab export.log`	Export metadata for an air-gapped / disconnected WSUS
`wsusutil.exe import package.cab import.log`	Import that metadata on the disconnected server
`wsusutil.exe movecontent D:\WSUS\ move.log`	Move the update content folder to another drive
`wsusutil.exe usecustomwebsite true`	Move WSUS to the custom website on ports 8530/8531

# Check server health
& "C:\Program Files\Update Services\Tools\wsusutil.exe" checkhealth

# Reset and re-download any missing or corrupt update files
& "C:\Program Files\Update Services\Tools\wsusutil.exe" reset

# Reclaim disk space by deleting superseded revisions
& "C:\Program Files\Update Services\Tools\wsusutil.exe" deleteunneededrevisions

WSUS PowerShell (UpdateServices Module)

The UpdateServices module ships with the WSUS role and RSAT. It's the modern way to script approvals, cleanup, and reporting on the server.

# Connect to the local WSUS server
$wsus = Get-WsusServer

# Connect to a remote WSUS server (port 8530 = HTTP, 8531 = HTTPS)
$wsus = Get-WsusServer -Name WSUS01 -PortNumber 8530

Query and Approve Updates

# List updates that are needed but not yet approved
Get-WsusUpdate -Approval Unapproved -Status FailedOrNeeded

# Approve all critical updates for the "All Computers" group
Get-WsusUpdate -Classification Critical -Approval Unapproved |
    Approve-WsusUpdate -Action Install -TargetGroupName "All Computers"

# Decline every superseded update (a common cleanup step)
Get-WsusUpdate -Classification All -Approval AnyExceptDeclined |
    Where-Object { $_.Update.IsSuperseded } |
    Deny-WsusUpdate

Manage Clients and Groups

# List every computer reporting to WSUS
Get-WsusServer | Get-WsusComputer |
    Select-Object FullDomainName, LastReportedStatusTime, LastSyncTime

# Find clients that haven't checked in for 30+ days
Get-WsusComputer | Where-Object {
    $_.LastReportedStatusTime -lt (Get-Date).AddDays(-30)
} | Select-Object FullDomainName, LastReportedStatusTime

WSUS Server Cleanup

The single most important WSUS maintenance task — run it monthly to keep the database fast and stop the disk from filling up:

# Full cleanup: decline superseded/expired updates, delete obsolete
# updates and computers, and free unneeded content files
Invoke-WsusServerCleanup -DeclineSupersededUpdates -DeclineExpiredUpdates `
    -CleanupObsoleteUpdates -CleanupObsoleteComputers `
    -CleanupUnneededContentFiles -CompressUpdates

Client vs. server, in one line: wuauclt and usoclient run on the client to talk to WSUS (see the client section above); wsusutil.exe and the UpdateServices module run on the WSUS server itself to approve updates and maintain the database. You need both sides to manage patching end to end.

Tool Comparison and Best Practices

Understanding which Windows Update tool to use for your environment ensures optimal update management efficiency and reliability.

Tool	Best For	Advantages	Limitations
WUAUCLT	Legacy systems (Win 7, Server 2012R2)	Simple, built-in	Deprecated, limited features
USOClient	Modern Windows (10+, Server 2016+)	Native, reliable	Basic functionality only
PowerShell	Advanced automation, enterprise	Flexible, scriptable, detailed control	Requires module installation

Best Practices for Windows Update Management

Always run update commands from an elevated/administrative prompt
Test updates in a non-production environment first
Schedule updates during maintenance windows to minimize disruption
Monitor update installation progress and logs for errors
Implement a rollback strategy for critical systems
Use PowerShell for enterprise environments requiring detailed control

Troubleshooting Common Issues

Resolve Windows Update failures with comprehensive troubleshooting commands and error code resolution guides.

Reset Windows Update Components

# Complete reset using PowerShell
Stop-Service wuauserv, cryptSvc, bits, msiserver

# Clear update cache directories
Remove-Item C:\Windows\SoftwareDistribution -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item C:\Windows\System32\catroot2 -Recurse -Force -ErrorAction SilentlyContinue

# Restart services
Start-Service wuauserv, cryptSvc, bits, msiserver

# Alternative: Use PSWindowsUpdate module
Reset-WUComponents

Common Windows Update Error Codes

Each row is deep-linkable — share a specific code with …#err-0x8024402f, and the row highlights on arrival.

Error Code	Description	Solution
`0x80070002`	File not found	Clear SoftwareDistribution folder
`0x80070003`	System cannot find path	Reset Windows Update components
`0x8024402F`	Connection to update server failed	Check internet connection, proxy, firewall
`0x80240034`	Update not applicable	Update already installed or wrong version
`0x80244007`	Server not found	Verify WSUS configuration or internet access
`0x80244019`	Exceeded maximum redirects	Reset Windows Update authorization
`0x8024401C`	Connection closed	Check network stability, run `wuauclt /resetauthorization`

Error Resolution Commands

# Fix 0x8024402F (connection failures)
netsh winhttp reset proxy
netsh winsock reset
ipconfig /flushdns

# Fix 0x80244019 (too many redirects)
wuauclt /resetauthorization
wuauclt /detectnow

# Check and repair system files
sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

# View detailed Windows Update log
Get-WindowsUpdateLog

# Check specific error in Event Viewer
Get-WinEvent -LogName System -MaxEvents 100 | Where-Object {$_.Id -in @(20,21,22,24,25)} | Format-Table TimeCreated, Id, Message -AutoSize

Diagnostic Commands

# Check Windows Update service status
Get-Service wuauserv, bits, cryptsvc | Format-Table Name, Status, StartType

# Check update installer status (PowerShell)
Get-WUInstallerStatus

# View pending updates and their status
Get-WindowsUpdate -Verbose

# Check last successful update check
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect" | Select-Object LastSuccessTime

# Verify update history with exit codes
Get-WUHistory | Where-Object {$_.Result -ne "Succeeded"} | Format-Table Date, Title, Result -AutoSize

# Test connectivity to Microsoft update servers
Test-NetConnection -ComputerName "update.microsoft.com" -Port 443
Test-NetConnection -ComputerName "download.windowsupdate.com" -Port 443

Advanced Troubleshooting Script

Comprehensive PowerShell script for deep troubleshooting and repair.

# Complete Windows Update troubleshooting script
Write-Host "Stopping Windows Update Services..." -ForegroundColor Yellow
Stop-Service wuauserv, bits, cryptsvc, msiserver -Force

Write-Host "Clearing update cache..." -ForegroundColor Yellow
Remove-Item C:\Windows\SoftwareDistribution\* -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item C:\Windows\System32\catroot2\* -Recurse -Force -ErrorAction SilentlyContinue

Write-Host "Re-registering DLL files..." -ForegroundColor Yellow
$dlls = @("wuaueng.dll","wuapi.dll","wups.dll","wups2.dll","wuwebv.dll","wucltux.dll")
foreach ($dll in $dlls) {
    regsvr32 /s $dll
}

Write-Host "Resetting network components..." -ForegroundColor Yellow
netsh winsock reset
netsh winhttp reset proxy

Write-Host "Restarting services..." -ForegroundColor Yellow
Start-Service wuauserv, bits, cryptsvc, msiserver

Write-Host "Forcing update detection..." -ForegroundColor Yellow
wuauclt /resetauthorization /detectnow

Write-Host "Troubleshooting complete!" -ForegroundColor Green

Get our free Windows Patching Toolkit resourceDownload on inventivehq.com →

Advanced Use Cases and Automation

Real-world scenarios and automation examples for enterprise Windows update management.

Bulk Server Update Deployment

Deploy updates across multiple servers with progress monitoring and reporting.

# Define server list
$servers = Get-Content "C:\servers.txt"

# Install updates on all servers with progress tracking
$results = @()
foreach ($server in $servers) {
    Write-Host "Processing $server..." -ForegroundColor Cyan
    try {
        $result = Invoke-WUJob -ComputerName $server -Script {
            Get-WUInstall -MicrosoftUpdate -AcceptAll -IgnoreReboot
        } -RunNow -Confirm:$false

        $results += [PSCustomObject]@{
            Server = $server
            Status = "Success"
            Time = Get-Date
        }
    } catch {
        $results += [PSCustomObject]@{
            Server = $server
            Status = "Failed: $($_.Exception.Message)"
            Time = Get-Date
        }
    }
}

# Export results to CSV
$results | Export-Csv "C:\UpdateResults.csv" -NoTypeInformation

Maintenance Window Automation

Create automated maintenance windows with pre/post-update checks and rollback capability.

# Maintenance window script with safety checks
$maintenanceScript = {
    # Pre-update backup
    Write-Host "Creating system restore point..." -ForegroundColor Yellow
    Checkpoint-Computer -Description "Before Windows Updates $(Get-Date)" -RestorePointType MODIFY_SETTINGS

    # Check available disk space
    $disk = Get-PSDrive C
    if ($disk.Free -lt 10GB) {
        Write-Host "Insufficient disk space! Aborting." -ForegroundColor Red
        exit 1
    }

    # Install updates
    Write-Host "Installing updates..." -ForegroundColor Yellow
    $updates = Get-WUInstall -MicrosoftUpdate -AcceptAll -IgnoreReboot -Verbose

    # Post-update verification
    Write-Host "Verifying installation..." -ForegroundColor Yellow
    $failed = Get-WUHistory -Last 10 | Where-Object {$_.Result -eq "Failed"}

    if ($failed) {
        Write-Host "Some updates failed. Review required." -ForegroundColor Red
        $failed | Format-Table Date, Title, Result
    } else {
        Write-Host "All updates installed successfully!" -ForegroundColor Green
    }

    # Schedule reboot
    Write-Host "Scheduling reboot for 3 AM..." -ForegroundColor Yellow
    shutdown /r /t 3600 /c "System will reboot in 1 hour for updates"
}

# Execute during maintenance window
Invoke-Command -ComputerName "ProductionServer" -ScriptBlock $maintenanceScript

Update Compliance Reporting

Generate comprehensive update compliance reports for management and audit purposes.

# Generate compliance report for all servers
$servers = Get-Content "C:\servers.txt"
$report = @()

foreach ($server in $servers) {
    $pending = Get-WUList -ComputerName $server -MicrosoftUpdate
    $lastUpdate = Get-WUHistory -ComputerName $server -Last 1

    $report += [PSCustomObject]@{
        ServerName = $server
        PendingUpdates = $pending.Count
        LastUpdateDate = $lastUpdate.Date
        LastUpdateTitle = $lastUpdate.Title
        RebootRequired = (Get-WURebootStatus -ComputerName $server).RebootRequired
        ComplianceStatus = if ($pending.Count -eq 0) {"Compliant"} else {"Non-Compliant"}
    }
}

# Export to HTML report
$report | ConvertTo-Html -Title "Windows Update Compliance Report" |
    Out-File "C:\ComplianceReport.html"

# Email report to management
Send-MailMessage -To "management@company.com" -From "updates@company.com" `
    -Subject "Monthly Update Compliance Report" -Body "See attached" `
    -Attachments "C:\ComplianceReport.html" -SmtpServer "smtp.company.com"

Offline Update Installation

Deploy updates on systems without internet connectivity using offline MSU packages.

# Download updates for offline installation
Get-WUOfflineMSU -DestinationPath "C:\OfflineUpdates" -AcceptAll

# Install from MSU files on offline system
$msuFiles = Get-ChildItem "C:\OfflineUpdates\*.msu"
foreach ($msu in $msuFiles) {
    Write-Host "Installing $($msu.Name)..." -ForegroundColor Cyan
    Start-Process wusa.exe -ArgumentList "$($msu.FullName) /quiet /norestart" -Wait
}

# Alternative: Use DISM for offline servicing
DISM /Online /Add-Package /PackagePath:"C:\OfflineUpdates\update.cab"

Version-Specific Considerations

Important compatibility notes and version-specific behaviors for different Windows releases.

Windows 11 (23H2 / 24H2)

USOClient commands work identically to Windows 10
Enhanced Windows Update settings in System Settings
Improved update rollback capabilities within 10 days
New Get-WindowsUpdateLog generates ETL format by default
Better handling of driver updates through Windows Update

Windows 10 Versions

1507-1607: USOClient may not be available; use WUAUCLT or PowerShell
1703+: USOClient fully supported and recommended
20H2+: All modern update commands work reliably
LTSC 2019/2021: Different update cadence, test thoroughly before deployment

Windows Server

Server 2025: Latest USOClient and PowerShell features fully supported
Server 2022/2019/2016: Use USOClient or PowerShell (preferred)
Server 2012 R2: WUAUCLT only; PSWindowsUpdate module highly recommended
Server Core: Command-line only; PowerShell module essential for management
Note: Windows Server typically requires manual reboot approval

Compatibility Warnings

Important: Not all Windows 10/11 versions support usoclient scaninstallwait. Some LTSC and LTSB versions have limited USOClient functionality. Always test update commands in dev environment before production use. Group Policy settings can override command-line update behaviors. Third-party security software may interfere with update processes.

Windows Update Commands: Force Updates via USOClient (2026)

Frequently Asked Questions

Related articles

Is USOClient.exe Safe? Windows Update Process Explained

WSUS to Azure Migration: Complete Update Management Guide

Beyond WSUS: How to Build a Modern Windows Update Management System (2026)