Windows Update Commands | PowerShell UsoClient Guide

# Scan for available updates
usoclient startscan

# Download detected updates
usoclient startdownload

# Install downloaded updates
usoclient startinstall

# Complete workflow: scan, download, and install
usoclient scaninstallwait

# Install from PowerShell Gallery (PowerShell 5+)
Install-Module PSWindowsUpdate

# Import the module
Import-Module PSWindowsUpdate

# Add Microsoft Update service
Add-WUServiceManager -ServiceID 7971f918-a847-4430-9279-4a52d1efe18d

# List available updates
Get-WUList -MicrosoftUpdate

# Install all updates with automatic reboot
Get-WUInstall -MicrosoftUpdate -AcceptAll -AutoReboot

# Install updates without automatic reboot (recommended)
Get-WUInstall -MicrosoftUpdate -AcceptAll

# Check if reboot is required
Get-WURebootStatus

# View update history
Get-WUHistory

# Install only security updates
Get-WUInstall -MicrosoftUpdate -Category "Security Updates" -AcceptAll

# Exclude specific updates by title
Get-WUInstall -MicrosoftUpdate -AcceptAll -NotTitle "Silverlight"

# Install updates for specific products
Get-WUInstall -MicrosoftUpdate -Category "Critical Updates" -AcceptAll

# Install updates on remote computer
Get-WUInstall -ComputerName SERVER01 -MicrosoftUpdate -AcceptAll

# Install updates on multiple computers
Get-WUInstall -ComputerName SERVER01,SERVER02,SERVER03 -MicrosoftUpdate -AcceptAll

# Use credentials for remote access
$cred = Get-Credential
Invoke-WUJob -ComputerName SERVER01 -Script {Get-WUInstall -MicrosoftUpdate -AcceptAll} -Credential $cred

# Check update status on remote computers
Get-WUList -ComputerName SERVER01,SERVER02 -MicrosoftUpdate

# Install specific KB update
Get-WUInstall -KBArticleID KB5034441 -AcceptAll

# Install multiple specific updates
Get-WUInstall -KBArticleID KB5034441,KB5034123 -AcceptAll

# Hide problematic updates
Hide-WindowsUpdate -KBArticleID KB5034441 -Confirm:$false

# Show previously hidden updates
Show-WindowsUpdate -KBArticleID KB5034441

# List all hidden updates
Get-WindowsUpdate -IsHidden

# Remove/uninstall specific update
Remove-WindowsUpdate -KBArticleID KB5034441 -NoRestart

# Schedule update installation for 2 AM
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -ScheduleJob (Get-Date "02:00")

# Schedule with automatic reboot at specific time
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot -ScheduleReboot (Get-Date "03:00")

# Install updates after reboot using RecurseCycle
Get-WUInstall -MicrosoftUpdate -AcceptAll -RecurseCycle 3 -AutoReboot

# Create scheduled task for weekly updates
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command `"Get-WUInstall -MicrosoftUpdate -AcceptAll -AutoReboot`""
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2am
Register-ScheduledTask -TaskName "WeeklyUpdates" -Action $action -Trigger $trigger -RunLevel Highest

# Send email report after update installation
Get-WUInstall -MicrosoftUpdate -AcceptAll -SendReport -PSWUSettings @{
    SmtpServer="smtp.company.com"
    Port=587
    To="[email protected]"
    From="[email protected]"
}

# Configure email settings for future use
$EmailParams = @{
    SmtpServer = "smtp.office365.com"
    Port = 587
    To = "[email protected]"
    From = "[email protected]"
    Subject = "Windows Update Report - {0}" -f $env:COMPUTERNAME
}
Set-PSWUSettings @EmailParams

# Send history report
Get-WUHistory -Last 30 -SendReport

# Email report with specific format
Get-WUInstall -MicrosoftUpdate -AcceptAll -SendHistory -SendReport

# Detect and install updates immediately
wuauclt /detectnow /updatenow

# Reset authorization cookie if updates are stuck
wuauclt /resetauthorization

# Report client status to WSUS server
wuauclt /reportnow

# Check configured WSUS server
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name WUServer

# Check WSUS status server
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name WUStatusServer

# View all WSUS-related registry settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"

# Force immediate check-in with WSUS server
wuauclt /reportnow

# Reset and re-register with WSUS
wuauclt /resetauthorization /detectnow

# Stop Windows Update service
Stop-Service wuauserv

# Remove duplicate SUSclientID (fixes registration issues)
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name SusClientId -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name SusClientIdValidation -ErrorAction SilentlyContinue

# Clear authorization token
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name AccountDomainSid -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name PingID -ErrorAction SilentlyContinue

# Restart service and force re-registration
Start-Service wuauserv
wuauclt /resetauthorization /detectnow

# Verify new client ID was generated
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" -Name SusClientId

# Add WSUS as update source
Add-WUServiceManager -ServiceID "3da21691-e39d-4da6-8a4b-b43877bcb1b7" -Confirm:$false

# List updates from WSUS server
Get-WUList -ServiceID "3da21691-e39d-4da6-8a4b-b43877bcb1b7"

# Install updates from WSUS
Get-WUInstall -ServiceID "3da21691-e39d-4da6-8a4b-b43877bcb1b7" -AcceptAll

# Remove WSUS service (switch back to Microsoft Update)
Remove-WUServiceManager -ServiceID "3da21691-e39d-4da6-8a4b-b43877bcb1b7"

# Complete reset using PowerShell
Stop-Service wuauserv, cryptSvc, bits, msiserver

# Clear update cache directories
Remove-Item C:\Windows\SoftwareDistribution -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item C:\Windows\System32\catroot2 -Recurse -Force -ErrorAction SilentlyContinue

# Restart services
Start-Service wuauserv, cryptSvc, bits, msiserver

# Alternative: Use PSWindowsUpdate module
Reset-WUComponents

# Fix 0x8024402F (connection failures)
netsh winhttp reset proxy
netsh winsock reset
ipconfig /flushdns

# Fix 0x80244019 (too many redirects)
wuauclt /resetauthorization
wuauclt /detectnow

# Check and repair system files
sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

# View detailed Windows Update log
Get-WindowsUpdateLog

# Check specific error in Event Viewer
Get-WinEvent -LogName System -MaxEvents 100 | Where-Object {$_.Id -in @(20,21,22,24,25)} | Format-Table TimeCreated, Id, Message -AutoSize

# Check Windows Update service status
Get-Service wuauserv, bits, cryptsvc | Format-Table Name, Status, StartType

# Check update installer status (PowerShell)
Get-WUInstallerStatus

# View pending updates and their status
Get-WindowsUpdate -Verbose

# Check last successful update check
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect" | Select-Object LastSuccessTime

# Verify update history with exit codes
Get-WUHistory | Where-Object {$_.Result -ne "Succeeded"} | Format-Table Date, Title, Result -AutoSize

# Test connectivity to Microsoft update servers
Test-NetConnection -ComputerName "update.microsoft.com" -Port 443
Test-NetConnection -ComputerName "download.windowsupdate.com" -Port 443

# Complete Windows Update troubleshooting script
Write-Host "Stopping Windows Update Services..." -ForegroundColor Yellow
Stop-Service wuauserv, bits, cryptsvc, msiserver -Force

Write-Host "Clearing update cache..." -ForegroundColor Yellow
Remove-Item C:\Windows\SoftwareDistribution\* -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item C:\Windows\System32\catroot2\* -Recurse -Force -ErrorAction SilentlyContinue

Write-Host "Re-registering DLL files..." -ForegroundColor Yellow
$dlls = @("wuaueng.dll","wuapi.dll","wups.dll","wups2.dll","wuwebv.dll","wucltux.dll")
foreach ($dll in $dlls) {
    regsvr32 /s $dll
}

Write-Host "Resetting network components..." -ForegroundColor Yellow
netsh winsock reset
netsh winhttp reset proxy

Write-Host "Restarting services..." -ForegroundColor Yellow
Start-Service wuauserv, bits, cryptsvc, msiserver

Write-Host "Forcing update detection..." -ForegroundColor Yellow
wuauclt /resetauthorization /detectnow

Write-Host "Troubleshooting complete!" -ForegroundColor Green

# Define server list
$servers = Get-Content "C:\servers.txt"

# Install updates on all servers with progress tracking
$results = @()
foreach ($server in $servers) {
    Write-Host "Processing $server..." -ForegroundColor Cyan
    try {
        $result = Invoke-WUJob -ComputerName $server -Script {
            Get-WUInstall -MicrosoftUpdate -AcceptAll -IgnoreReboot
        } -RunNow -Confirm:$false

        $results += [PSCustomObject]@{
            Server = $server
            Status = "Success"
            Time = Get-Date
        }
    } catch {
        $results += [PSCustomObject]@{
            Server = $server
            Status = "Failed: $($_.Exception.Message)"
            Time = Get-Date
        }
    }
}

# Export results to CSV
$results | Export-Csv "C:\UpdateResults.csv" -NoTypeInformation

# Maintenance window script with safety checks
$maintenanceScript = {
    # Pre-update backup
    Write-Host "Creating system restore point..." -ForegroundColor Yellow
    Checkpoint-Computer -Description "Before Windows Updates $(Get-Date)" -RestorePointType MODIFY_SETTINGS

    # Check available disk space
    $disk = Get-PSDrive C
    if ($disk.Free -lt 10GB) {
        Write-Host "Insufficient disk space! Aborting." -ForegroundColor Red
        exit 1
    }

    # Install updates
    Write-Host "Installing updates..." -ForegroundColor Yellow
    $updates = Get-WUInstall -MicrosoftUpdate -AcceptAll -IgnoreReboot -Verbose

    # Post-update verification
    Write-Host "Verifying installation..." -ForegroundColor Yellow
    $failed = Get-WUHistory -Last 10 | Where-Object {$_.Result -eq "Failed"}

    if ($failed) {
        Write-Host "Some updates failed. Review required." -ForegroundColor Red
        $failed | Format-Table Date, Title, Result
    } else {
        Write-Host "All updates installed successfully!" -ForegroundColor Green
    }

    # Schedule reboot
    Write-Host "Scheduling reboot for 3 AM..." -ForegroundColor Yellow
    shutdown /r /t 3600 /c "System will reboot in 1 hour for updates"
}

# Execute during maintenance window
Invoke-Command -ComputerName "ProductionServer" -ScriptBlock $maintenanceScript

# Generate compliance report for all servers
$servers = Get-Content "C:\servers.txt"
$report = @()

foreach ($server in $servers) {
    $pending = Get-WUList -ComputerName $server -MicrosoftUpdate
    $lastUpdate = Get-WUHistory -ComputerName $server -Last 1

    $report += [PSCustomObject]@{
        ServerName = $server
        PendingUpdates = $pending.Count
        LastUpdateDate = $lastUpdate.Date
        LastUpdateTitle = $lastUpdate.Title
        RebootRequired = (Get-WURebootStatus -ComputerName $server).RebootRequired
        ComplianceStatus = if ($pending.Count -eq 0) {"Compliant"} else {"Non-Compliant"}
    }
}

# Export to HTML report
$report | ConvertTo-Html -Title "Windows Update Compliance Report" |
    Out-File "C:\ComplianceReport.html"

# Email report to management
Send-MailMessage -To "[email protected]" -From "[email protected]" `
    -Subject "Monthly Update Compliance Report" -Body "See attached" `
    -Attachments "C:\ComplianceReport.html" -SmtpServer "smtp.company.com"

# Download updates for offline installation
Get-WUOfflineMSU -DestinationPath "C:\OfflineUpdates" -AcceptAll

# Install from MSU files on offline system
$msuFiles = Get-ChildItem "C:\OfflineUpdates\*.msu"
foreach ($msu in $msuFiles) {
    Write-Host "Installing $($msu.Name)..." -ForegroundColor Cyan
    Start-Process wusa.exe -ArgumentList "$($msu.FullName) /quiet /norestart" -Wait
}

# Alternative: Use DISM for offline servicing
DISM /Online /Add-Package /PackagePath:"C:\OfflineUpdates\update.cab"