Windows Update PowerShell Generator

Free Windows Update PowerShell Command Generator

Windows Update has accumulated three generations of command-line interfaces, and which one works depends on the Windows version in front of you. wuauclt was the answer on Windows 7 and Server 2012 and is mostly inert on Windows 10 and 11. usoclient replaced it, runs silently, and is barely documented. The PSWindowsUpdate PowerShell module is the only option that gives real output and manages remote machines properly — and it is not installed by default. This generator picks a working command for the action you want, on the platform you have, for local or remote targets, and chains several actions into one copy-paste script.

It generates text only. Nothing runs, no machine is contacted, and no credentials are involved. You copy the script, read it, and run it yourself in an elevated PowerShell window.

How to Use the Generator

1. Choose an action. Check for updates, download, install, cancel a running update, view history, hide a KB, uninstall a KB, pause, resume, or reboot to finish.
2. Choose local or remote. For remote, enter one or more computer names; the generator builds the correct Invoke-Command or Invoke-WUJob wrapper and lists the machines as a PowerShell array.
3. Pick a method. Only the methods that actually support your chosen action are offered. Switching actions keeps your current method if it still applies and falls back to the recommended one if it does not.
4. Set options. A KB number where the action needs one, driver inclusion, and auto-reboot behaviour appear only when the selected method supports them.
5. Chain steps and copy. Add the current command as a step and build the next one. The assembled script carries a header stating whether it needs elevation, the PSWindowsUpdate module, or WinRM on the targets.

Elevation, Downtime, and What Each Command Costs You

Nine of the ten actions require an elevated PowerShell session — only viewing update history runs as a standard user. The generated script says so in its header when any step needs it, but it is worth being explicit about which commands change state and which can take a machine offline.

Two of these deserve a hard pause before you press enter. The reboot action emits Restart-Computer -Force, which restarts the machine immediately — anyone logged in loses unsaved work, and against a remote list it restarts every machine in that list at once. The generator prefixes those commands with an explicit warning comment for exactly that reason, and offers the -Wait -For PowerShell -Timeout 600 variant so a script can wait for each machine to come back before continuing. The uninstall action removes a security patch; if you are backing out a bad update, make sure you know what vulnerability the machine is exposed to again in the meantime, and plan to reinstall or replace it.

Method Reference

Worked Examples

Install a specific patch locally without restarting. Choosing install, the PSWindowsUpdate method, KB5001234, and leaving auto-reboot off produces:

Install-WindowsUpdate -KBArticleID KB5001234 -AcceptAll -IgnoreReboot

-IgnoreReboot is what keeps the machine up; switch auto-reboot on and it becomes -AutoReboot, which restarts as soon as the install requires it.

Check what is available on three servers. Selecting remote targets wraps the scan in a job against a PowerShell array:

Get-WindowsUpdate -ComputerName @('SRV01','SRV02','SRV03')

Stop an update that is mid-flight. The cancel action produces a sequence rather than a single command: stop wuauserv, usosvc, and bits, remove every in-progress BITS transfer, then start the services again so future updates still work. The generated comments state the limitation plainly — an update already past the installing stage will complete on the next reboot regardless, and has to be uninstalled afterwards.

Pause updates for a change freeze. The pause action writes an expiry timestamp to HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings at a date you choose; resume removes that value and triggers a fresh scan.

Prerequisites for Remote Targets

Remote actions need PowerShell remoting enabled on each target, which means running Enable-PSRemoting -Force on the machine itself — a step you cannot bootstrap remotely with these commands. The generated script includes that reminder in its header whenever any step targets a remote computer.

The other constraint is specific to Windows Update: it will not install updates through a normal remote session, because the update agent refuses to run under a network logon token. That is why the PSWindowsUpdate method uses Invoke-WUJob, which registers a scheduled task on the target running as SYSTEM, rather than plain Invoke-Command. If a remote install appears to do nothing, this double-hop restriction is almost always the reason.

Frequently Asked Questions

Does this tool run any commands on my machines?

No. It assembles script text in your browser. Nothing executes, no host is contacted, and no credentials are collected. You copy the script and run it yourself, which gives you the chance to review it first.

Why does wuauclt /detectnow do nothing on Windows 11?

Because Microsoft replaced the Windows Update Agent’s command surface with the Update Session Orchestrator. On Windows 10 and 11 the old switches are accepted and ignored. Use usoclient or the PSWindowsUpdate module instead; the generator marks wuauclt as legacy for this reason.

I ran a usoclient command and nothing happened. Is it broken?

Probably not. usoclient returns immediately and does its work in the background with no console output. Open Settings > Windows Update to see the scan, download, or install progress.

How do I install the PSWindowsUpdate module?

Run Install-Module PSWindowsUpdate -Force from an elevated PowerShell session. It comes from the PowerShell Gallery, so the machine needs outbound access to it, and you may be prompted to trust the repository the first time.

Can I install updates on a remote computer with Invoke-Command?

Not reliably. The Windows Update agent blocks installs initiated over a remote session token. Invoke-WUJob works around this by scheduling a task that runs locally as SYSTEM, which is what the generator emits for remote installs.

What is the difference between hiding and uninstalling a KB?

Hiding prevents an update from being offered or installed in the first place — useful when a known-bad patch is pending. Uninstalling removes one that is already applied, which reintroduces whatever it fixed and often requires a restart. Hide before it lands, uninstall only when it already has.

Will the reboot action warn logged-in users?

No. Both Restart-Computer -Force and usoclient RestartDevice restart immediately with no countdown and no prompt. Unsaved work is lost. Schedule it, or use the -Wait variant in a controlled maintenance window.

How long can I pause updates?

Windows caps consumer pause at 35 days from the current date. Setting a longer expiry in the registry does not extend it — the setting is clamped. For longer or policy-driven deferrals, use Windows Update for Business policies or your patch management platform.

Which related tools help with the rest of a patch window?

The Exchange Online PowerShell command builder covers mailbox-side administration in the same style, and the MTBF/MTTR calculator helps quantify how much a reboot window actually costs in availability terms.