PowerShell Windows Update: Check and Install Updates
─□✕

PowerShell Windows Update: Check and Install Updates

PowerShell Tips Editor 4 min read
PowerShell Windows Update: Check and Install Updates

Patch Tuesday arrives, and clicking through Windows Update on 50 machines is not a workflow — it’s a full day of wasted time. PowerShell Windows Update automation is possible with the community PSWindowsUpdate module, which wraps the Windows Update Agent API and lets you check, install, schedule, and report on patches from the command line or across remote machines. This post covers the complete workflow from module installation through automated remote patching.

Install PSWindowsUpdate Module

The PSWindowsUpdate module is not built into Windows — install it from the PowerShell Gallery. You need administrator rights and the machine needs internet access to the Gallery (or use an internal repository).

# Install for the current user (no admin needed)
Install-Module -Name PSWindowsUpdate -Scope CurrentUser -Force

# Install for all users (admin required)
Install-Module -Name PSWindowsUpdate -Force

# Verify installation
Get-Module -Name PSWindowsUpdate -ListAvailable

If the Gallery is not accessible, you can download the module from a connected machine and copy it to $env:PROGRAMFILES\WindowsPowerShell\Modules\PSWindowsUpdate.

Check for Available Updates

Get-WindowsUpdate queries Windows Update (or WSUS if configured) and returns a list of available updates without installing anything. Review this list before deciding what to apply.

Import-Module PSWindowsUpdate

# List all available updates
Get-WindowsUpdate
ComputerName  Status  KB          Size    Title
------------  ------  --          ----    -----
WORKSTATION   -------  KB5034441  100 MB  2026-04 Cumulative Update for Windows 11
WORKSTATION   -------  KB890830   1  MB   Windows Malicious Software Removal Tool
# Filter to security updates only
Get-WindowsUpdate -Category "Security Updates"

# Check how many updates are available
(Get-WindowsUpdate).Count

Install All Updates

Use Install-WindowsUpdate to apply updates. By default it prompts for confirmation on each update — use -AcceptAll to proceed automatically. -AutoReboot triggers an automatic reboot if one is required.

# Install all available updates, accept prompts automatically
Install-WindowsUpdate -AcceptAll -Verbose

# Install and automatically reboot if needed
Install-WindowsUpdate -AcceptAll -AutoReboot

# Install without rebooting (deferred reboot)
Install-WindowsUpdate -AcceptAll -IgnoreReboot

Install Specific KB Numbers

Target a specific KB article by passing the KB number to -KBArticleID. This is the right approach when you’re deploying a targeted patch outside of normal maintenance windows — for example, an emergency zero-day fix.

# Install a specific KB
Install-WindowsUpdate -KBArticleID "KB5034441" -AcceptAll

# Install multiple specific KBs
Install-WindowsUpdate -KBArticleID "KB5034441", "KB890830" -AcceptAll

Schedule Updates Remotely

Combine Invoke-Command with PSWindowsUpdate to install updates on remote machines. The module must be present on the remote machine — deploy it first with Invoke-Command.

$servers = @("server01", "server02", "server03")

# Install PSWindowsUpdate on remote machines first
Invoke-Command -ComputerName $servers -ScriptBlock {
    if (-not (Get-Module -Name PSWindowsUpdate -ListAvailable)) {
        Install-Module -Name PSWindowsUpdate -Force -Confirm:$false
    }
}

# Install updates on all remote machines
Invoke-Command -ComputerName $servers -ScriptBlock {
    Import-Module PSWindowsUpdate
    Install-WindowsUpdate -AcceptAll -IgnoreReboot -Verbose
} -AsJob  # Run as background jobs for parallel execution

# Wait for jobs and get results
Get-Job | Wait-Job | Receive-Job

Get Update History

Review which updates have been installed and when with Get-WUHistory. This is useful for compliance reporting and for confirming a patch was actually applied.

# Last 20 installed updates
Get-WUHistory -MaxResults 20 | Select-Object Date, KB, Title, Result

# Check if a specific KB is installed
Get-WUHistory | Where-Object KB -eq "KB5034441"
Date                 KB         Title                                         Result
----                 --         -----                                         ------
5/1/2026 2:13:00 AM  KB5034441  2026-04 Cumulative Update for Windows 11     Succeeded

Common Errors and Fixes

  • Module requires admin rights to install updates: Install-WindowsUpdate requires an elevated PowerShell session — it calls the Windows Update Agent API which requires administrator privileges. Running without elevation produces “Access Denied” errors. When deploying remotely, ensure the credential used with Invoke-Command has local admin rights on the target machines.
  • WSUS vs Windows Update direct: On machines configured to use WSUS (via Group Policy), PSWindowsUpdate queries the WSUS server by default. To override and query Windows Update directly, use -MicrosoftUpdate: Get-WindowsUpdate -MicrosoftUpdate. Be aware this may bypass your organization’s approval workflow — use it only in authorized scenarios.

Related Cmdlets / See Also

Wrapping Up

PSWindowsUpdate turns Patch Tuesday from a manual chore into a script run — check, install, and verify across your entire fleet from a single PowerShell session. As a next step, combine the remote update script with a pre-patch snapshot of installed KBs and a post-patch check of update history to generate an automatic patch compliance report.

#patches#pswindowsupdate#security#windows-update
Send-Item -To