Why Automate Windows Updates?

Manually updating dozens of servers wastes time and leads to missed patches. PowerShell can automate the entire update process, including reboots.

Step 1: Install PSWindowsUpdate Module

On each server (or via remoting):

Install-Module -Name PSWindowsUpdate -Force
Import-Module PSWindowsUpdate

Step 2: Check Available Updates

Get-WindowsUpdate

Step 3: Install All Updates

Install-WindowsUpdate -AcceptAll -AutoReboot

Step 4: Update Multiple Servers Remotely

$Servers = "Server01", "Server02", "Server03"

Invoke-Command -ComputerName $Servers -ScriptBlock {
    Import-Module PSWindowsUpdate
    Install-WindowsUpdate -AcceptAll -AutoReboot
}

Install Updates Without Reboot

Install-WindowsUpdate -AcceptAll -IgnoreReboot

Schedule Updates

Create a scheduled task to run updates weekly:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\UpdateServers.ps1"
$Trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2am
Register-ScheduledTask -TaskName "Weekly Windows Updates" -Action $Action -Trigger $Trigger -User "SYSTEM"

Generate Update Report

$UpdateHistory = Get-WindowsUpdate -History

$UpdateHistory | Select-Object Title, KB, Result, Date | Export-Csv -Path "C:\UpdateReport.csv"

Best Practices

  • Test updates on non-production servers first
  • Schedule updates during maintenance windows
  • Exclude critical updates that need testing
  • Monitor update status with email reports
  • Keep update logs for compliance

Rollback Updates

Get-WindowsUpdate -History | Where-Object {$_.KB -eq "KB5001234"} | Uninstall-WindowsUpdate