If you go check the PowerShell Gallery you will find a great module in the top 100 downloads called PSWindowsUpdate. This is one of my favorite modules because it fits a specific need that many organizations have, which is orchestrating the deployment of Windows updates. There are many great cmdlets in this module, but the one I will focus on today is Invoke-WUInstall, used to install Windows updates remotely.

Dan Franciscus

Dan Franciscus is a systems engineer and VMware Certified Professional (VCP) specializing in VMware, PowerShell, and other Microsoft-based technologies. You can reach Dan at his blog or his Twitter at @dan_franciscus.

Installing PSWindowsUpdate ^

Since PSWindowsUpdate is not installed on Windows by default, we have to first install the module. Luckily, we can do this easily from the PowerShell Gallery. Note I am using an older version from July 2017 (1.5.2.6).

If we run Get-Command we can see all of the commands in the PSWindowsUpdate module:

How Invoke-WUInstall works ^

One different aspect of using Invoke-WUInstall is that it does not use traditional PowerShell remoting methods to perform Windows update installs. When you look at the source code, it actually creates and immediately runs a scheduled task on the remote machine under the SYSTEM account.

A typical use of Invoke-WUInstall would be:

In this command we see Get-WUInstall, which is the command PSWindowsUpdate uses to install updates, usually from your Windows Server Update Services (WSUS) server. Get-WUInstall simply uses a COM object for Windows updates to perform the tasks needed. Notice also the use of the -AcceptAll parameter, which means it will automatically accept any updates to install.

One nice feature of Invoke-WUInstall is that it actually installs the PSWindowsUpdate module on the remote machine (if it isn't there already). This is great when you are using the module on a new machine, or when you decide to use it for the first time.

As you can see, the scheduled task is going to run ipmo PSWindowsUpdate; Get-WUInstall  -AcceptAll -AutoReboot  | Out-File C:\PSWindowsUpdate.log. Using Out-File will ensure the logs of downloading and installing updates are visible so we can check against them later.

Install updates on multiple machines ^

The true power of Invoke-WUInstall is when you have to install updates on many machines at once. This is very easy to do, all you need is to add machines to the ‑ComputerName parameter, which then processes them in a loop (not in parallel unfortunately).

Finding errors ^

One great reason to output to a log on the remote machine is to confirm that no errors installing updates on these remote machines occurred. With some simple PowerShell, we can query these log files and search for failures.

Here is what a typical log looks like after using Get-WUInstall -AcceptAll | Out-File C:\ PSWindowsUpdate.log:

Invoke WUInstall log

Invoke WUInstall log

It includes the status of the update, its KB number, size, and title—all great information to have handy when installing updates.

Using Invoke-Command, Get-Item, and Select-String, we can use a quick technique to easily work through any computers used with Invoke-WUInstall and find Windows updates that failed to install:

Conclusion ^

While there are other solutions for managing Windows update deployment, PSWindowsUpdate provides a Windows admin a free and very powerful tool to manage updates. With some simple PowerShell scripting, an admin can orchestrate updates across the enterprise in conjunction with WSUS as well.

Join the 4sysops PowerShell group!

Your question was not answered? Ask in the forum!

8+

Users who have LIKED this post:

  • avatar
  • avatar
Share
30 Comments
  1. geert 2 years ago

    I don't have the Invoke-WUInstall cmd

    2+

    • Author
      Dan Franciscus 2 years ago

      Sorry should have specified this. Its not a builtin PowerShell module.

      https://www.powershellgallery.com/packages/PSWindowsUpdate/2.0.0.4

      Install by doing:

      Install-Module PSWindowsUpdate

      2+

      • Caleb 2 years ago

        I just installed this module, and the "Invoke-WUInstall' cmdlet is not available.

        1+

        • Author
          Dan Franciscus 2 years ago

          Sorry its in version 1 it seems. I never realized major changes were made to newer versions.

          3+

          Users who have LIKED this comment:

          • avatar
    • Adam 1 day ago

      The newer version 2.1.1.2 doesn't utilize the Invoke-WUInstall.

      I believe the cmdlet Get-WindowsUpdate is the switch to use I believe. I am looking into this to see about making it work for me as well.

      0

  2. Jimmy 2 years ago

    I also don't have this cmdlet on my PS. But i found this one: Install-WUUpdates, wight does the same thing?

    1+

  3. Paolo Frigo 2 years ago

    Maybe I'm wrong but I think the cmd-let is included on Michael Gajda's
    Windows Update PowerShell Module

     

    1+

  4. James 2 years ago

    You can't see the source code anymore since version 2.0. It also is significantly slower. Has anyone had any luck getting in contact with Michael Gadja the creator?

    1+

    • Author
      Dan Franciscus 2 years ago

      Darn thats a shame. I couldnt find it on Github. Maybe he is going to try and sell it lol.

      1+

  5. Caleb 2 years ago

    The Invoke-WUInstall was removed from this module starting with version 2.0.0.0 last October.

    3+

    Users who have LIKED this comment:

    • avatar
    • Author
      Dan Franciscus 2 years ago

      Yep, I am going to update the article specifying I was using an older version.

      2+

      Users who have LIKED this comment:

      • avatar
      • Luc Fullenwarth 2 years ago

        I discovered the new version a few weeks ago and there are some breaking changes but also new interesting cmdlets.

        1+

  6. Jimmy 2 years ago

    So PS cmdlet on above article works only if you have the old version?

    There is no other way of doing this? Because this could be very handy for me.

    1+

    • Caleb 2 years ago

      @Jimmy, I believe this is how you run the command on the newer version:

      That command would run the updates at 6:00pm today.

      3+

  7. Octavio 1 year ago

    I think this wont work in 2016 server, does it?

    1+

  8. Stiven Castro 10 months ago

    Hi

    Does anyone knows if this works on Azure VM's?

     

    0

    • Luc Fullenwarth 10 months ago

      @Stiven Castro

      Yes it works also on Azure VMs.

      If you want to run it locally, just install the module.

      If you want to run it remotely you have to open the remoting ports and also ensure your local account is an administrator of the remove VM.

      0

  9. nanodroid 6 months ago

    Running this command on a 2016 server it seems to complete but no updates are accually installed, does this work for 2016 server or is there a different command for it.

     

     

    0

    • Luc Fullenwarth 6 months ago

      @nanodroid

      The Get-WUInstall is misleading because the cmdlet only lists updates. You must use the -Install parameter in order to effectively install updates.

      0

  10. Chandan 6 months ago

    is there any option to get system restart notification if restart is required during windows update ?

    0

  11. Antonio 5 months ago

    You've mentioned, this Module will actually install the module on the remote server if its missing - but how? Will it use the local resources?

    Does that mean, that all servers must have internet connectivity? If yes - how can I implement it without internet connection?

    0

  12. Andreas 4 months ago

    I want to use this script to remotely install ONLY a particular update. The latest Windows feature version(1903 today). I don't want to start an all out update of all the latest updates on the remote computer, just the 1903 feature update. How can i use this script to achieve that?

    1+

    • Jonathan Baynes 2 months ago

      Diddo. I somehow doubt it. I've not found a good way to do this without system center. I have lots of remotely managed devices. I'm a small MSP, and I've not found a good way to push 1903 out yet. Anyone have a comment on that? 

       

      Only think i have seen is downloaded the iso, extracting it to a folder, and then I'd have to push that entire folder out and could run a command to force the update. But it would be much better if a powershell command could initiate the process including the download from Microsoft. 

      0

      • Ben 2 months ago

        I use PDQ in my company using an extracted ISO, I copy the files locally (but you could probably run from a network location too).

        I use the command line:

        We use this method because we have issues with windows index/windows search corruption and have to stop the service before the update - probably because we have gpo-restricted cortana/windows search significantly.

        0

  13. uminds 3 months ago

    I am trying to install update remotely on a Windows 2016 server and it wasn't success. I used the following cmdlet.

    pswindowsupdate 2.0 is installed locally on the server

    invoke-wujob -comp server1 -runnow -cred $(get-credential) -script {get-windowsupdate -install -acceptall}

    It always said access denied. The account I used is domain admin. I am however able to use invoke-command and run the scriptblock get-windows update. What other permission I need for this?

    Thanks

    0

  14. Piyush Pandya 2 months ago

    Where you mention, that PSWindowsUpdate will install on the remote server if it is not there, does the remote server need Internet access to install PSWindowsUpdate?  Or does it take from an internal location? Can we specify a location?

    0

  15. Jennie 2 months ago

    You might want to include the following commands:

    Set-ExecutionPolicy RemoteSigned

    This allows you to run the script on the comptuer

    Import-Module PSWindowsUpdate

    This imports the module so you can use it

    If the PC doesn't have internet access, you can copy the PSWindowsUpdate folder from C:\Windows\System32\WindowsPowerShell\v1.0 folder from a computer with internet to the same folder on the non-internet computer. Then run:

    Set-ExecutionPolicy RemoteSigned
    Import-Module PSWindowsUpdate

    1+

Leave a reply

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2019

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account