Install Windows updates from PowerShell with PSWindowsUpdate

The Settings app is fine for occasional updates, but it hides detail and is hard to automate. PSWindowsUpdate is a popular community module from the PowerShell Gallery that drives Windows Update from the command line. You can see exactly what will install, choose what to skip, decide when to restart and run the whole thing on a schedule.

Before you start

• Administrator access over Remote Desktop to 203.0.113.10:3389.
• Windows PowerShell 5.1 (built in) or PowerShell 7, running as Administrator.
• Outbound internet access to the PowerShell Gallery.
• A quiet time to install, because many updates need a restart.

Install the module

On older servers, enable TLS 1.2 for the session first, so PowerShell can talk to the Gallery:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Then install the module:

Install-Module -Name PSWindowsUpdate -Force

If asked to install the NuGet provider, answer Y. If asked whether to trust the PSGallery repository, answer Y as well.

Load it and check it works:

Import-Module PSWindowsUpdate
Get-Command -Module PSWindowsUpdate | Measure-Object

A count above zero means the commands are available.

If you see an error that running scripts is disabled, see Fix "running scripts is disabled" in PowerShell.

List available updates

Get-WindowsUpdate

The scan can take a few minutes. The result lists each update with its KB number, size and title, for example:

ComputerName Status     KB          Size Title
------------ ------     --          ---- -----
WEB01        -------    KB5044281  412MB 2026-10 Cumulative Update for ...
WEB01        -------    KB890830    78MB Windows Malicious Software Removal Tool ...

To include updates for other Microsoft products, such as SQL Server or.NET, add -MicrosoftUpdate. The first time, you may need to register the Microsoft Update service:

Add-WUServiceManager -MicrosoftUpdate

Install updates

Install everything that is available, without restarting:

Install-WindowsUpdate -AcceptAll -IgnoreReboot

• -AcceptAll answers "yes" to every update, so it does not ask one by one.
• -IgnoreReboot installs but does not restart. You restart later.

To install only certain updates by KB number:

Install-WindowsUpdate -KBArticleID KB5044281 -AcceptAll -IgnoreReboot

To skip one update, hide it so it is not offered again:

Hide-WindowsUpdate -KBArticleID KB5044281 -Confirm:$false

Use Show-WindowsUpdate with the same KB to unhide it later.

Control reboots

Check whether a restart is waiting:

Get-WURebootStatus -Silent

True means a restart is needed. Restart when it suits you:

Restart-Computer

If you do want an automatic restart straight after installing, replace -IgnoreReboot with -AutoReboot. Only use that when you are sure nothing important is running.

Review what was installed

Get-WUHistory -MaxDate (Get-Date).AddDays(-30) |
  Select-Object Date, KB, Result, Title

Result shows Succeeded or Failed for each update.

Run updates on a schedule

You can run PSWindowsUpdate from Task Scheduler. This example installs updates every Sunday at 03:00 without restarting and writes a log:

$cmd = 'Import-Module PSWindowsUpdate; Install-WindowsUpdate -AcceptAll -IgnoreReboot | Out-File C:\Logs\wu.log -Append'
$action  = New-ScheduledTaskAction -Execute 'powershell.exe' `
  -Argument "-NoProfile -ExecutionPolicy Bypass -Command `"$cmd`""
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 3am
Register-ScheduledTask -TaskName 'Weekly Windows Updates' -Action $action `
  -Trigger $trigger -User 'SYSTEM' -RunLevel Highest

Create the C:\Logs folder first. The task runs as SYSTEM, so the module must be installed for all users, which is the default when you install it from an elevated prompt.

Plan a separate, known restart time, for example with a scheduled reboot, so updates finish installing.

Check it works

After installing and restarting:

1. Run Get-WindowsUpdate again. The installed updates should no longer appear.
2. Run Get-WURebootStatus -Silent. It should return False.
3. Check the build revision with winver. It should have increased after a cumulative update.

Troubleshooting

• "Unable to resolve package source" or no NuGet provider: TLS 1.2 is not enabled for the session. Run the TLS line above and try again.
• Install-WindowsUpdate returns nothing: no updates are available, or Windows Update is paused. Check Settings → Windows Update.
• An error code starting with 0x8024: these come from the Windows Update agent, often because it cannot reach Microsoft's servers. See Fix Windows Update error codes.
• Scheduled task runs but nothing installs: open the log file. A missing module or execution policy error usually shows there.

Next steps

• Undo a bad update: View update history and uninstall a bad Windows update.
• General update routine: Windows Update and server maintenance.