Windows update powershell script

Question

Windows update powershell script

Jan Vávra 446

I wanna write following orchestration that will be run regulary:

Remove VM from load balancer
Test if there are some active connections to a service on a VM.
Invoke a powershell script that will install windows updates and do a OS reboot.
Check status page of service.
Return a VM to a pool.

I have problem with the pwsh script on Windows Server 2022. It declares that updates were installed but doesn't make restart and the list of updates from GUI / Settings / Updates is not empty.

The core calls

Get-WindowsUpdate -MicrosoftUpdate -AcceptAll |
    Install-WindowsUpdate -AcceptAll -AutoReboot -Verbose 4

Should I use powershell 7?
The default is
PSVersion 5.1.20348.2849

Isn't there a standard solution?

The full script is


param(
    [string]$Command
)

# --- Global paths & logging ---
$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Definition
$ScriptPath = $MyInvocation.MyCommand.Path
Write-Host $ScriptPath

$LogFile   = Join-Path $ScriptDir ("AutoUpdate_" + (Get-Date -Format "yyyy-MM") + ".log")
# Ensure log directory exists
New-Item -ItemType Directory -Path $ScriptDir -Force | Out-Null


function Write-Log {
    param([Parameter(Mandatory)][string]$Message)
    $ts = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
    $line = "[$ts] $Message"
    Write-Host $line
    Add-Content -Path $LogFile -Value $line
}

function Ensure-PSWindowsUpdate {
    Write-Log "Checking PSWindowsUpdate module..."
    try {
        if (-not (Get-Module -ListAvailable -Name PSWindowsUpdate)) {
            Write-Log "Installing NuGet provider and PSWindowsUpdate..."
            Install-PackageProvider -Name NuGet -Force -ErrorAction Stop
            # Try global (preferred when running as admin/SYSTEM)
            try {
                Install-Module -Name PSWindowsUpdate -Force -Scope AllUsers -ErrorAction Stop
            } catch {
                # Fallback to CurrentUser scope (may work for interactive runs)
                Install-Module -Name PSWindowsUpdate -Force -Scope CurrentUser -ErrorAction Stop
            }
        }
        Import-Module PSWindowsUpdate -ErrorAction Stop
        Write-Log "PSWindowsUpdate is available."
        return $true
    } catch {
        Write-Log "ERROR ensuring PSWindowsUpdate: $($_.Exception.Message)"
        return $false
    }
}

function Invoke-AutoUpdate {
    <#
      .SYNOPSIS
        Searches, downloads and installs updates; reboots automatically if needed.
      .NOTES
        Run elevated. Best run as SYSTEM for reliability on servers.
    #>
    Write-Log "===== Starting Windows Update Process ====="
    try {
        if (-not (Ensure-PSWindowsUpdate)) {
            throw "PSWindowsUpdate module unavailable."
        }

        Write-Log "Ensuring Windows Update service is running..."
        Set-Service wuauserv -StartupType Manual
        Start-Service wuauserv

        Write-Log "Searching for and installing updates..."
        # -AutoReboot triggers reboot when required after install        
        # Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot -Install -Verbose 4>&1 |
        Get-WindowsUpdate -MicrosoftUpdate -AcceptAll |
            Install-WindowsUpdate -AcceptAll -AutoReboot -Verbose 4>&1 |
            ForEach-Object {
                if ($_ -is [System.Management.Automation.VerboseRecord]) {
                    Write-Log $_.Message
                }
            elseif ($_ -is [string]) {
                Write-Log $_
            }
        }


        Write-Log "Update workflow finished (system may reboot if required)."
    } catch {
        Write-Log "ERROR during update: $($_.Exception.Message)"
        throw
    } finally {
        Write-Log "===== Windows Update Script Completed ====="
    }
}

function Register-AutoUpdateTask {
    <#
      .SYNOPSIS
        Registers a weekly scheduled task to run this script.
      .PARAMETER RunAs
        'System' (default), 'NetworkService', or 'LocalService'
      .PARAMETER DayOfWeek
        Day to run (default: Monday)
      .PARAMETER Time
        Time to run in HH:mm (24h) (default: 04:00)
      .PARAMETER TaskName
        Name of the scheduled task
    #>
    param(
        [ValidateSet('System','NetworkService','LocalService')]
        [string]$RunAs = 'System',
        [ValidateSet('Sunday','Monday','Tuesday','Wednesday','Thursday','Friday','Saturday')]
        [string]$DayOfWeek = 'Monday',
        [ValidatePattern('^[0-2]\d:[0-5]\d$')]
        [string]$Time = '04:00',
        [string]$TaskName = 'Software602\WinUpdate'
    )

    # Map to principal identities
    switch ($RunAs) {
        'System'         { $userId = 'SYSTEM' }
        'NetworkService' { $userId = 'NT AUTHORITY\NetworkService' }
        'LocalService'   { $userId = 'NT AUTHORITY\LocalService' }
    }


    try {            
    
        # Build action to run this script
        $escaped = $ScriptPath.Replace('"','`"')
        $action = New-ScheduledTaskAction -Execute 'powershell.exe' `
            -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$escaped`" -Command Invoke-AutoUpdate"

        # Trigger
        $hour, $min = $Time.Split(':')
        $at = Get-Date -Hour $hour -Minute $min -Second 0
        $trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek $DayOfWeek -At $at

        # Principal
        $principal = New-ScheduledTaskPrincipal -UserId $userId -RunLevel Highest -LogonType ServiceAccount

        # Settings (retry if missed, stop on battery constraints off)
        $settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -AllowStartIfOnBatteries `
            -DontStopIfGoingOnBatteries -MultipleInstances IgnoreNew

        # Register
        Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger `
            -Principal $principal -Settings $settings -Description "Installs Windows Updates and reboots if needed." -Force

        $msg = "Scheduled task '$TaskName' registered to run as '$RunAs' every $DayOfWeek at $Time."
        Write-Log $msg
        Write-Host $msg

    }
    catch {
        $err = $_.Exception.Message
        $msg = "Failed to create scheduled task action: $err"
        Write-Log $msg
        Write-Warning $msg
    }    
}

switch ($Command) {
    'Invoke-AutoUpdate' { Invoke-AutoUpdate }
    'Register-AutoUpdate' { Register-AutoUpdateTask -RunAs System }
    default { Write-Host "No valid -Command specified. Options: Invoke-AutoUpdate, Register-AutoUpdate" }
}

Manish Deshpande 1,485 Reputation points Microsoft External Staff Moderator

2025-11-11T08:56:40.09+00:00
Hello @Jan Vávra

Thanks for reaching out to Microsoft Q&A.

The -AutoReboot flag in PSWindowsUpdate does not always trigger a restart on Windows Server 2022.

Pending reboot state remains even after updates are applied.

We recommend the following steps:

Run the update script elevated or as SYSTEM via Task Scheduler.

Use the correct command:
Get-WindowsUpdate -MicrosoftUpdate -AcceptAll | Install-WindowsUpdate -AcceptAll -Install -AutoReboot -Verbose

Add an explicit reboot check:
if (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired") { Restart-Computer -Force
Show more lines

Schedule the script weekly using Task Scheduler with SYSTEM privileges.

Validate post-update status and confirm no pending updates remain.

This approach ensures updates are installed, the system reboots when required, and the VM returns to service seamlessly.

Thanks,
Manish Deshpande

Jan Vávra 446

Thanks, testing the registry caused required restart.

But still at gui I can see some pending updates that weren't installed by the Install-WindowsUpdate cmdlet.

obrazek

I enhanced the pws by some UsoClient.exe but it didn't help.

Write-Log "Searching for and installing updates..."

        $updates = Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -ErrorAction SilentlyContinue
        if (-not $updates -or $updates.Count -eq 0) {
            Write-Log "No updates detected by PSWindowsUpdate. Triggering UsoClient..."
            try {
                Start-Process -FilePath "UsoClient.exe" -ArgumentList "StartScan" -Wait -NoNewWindow
                Start-Process -FilePath "UsoClient.exe" -ArgumentList "StartDownload" -Wait -NoNewWindow
                Start-Process -FilePath "UsoClient.exe" -ArgumentList "StartInstall" -Wait -NoNewWindow
                Write-Log "UsoClient triggered successfully. Updates should now install automatically."
            }
            catch {
                Write-Log "ERROR: UsoClient execution failed: $($_.Exception.Message)"
            }
        }
        else {
            Write-Log "Installing updates found by PSWindowsUpdate..."
            $updates | Install-WindowsUpdate -AcceptAll -AutoReboot -Verbose 4>&1 |
            ForEach-Object {
                if ($_ -is [System.Management.Automation.VerboseRecord]) {
                    Write-Log $_.Message
                }
                elseif ($_ -is [string]) {
                    Write-Log $_
                }
            }
        }

Manish Deshpande 1,485 Reputation points Microsoft External Staff Moderator

2025-11-17T05:27:41.01+00:00
Hello Jan Vávra

The Install-WindowsUpdate cmdlet may not install some cumulative or .NET updates right away if extra steps or a restart are needed. Also, running UsoClient.exe manually might not work if Windows Update is managed or restricted by Group Policy.

Verify Update Status:

Get-WindowsUpdateLog Get-WindowsUpdate -MicrosoftUpdate

Confirm which updates are pending and whether they require a restart.

Restart Windows Update Services:

Stop-Service wuauserv Stop-Service bits Start-Service wuauserv Start-Service bits

Force Update Scan and Install:

Use PSWindowsUpdate with elevated privileges

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot -Verbose

Ensure -AutoReboot is included to apply updates requiring restart.

Clear Update Cache (if issue persists) :
net stop wuauserv net stop bits Remove-Item -Path "C:\Windows\SoftwareDistribution" -Recurse -Force net start wuauserv net start bits
Then re-run the Install-WindowsUpdate command.

Validate Post-Installation:

After reboot, confirm no pending updates.

If updates still fail, check for Group Policy settings or WSUS configuration that might restrict installations.

Thanks,
Manish Deshpande
Manish Deshpande 1,485 Reputation points Microsoft External Staff Moderator

2025-11-18T05:34:47.3666667+00:00

Hello Jan Vávra

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail.

Jan Vávra 446

I went over all these steps and got the same result in gui - pending install.

PS C:\Users\Administrator\Documents> Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot -Verbose
VERBOSE: WIN-9F5J51OVNL1 (11/18/2025 8:43:48 PM): Connecting to Microsoft Update server. Please wait...
VERBOSE: Found [0] Updates in pre search criteria
PS C:\Users\Administrator\Documents> net stop wuauserv
The Windows Update service is stopping.
The Windows Update service was stopped successfully.
PS C:\Users\Administrator\Documents>   net stop bits
The Background Intelligent Transfer Service service is not started.
More help is available by typing NET HELPMSG 3521.
PS C:\Users\Administrator\Documents>   Remove-Item -Path "C:\Windows\SoftwareDistribution" -Recurse -Force
PS C:\Users\Administrator\Documents>   net start wuauserv
The Windows Update service is starting.
The Windows Update service was started successfully.
PS C:\Users\Administrator\Documents>   net start bits
The Background Intelligent Transfer Service service is starting.
The Background Intelligent Transfer Service service was started successfully.
PS C:\Users\Administrator\Documents> Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot -Verbose
VERBOSE: WIN-9F5J51OVNL1 (11/18/2025 8:44:49 PM): Connecting to Microsoft Update server. Please wait...
VERBOSE: Found [0] Updates in pre search criteria

In my script I have
$updates = Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -ErrorAction SilentlyContinue
$updates | Install-WindowsUpdate -AcceptAll -AutoReboot -Verbose 4>&1

I took the Windows server ISO cs-cz_windows_server_2022_updated_feb_2025_x64_dvd_0398a40c.iso
changed it display language to english.

The default setup for windows update is that is "Controlled by your organization".
It actually means that updates will be downloaded but not installed automatically, nor the system will be restarted. That's default setup delivered by Microsoft.

It means
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\AU is 3. This key is missing but its behaves in that manner.

I need a simple command: "Perform any updates you want and restart the OS if needed."
I thought the

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot -Verbose

will do it. But it doesn't ;-(

2 answers

Your answer

Manish Deshpande 1,485 Reputation points Microsoft External Staff Moderator

2025-11-11T08:56:40.09+00:00

Hello @Jan Vávra

Thanks for reaching out to Microsoft Q&A.

The -AutoReboot flag in PSWindowsUpdate does not always trigger a restart on Windows Server 2022.

Pending reboot state remains even after updates are applied.

We recommend the following steps:

Run the update script elevated or as SYSTEM via Task Scheduler.

Use the correct command:
Get-WindowsUpdate -MicrosoftUpdate -AcceptAll | Install-WindowsUpdate -AcceptAll -Install -AutoReboot -Verbose

Add an explicit reboot check:
if (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired") { Restart-Computer -Force
Show more lines

Schedule the script weekly using Task Scheduler with SYSTEM privileges.

Validate post-update status and confirm no pending updates remain.

This approach ensures updates are installed, the system reboots when required, and the VM returns to service seamlessly.

Thanks,
Manish Deshpande
Jan Vávra 446 Reputation points

2025-11-12T20:15:29.0466667+00:00

Thanks, testing the registry caused required restart.

But still at gui I can see some pending updates that weren't installed by the Install-WindowsUpdate cmdlet.

I enhanced the pws by some UsoClient.exe but it didn't help.

Write-Log "Searching for and installing updates..." $updates = Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -ErrorAction SilentlyContinue if (-not $updates -or $updates.Count -eq 0) { Write-Log "No updates detected by PSWindowsUpdate. Triggering UsoClient..." try { Start-Process -FilePath "UsoClient.exe" -ArgumentList "StartScan" -Wait -NoNewWindow Start-Process -FilePath "UsoClient.exe" -ArgumentList "StartDownload" -Wait -NoNewWindow Start-Process -FilePath "UsoClient.exe" -ArgumentList "StartInstall" -Wait -NoNewWindow Write-Log "UsoClient triggered successfully. Updates should now install automatically." } catch { Write-Log "ERROR: UsoClient execution failed: $($_.Exception.Message)" } } else { Write-Log "Installing updates found by PSWindowsUpdate..." $updates | Install-WindowsUpdate -AcceptAll -AutoReboot -Verbose 4>&1 | ForEach-Object { if ($_ -is [System.Management.Automation.VerboseRecord]) { Write-Log $_.Message } elseif ($_ -is [string]) { Write-Log $_ } } }
Manish Deshpande 1,485 Reputation points Microsoft External Staff Moderator

2025-11-17T05:27:41.01+00:00

Hello Jan Vávra

The Install-WindowsUpdate cmdlet may not install some cumulative or .NET updates right away if extra steps or a restart are needed. Also, running UsoClient.exe manually might not work if Windows Update is managed or restricted by Group Policy.

Verify Update Status:

Get-WindowsUpdateLog Get-WindowsUpdate -MicrosoftUpdate

Confirm which updates are pending and whether they require a restart.

Restart Windows Update Services:

Stop-Service wuauserv Stop-Service bits Start-Service wuauserv Start-Service bits

Force Update Scan and Install:

Use PSWindowsUpdate with elevated privileges

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot -Verbose

Ensure -AutoReboot is included to apply updates requiring restart.

Clear Update Cache (if issue persists) :
net stop wuauserv net stop bits Remove-Item -Path "C:\Windows\SoftwareDistribution" -Recurse -Force net start wuauserv net start bits
Then re-run the Install-WindowsUpdate command.

Validate Post-Installation:

After reboot, confirm no pending updates.

If updates still fail, check for Group Policy settings or WSUS configuration that might restrict installations.

Thanks,
Manish Deshpande
Manish Deshpande 1,485 Reputation points Microsoft External Staff Moderator

2025-11-18T05:34:47.3666667+00:00

Hello Jan Vávra

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail.

Answer 1

It appears that you are facing issues with your PowerShell script for installing Windows updates on Windows Server 2022, specifically regarding the automatic reboot not occurring after updates are installed. Here are some considerations and suggestions:

PowerShell Version: You are currently using PowerShell 5.1. While PowerShell 7 offers more features and improvements, it is not strictly necessary for running Windows Update commands. However, ensure that the commands you are using are compatible with the version you are running.
Update Installation: The command Get-WindowsUpdate is typically used to check for available updates. To install updates and handle reboots, you might want to use Install-WindowsUpdate from the PSWindowsUpdate module. Make sure this module is installed and imported in your script.
Reboot Handling: If updates require a reboot, you can force a reboot after installation by using the -Force parameter in the Install-WindowsUpdate command. Additionally, you can check the -AcceptAll parameter to automatically accept all updates.
Logging and Error Handling: Ensure that your script includes proper logging and error handling to capture any issues that may arise during the update process. This can help identify why the reboot is not occurring.
Scheduled Task: If you are running this script as a scheduled task, ensure it is set to run with elevated privileges. Running as the SYSTEM account can sometimes resolve permission-related issues with updates.
Manual Check: After running the script, manually check the Windows Update settings to see if updates are still pending. This can help confirm whether the updates were applied successfully.

Here’s a simplified example of how you might structure your update function:

function Update-Windows {
    Import-Module PSWindowsUpdate
    $updates = Get-WindowsUpdate
    if ($updates) {
        Install-WindowsUpdate -AcceptAll -AutoReboot -Force
    } else {
        Write-Host "No updates available."
    }
}

Make sure to test the script in a safe environment before deploying it in production.

References:

Answer 2

Jan Vávra 446

I took another versions of Windows, eg. Windows Server 2022 from Sep 2025 Datatacenter.
The Windows update page declares there is a pending install even I ran my script.

obrazek

If I run

Get-WUHistory | Select Date, Title, Result

I can see that pending install "B2267602 (Version 1.441.378.0)" was installed.
And also I cannot see anything at View update history page. obrazek

I think that Install-WindowsUpdate doesn't do all the work ...

$updates = Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -ErrorAction SilentlyContinue
$updates | Install-WindowsUpdate -AcceptAll -AutoReboot -Verbose 4>&1

Manish Deshpande 1,485 Reputation points Microsoft External Staff Moderator

2025-11-27T13:04:25.51+00:00
Hello Jan Vávra

Thank you for sharing the details and screenshots. Based on our review, the issue occurs because the server is showing “Controlled by your organization”, which means updates are managed by WSUS/Group Policy. This can cause the GUI to display “Pending install” even when PowerShell reports no updates.

Run PowerShell as Administrator Execute the following command to install all approved updates and reboot automatically:

Install-WindowsUpdate -AcceptAll -AutoReboot

If you want to use Microsoft Update instead of WSUS Add Microsoft Update service and run:

Add-WUServiceManager -MicrosoftUpdate Get-WindowsUpdate -MicrosoftUpdate -AcceptAll Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot

Verify Update Status After Reboot

Get-WUHistory | Select Date, Title, Result

Then open Settings → Windows Update → Check for updates once to refresh the GUI.

If GUI still shows pending install

Enable Get the latest updates as soon as they’re available in Windows Update settings.

Restart the server and click Check for updates again.

The “Controlled by your organization” message is expected when WSUS or GPO policies are applied.

If updates still fail, review Group Policy or WSUS configuration for restrictions.

Let us know the update after performing the above steps.

Thanks,
Manish Deshpande.
Jan Vávra 446 Reputation points

2025-11-28T11:13:52.9666667+00:00
I took the default iso of Windows Server 2022 Datacenter from Sep 2025 from MPN and installed it in Hyper-V.
The message “Controlled by your organization” is a default setting, and this also applies to Azure VMs. It only means that registry

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\AUOptions is set to 3.

No WSUS service used. Actually, I can confirm that

PS C:\Users\Administrator> Get-WUServiceManager ServiceID IsManaged IsDefault Name --------- --------- --------- ---- 7971f918-a847-4430-9279-4a52d1efe18d False False Microsoft Update 8b24b027-1dee-babb-9a95-3517dfb9c552 False False DCat Flighting Prod 855e8a7c-ecb4-4ca3-b045-1dfa50104289 False False Windows Store (DCat Prod) 9482f4b4-e343-43b6-b170-9a65bc822c77 False True Windows Update

Although I created a new empty Windows Server 2022 installation and used the sequence

Add-WUServiceManager -MicrosoftUpdate Get-WindowsUpdate -MicrosoftUpdate -AcceptAll Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot

I still can see pending installations and these KBs are shown in Get-WUHistory but not in the history in gui.

Nor manual restart has helped.
Jan Vávra 446 Reputation points

2025-11-28T13:02:53.9+00:00

UPDATE: I Also tried the Powershell 7.5. Nothing changed. And then made also a manual OS restart. Still Pending installations ...
Then I clicked at "Install now" button. It started showing "Installing ..." and something appeared in gui history. And then no OS restart was required.

Maybe this behaviour is a bug in a Windows update system. GUI didn't get fresh info but really nothing was installed ...
Eg. timestamp for

11/28/2025 3:27:15 AM 2025-10 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Microsoft server operating system version 21H2 for x64 (KB5066743) Succeeded

says that the last one item from gui was installed half hour ago than I clicked the Install button.

My primary intention is to keep OS safe, not the Windows Update gui, but I need confirmation that my procedure is correct.
Manish Deshpande 1,485 Reputation points Microsoft External Staff Moderator

2025-11-28T14:05:17.8033333+00:00

Hello Jan Vávra

Thanks for the detailed screenshots. Because the server is managed by your organization, Windows Update can show “Pending install” for approved updates, while PowerShell returns 0 updates if it’s scanning Microsoft Update instead of the managed source. The fix is to install from the correct source and let the server reboot automatically.

Action (managed/WSUS devices):

Run : Install-WindowsUpdate -AcceptAll -AutoReboot -ErrorAction Stop

Action (standalone/Microsoft Update):

Run

Add-WUServiceManager -MicrosoftUpdate -ErrorAction Stop

Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -ErrorAction SilentlyContinue

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot -ErrorAction Stop

Get-WUHistory | Select Date, Title, Result

If you want fully automatic installs and scheduled reboots going forward, we can enable Group Policy “Configure Automatic Updates = 4” and define the schedule. This keeps organization control while removing the need to click Install now in the GUI.

Links:
https://learn.microsoft.com/en-us/windows/release-health/status-windows-server-2022
https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wsus

Best regards,
Manish Deshpande
Jan Vávra 446 Reputation points

2025-11-28T16:15:57.54+00:00
I do not want to let the machine restart at an abitrary time.
My plan is to prepare an orchestration pwsh that will

remove the machine from Azure LB

make install updates and OS restart

ACME for TLS certs. In 2027, they'll be shortened to 90 days.

check healthiness of web app

return to the Azure LB's Backend pool

So value 4 for Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\AUOptions

is not the right option for me.

Shraddha Pandey 565 Microsoft External Staff Moderator

Hello @Jan Vávra,

Below are the steps you can follow to troubleshoot further:

Add that USOClient part as a small helper function, then call it once at the end of Invoke-AutoUpdate.

Add this helper below Ensure-PSWindowsUpdate

function Refresh-WUClientState {
    Write-Log "Refreshing Windows Update state (USOClient)..."
    $usoPath = "$env:SystemRoot\System32\UsoClient.exe"
    if (-not (Test-Path $usoPath)) {
        Write-Log "UsoClient.exe not found, skipping refresh."
        return
    }
    Start-Process -FilePath $usoPath `
                  -ArgumentList "StartInteractiveScan" `
                  -WindowStyle Hidden -NoNewWindow
    Write-Log "USOClient StartInteractiveScan triggered (similar to clicking 'Install now')."
}

2.Call it at the end of Invoke-AutoUpdate

Right before the final Write-Log "===== Windows Update Script Completed =====" add:

        Write-Log "Calling USOClient to refresh GUI/update state..."
        Refresh-WUClientState

So the tail of Invoke-AutoUpdate becomes:

Write-Log "Update workflow finished (system may reboot if required)."
        Write-Log "Calling USOClient to refresh GUI/update state..."
        Refresh-WUClientState
    } catch {
        Write-Log "ERROR during update: $($_.Exception.Message)"
        throw
    } finally {
        Write-Log "===== Windows Update Script Completed ====="
    }
}

This keeps your existing logic, and after PSWindowsUpdate installs updates it triggers the same client action as pressing Install now, which should help the GUI reflect the real state more reliably.

Documents:

Windows Update Commands | PowerShell UsoClient Guide

I hope the above helps. Please let us know if you have any further questions on this.

Thank You!

Share via

Windows update powershell script

2 answers

Your answer