# PowerShell scripts for Windows patch management

To ensure a safe and reliable digital workspace, Windows devices must be updated with the most recent security updates and bug fixes. However, managing patches across many systems can be time-consuming and prone to human error. A patch management script can be helpful in this situation.

It helps to automate the execution of instructions that streamline downloading, installing, and managing patches on Windows computers. This can save time, reduce the likelihood of human error, and ensure consistency across all computers in the network. With a patch management script executed using Hexnode’s [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/) feature, you can also automate the process of identifying vulnerabilities or downloading and installing of required updates.

 Disclaimer:The sample scripts provided below are adapted from third-party open-source sites.

 

PowerShell script
-----------------

You can use the **PSWindowsUpdate** module to streamline the process of Windows patch management.

### Module installation

To install the PSWindowsUpdate module on your computer (manual installation required).

Script to install PSWindowsUpdate module

Install-Module –Name PSWindowsUpdate 

   1

  Install-Module –Name PSWindowsUpdate 

   

 

  

### List available cmdlets

To display the list of available cmdlets in the PSWindowsUpdate module.

Script to list available cmdlets

Get-Command -Module PSWindowsUpdate 

   1

  Get-Command -Module PSWindowsUpdate 

   

 

  

### List available updates

To get a full list of available Windows updates (Alias: Get-WUList).

Script to list available updates

Get-WindowsUpdate 

   1

  Get-WindowsUpdate 

   

 

  

### Install updates

To download and install available updates from the WSUS server or Microsoft update.

Script to install updates

Get-WUInstall –AcceptAll 

   1

  Get-WUInstall –AcceptAll 

   

 

  

To install only a specific update package.

Script to install specific update

Get-WUInstall -KBArticleID ‘Article number’ 

   1

  Get-WUInstall -KBArticleID ‘Article number’ 

   

 

  

Eg: Get-WUInstall -KBArticleID KB4011670

### Uninstall updates

To uninstall an already installed update (Alias: Get-WUUninstall).

Script to uninstall updates

Uninstall-WindowsUpdate -KBArticleID ‘Article number’ 

   1

  Uninstall-WindowsUpdate -KBArticleID ‘Article number’ 

   

 

  

### Disable automatic downloads

To prevent the device from downloading updates automatically.

Script to disable automatic downloads

Set-ItemProperty -Path "HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU" -Name "NoAutoUpdate" -Value 1

   1

  Set-ItemProperty -Path "HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU" -Name "NoAutoUpdate" -Value 1

   

 

  

 Notes:- It is recommended to manually validate the script execution on a system before executing the action in bulk.
- Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.