Automate Windows Updates with PowerShell: A Step‑by‑Step Guide

Keeping Windows machines up to date is essential for security, performance, and compliance. While the built‑in Windows Update client does a decent job, many IT professionals and power users prefer a more controllable, scriptable approach. PowerShell, with its rich set of cmdlets and community modules, makes it possible to schedule, filter, and log updates without ever opening the GUI. In this guide we’ll walk you through the entire process—from installing the necessary module to creating a reliable scheduled task—so you can let PowerShell handle updates while you focus on higher‑value work.

What You’ll Need

• Windows 10, 11, or Windows Server (2016 or newer)
• Administrative rights on the target machine
• PowerShell 5.1 or PowerShell 7 (the commands work in both)
• Internet connectivity for downloading updates and the PSWindowsUpdate module
• A basic understanding of PowerShell syntax

Step 1: Open PowerShell with Administrative Rights

Automation that touches system components requires elevated privileges. Right‑click the Start button, choose Windows PowerShell (Admin) or Windows Terminal (Admin), and confirm the UAC prompt. Running as admin ensures the cmdlets can query the update service, install patches, and create scheduled tasks.

Step 2: Install the PSWindowsUpdate Module

Microsoft does not ship a native PowerShell cmdlet for Windows Update, but the community‑maintained PSWindowsUpdate module fills that gap. Install it from the PowerShell Gallery with a single line:

Install-Module -Name PSWindowsUpdate -Force -Scope AllUsers

The -Force flag suppresses the confirmation prompt, and -Scope AllUsers makes the module available to every user on the computer. If you see a warning about an untrusted repository, run Set-PSRepository -Name PSGallery -InstallationPolicy Trusted first.

Step 3: Configure Update Policy

Before you start installing updates, decide which categories you want to automate. The module lets you filter by KB number, severity, or Microsoft product. A common intermediate‑level policy is to install all critical and security updates but skip optional feature packs. Save this policy in a reusable script block:

$UpdateFilter = {
    Get-WUList -MicrosoftUpdate | Where-Object {
        $_.Title -match "Security" -or $_.Title -match "Critical"
    }
}

You can also store the filter in a JSON file and import it later, which makes it easier to adjust without editing the main automation script.

Step 4: Create a Scheduled Task

Automation loses its value if you have to run the script manually every week. PowerShell can create a Windows Scheduled Task that runs the update script at a convenient time (for example, every Sunday at 3 AM).

# Define the script that will be executed
$ScriptPath = "C:ScriptsAutoWindowsUpdate.ps1"

# Ensure the script folder exists
New-Item -ItemType Directory -Path (Split-Path $ScriptPath) -Force | Out-Null

# Write the core update logic to the script file
@'
Import-Module PSWindowsUpdate
# Use the filter defined earlier (you can also import from a JSON file)
$Updates = Get-WUList -MicrosoftUpdate | Where-Object { $_.Title -match "Security" -or $_.Title -match "Critical" }
if ($Updates) {
    Write-Output "Found $($Updates.Count) updates. Installing..."
    $Updates | Install-WUUpdates -AcceptAll -IgnoreReboot
    Write-Output "Installation complete."
} else {
    Write-Output "No critical updates found."
}
'@ | Set-Content -Path $ScriptPath -Encoding UTF8

# Register the scheduled task
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$ScriptPath`""
$Trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 03:00am
$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
Register-ScheduledTask -TaskName "AutoWindowsUpdate" -Action $Action -Trigger $Trigger -Principal $Principal -Description "Automates critical Windows updates via PowerShell" -Force

Using the SYSTEM account eliminates the need for a password and guarantees the task runs even when no user is logged on. The -ExecutionPolicy Bypass flag prevents the script from being blocked on machines with a restrictive policy.

Step 5: Test the Automation

Never deploy a new scheduled task without a dry run. Manually invoke the script you just wrote:

PowerShell -NoProfile -ExecutionPolicy Bypass -File C:ScriptsAutoWindowsUpdate.ps1

Watch the console output. If updates are found, they will begin installing. Pay close attention to any error messages—common culprits are missing internet connectivity, Windows Update service being disabled, or the module not loading correctly. After a successful manual run, force the task to run on demand to confirm the scheduler can invoke it:

Start-ScheduledTask -TaskName "AutoWindowsUpdate"

Check the task history in the Task Scheduler UI to verify it completed without errors.

Step 6: Monitor and Log Updates

Automation is only as good as its visibility. Enhance the script to write a concise log entry after each run. Append the following lines to the end of AutoWindowsUpdate.ps1:

$LogFile = "C:LogsWindowsUpdateLog.txt"
$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
if (Test-Path $LogFile) {
    Add-Content -Path $LogFile -Value "$Timestamp - Update run completed. Installed $($Updates.Count) updates."
} else {
    New-Item -Path $LogFile -ItemType File -Force | Out-Null
    Set-Content -Path $LogFile -Value "$Timestamp - Update run initialized."
}

Now every execution appends a timestamped line, making it trivial to audit what was installed and when. For larger environments, consider forwarding this log to a central SIEM or using PowerShell Remoting to pull logs from multiple machines.

Common Mistakes to Avoid

Even seasoned admins slip up when automating Windows updates. Below are the most frequent pitfalls and how to sidestep them:

• Running the script without admin rights: The update service will reject installation attempts, resulting in cryptic “Access is denied” errors. Always launch PowerShell as Administrator.
• Forgetting to import the module inside the scheduled task: The task runs in a fresh session, so Import-Module PSWindowsUpdate must be part of the script file, not just your interactive console.
• Using the wrong execution policy: A restrictive policy (e.g., AllSigned) will block the script. The -ExecutionPolicy Bypass flag in the task action solves this without permanently lowering security.
• Skipping reboot handling: Some updates require a reboot to finish. The -IgnoreReboot switch defers the reboot, but you should schedule a separate reboot task or enable AutoReboot if downtime is acceptable.
• Hard‑coding user‑specific paths: Store scripts and logs in locations accessible to the SYSTEM account (e.g., C:Scripts, C:Logs) to avoid “Path not found” errors.

Tips and Tricks

Take your automation a notch higher with these intermediate tricks:

• Leverage JSON for dynamic filters: Keep a filters.json file that lists KB IDs or product names. Load it with Get-Content -Raw | ConvertFrom-Json and build the Where-Object clause on the fly.
• Combine with WSUS or ConfigMgr: If you manage a domain, let the script query your WSUS server for approved updates, then install only those that have passed testing.
• Send email notifications: Use Send-MailMessage at the end of the script to email the log snippet to the admin team.
• Implement a “maintenance window” check: Before installing, verify the current time falls within a predefined window (e.g., 02:00‑04:00) to avoid unexpected reboots during business hours.
• Use PowerShell 7’s cross‑platform capabilities: The same script can be adapted for Windows Server Core or even Linux machines that need to apply Windows‑based updates via remote management tools.

Frequently Asked Questions

Can I use this method on Windows 7?

The PSWindowsUpdate module supports Windows 7, but Microsoft has ended mainstream support, and many updates are no longer delivered. For legacy systems, consider using WSUS or a third‑party patch manager instead.

What if an update fails to install?

The script logs the failure, but you may also want to capture the error stream. Append 2>&1 | Tee-Object -FilePath $LogFile to the install command to record detailed error messages for troubleshooting.

How do I ensure the system reboots after critical updates?

Remove the -IgnoreReboot switch from Install-WUUpdates or add a separate reboot task that runs 30 minutes after the update task completes. Use Restart-Computer -Force with caution, as it will terminate any open user sessions.

Conclusion

Automating Windows updates with PowerShell gives you granular control, repeatable processes, and clear audit trails—features that the default Windows Update UI simply cannot match. By installing the PSWindowsUpdate module, crafting a sensible filter, and wiring everything up to a scheduled task, you can keep your machines secure without lifting a finger each month. Remember to test thoroughly, log every run, and keep an eye on the occasional reboot requirement. With these practices in place, your Windows fleet will stay patched, compliant, and ready for whatever comes next.

Photo by Surface on Unsplash