SOP · Enterprise Patching

Windows Security Updates
via PSWindowsUpdate

A complete step-by-step standard operating procedure for installing and scheduling Windows security updates using the PSWindowsUpdate PowerShell module, designed for sysadmins managing enterprise endpoints.

📅 26 March 2026 By Richard Gamarra ⏱ ~10 min read 🖥 PowerShell · Windows

Core Steps

PS 5+

Required Version

Admin

Privilege Level

Auto

Schedule Option

Step 1

Install the PSWindowsUpdate Module

Open PowerShell as an Administrator (right-click the Start menu → Windows PowerShell (Admin)). Then run the following command to install the PSWindowsUpdate module from the PowerShell Gallery:

⚠️

Administrator Privileges Required This command must be executed in an elevated PowerShell session. Running as a standard user will result in an access denied error.

PowerShell

Install-Module -Name PSWindowsUpdate -Force -AllowClobber

If prompted to install the NuGet provider, type Y and press Enter. The -Force flag bypasses confirmation prompts, and -AllowClobber allows overwriting existing commands from other modules if any conflict arises.

Step 2

Import the PSWindowsUpdate Module

After installation, import the module into your current PowerShell session so its cmdlets become available. This step is required every time you start a new session unless you have auto-import enabled via your profile.

PowerShell

Import-Module PSWindowsUpdate

💡

Tip: Verify Import Run Get-Command -Module PSWindowsUpdate to confirm the module loaded correctly and to see all available cmdlets.

Step 3

Search for Available Security Updates

Use Get-WindowsUpdate to query Windows Update for available patches. You can retrieve all pending updates or filter specifically for security-classified updates.

List all available updates:

PowerShell

Get-WindowsUpdate

Filter for Security Updates only:

PowerShell

Get-WindowsUpdate -Classification SecurityUpdates

The output will list all updates along with their KB article numbers, titles, sizes, and classification. Review the list before proceeding to installation to understand what changes will be applied.

Step 4

Install the Security Updates

Once you have reviewed the available security updates, use Install-WindowsUpdate to apply them. The command below filters for security updates, auto-accepts all prompts, and reboots the system if required.

⚠️

Auto-Reboot Warning The -AutoReboot flag will restart the machine without additional prompts if any update requires it. Ensure all critical work is saved and users are notified before running this in a production environment.

PowerShell

Install-WindowsUpdate -Classification SecurityUpdates -AcceptAll -AutoReboot

Parameter	Description
-Classification SecurityUpdates	Targets only updates classified as security patches, excluding optional/driver updates.
-AcceptAll	Automatically accepts all update license agreements and installation prompts without manual input.
-AutoReboot	Triggers an automatic system reboot after installation if any update requires it.

Step 5

Verify Installed Updates

After the installation completes (and the system reboots if applicable), run the following command to confirm the security updates were successfully installed:

PowerShell

Get-WindowsUpdate -Install

This command displays a history of all installed updates. Review the list to confirm the expected KB articles are present. You can cross-reference with Microsoft's Security Update Guide using the KB numbers shown.

✅

Verification Complete If all targeted security updates appear in the installed list, the patching process was successful. Document the KB numbers and installation date in your change management system.

⚙

Optional

Schedule Automatic Updates via PowerShell

For endpoints that require recurring automated patching, you can register a Windows Scheduled Task that runs the update installer on a defined schedule. The example below configures a daily run at 3:00 AM.

💡

Best Practice Schedule automatic updates during off-peak hours. Ensure the endpoint has a stable power and network connection at the scheduled time. For enterprise environments, consider using WSUS or SCCM for centralized patch orchestration.

PowerShell

Register-ScheduledTask \
  -Action (New-ScheduledTaskAction \
    -Execute 'powershell.exe' \
    -Argument 'Install-WindowsUpdate -AcceptAll -AutoReboot') \
  -Trigger (New-ScheduledTaskTrigger -Daily -At 3am) \
  -TaskName "AutoWindowsUpdate" \
  -Description "Automatically installs Windows security updates."

Component	Purpose
Register-ScheduledTask	Registers a new task in Windows Task Scheduler under the current user or SYSTEM context.
New-ScheduledTaskAction	Defines the executable and arguments to run. In this case, PowerShell with the update command.
New-ScheduledTaskTrigger -Daily -At 3am	Sets the task to fire every day at 3:00 AM local time.
-TaskName	A human-readable label visible in Task Scheduler for easy identification and auditing.

📚

Reference

References & External Resources

Official documentation and community resources for deeper exploration of PowerShell-based patch management.

📦

PSWindowsUpdate on PS Gallery

Official PowerShell Gallery listing for the PSWindowsUpdate module: version history, authors, and direct install command.

📖

Microsoft: Windows Update Overview

Microsoft Docs on how Windows Update works, update types, and deployment guidance for enterprise environments.

🛡️

Microsoft Security Update Guide

The official MSRC portal for tracking CVEs, security advisories, and KB article cross-references by product.

⏰

Microsoft's official reference for the Register-ScheduledTask cmdlet, parameters, and advanced scheduling scenarios.

🖥️

WSUS: Enterprise Scale Patching

Windows Server Update Services documentation, the enterprise-grade centralized patching alternative to PSWindowsUpdate.

🐙

PSWindowsUpdate on GitHub

Source code, issue tracker, and community contributions for the PSWindowsUpdate module maintained on GitHub.