Windows Server: Install and Manage Update Services with PowerShell

Installation

To install the WSUS role, run the following command from an elevated PowerShell prompt:

Install-WindowsFeature -Name UpdateServices

         
Figure 1: The expected output of Install-WindowsFeature UpdateServices
 

Additional Information:

The following WSUS role services can be installed using Windows PowerShell.

• Windows Internal Database (WID)
• WSUS Services
• Database

The WID Database and WSUS Services role services are installed after running Install-WindowsFeature UpdateSevices.

Administration

The following Windows PowerShell cmdlets are available for managing the WSUS role on a server running Windows Server Core.

Add a specified client computer to a specified target group:

Add-WsusComputer -Computer <computername> -TargetGroupName <groupname>

Approve an update to be made available to clients:

Approve-WsusUpdate -Update <update> -Action <approvalaction> -TargetGroupName <groupname>

In this command, the -Update switch accepts an update object retrieved using the Get-WsusUpdate command (see below). The value of -Action can be Install, Uninstall, or NotApproved. The latter does not decline the update but removes a preexisting approval action.

Decline an update:

Deny-WsusUpdate

As before, the -Update switch accepts an update object retrieved using the Get-WsusUpdate command (see below).

List all update classifications (for example, security updates or critical updates) available in the system:

Get-WsusClassification

List one or more WSUS client computers:

Get-WsusComputer

This command has many switches for filtering the list of client computers that it returns. See Get-WsusComputer for the full list.

List all products for which WSUS is providing updates:

Get-WsusProduct

Display a list of updates in WSUS that meet certain criteria:

Get-WsusUpdate

For a list of the switches that can be used to filter the output, see Get-WsusUpdate.

Begin the WSUS cleanup process:

Invoke-WsusServerCleanup

This command can start multiple cleanup tasks. See Invoke-WsusServerCleanup for the relevant switches.

Enable or disable specified types of updates (for example, security updates or driver updates):

Set-WsusClassification

Use filtered output from Get-WsusClassification to run this command.

Enable or disable updates for specified products:

Set-WsusProduct

Use filtered output from Get-WsusProduct to run this command.

Specify whether WSUS synchronizes with an upstream WSUS server or Microsoft's update servers:

Set-WsusServerSynchronization

Several switches can be used to specify settings for communicating with an upstream server. See Set-WsusServerSynchronization for details.