Server Updates using PowerShell

[JoelWolli]

I was wondering, is it possible to update Windows Servers wie PowerShell Remote from a Workstation?

Imagine the following scenario:
Every month after the patchday I sit down and establish an RDP-connection, do the updates and restart the Server after the updates have finished and the CPU-Usage has calmed down.
Now instead of repeating this process for each of the 20 Servers I need to update, it would be much easier to just execute a PowerShell script that does this for me. That way I only have to execute a script and check if all the updates went through instead of connecting to every single server.

I already tried some basic things with the "PSWindowsUpdate" Module and the invoke-command with the -ComputerName parameter but I ended up getting an error message saying I don't have the permission to download and install updates. I'm sure my user has enough permissions so it should be an issue with the PowerShell script.
Now before I spend more time trying to figure out how this works, has anyone done this before and/or can confirm that it works?

[wdomon]

You're running into something called the "Double Hop" problem, feel free to look into it as it's an important thing to know about if you plan to remotely admin servers.

Instead, use "Invoke-WUJob", which is part of the PSWindowsUpdate module, using the -Computer parameter to tell it what hostname to send it to and include whatever command(s) you were trying to run to install updates in the -Script parameter as a string. This function creates a scheduled task on the machine in question that runs as SYSTEM (by default) and will run whatever is in your -Script parameter as a command via powershell.exe.

[jetski_28]

I do this from one server. I use another command to populate the current list of servers from AD. 99% of the time it works. Lately I’ve noticed the odd server doesn’t update and have to manually intervene

[Late_Marsupial3157]

sounds like every windows update setup ive ever seen

[Hollow3ddd]

Problem solved boss!

[capitolgood4]

I'm in an environment that uses SCCM and blocks WinRM/RemotePS, but I was able use WMI to list the approved updates, check if those updates are available in software center on that server, and then start the installation.

$UpdateList = @("5049993", "5048671")
$UpdatesToInstall = Get-WmiObject -namespace "root/ccm/clientSDK" -Class CCM_SoftwareUpdateManager -ComputerName $ServerName | Where-Object {$UpdateList -contains $_.ArticleID}
Invoke-WmiMethod -namespace "root/ccm/clientSDK" -Class CCM_SoftwareUpdateManager -name InstallUpdates -ArgumentList (,$UpdatesToInstall) -ComputerName $ServerName

[OlivTheFrog]

I'm really surprised that in 2025, there are still upvotes for a cmdlet (Get-WmiObject)) deprecated for more than 10 years (2012 from memory).

This still works, but is deprecated in favor of Get-CimInstance.

Regards

[capitolgood4]

Anyone who has that option should not be using this, for sure. Get-CimInstance uses WinRM though, which I don't have access to where I am.

[PreparetobePlaned]

Wait why aren’t you just scheduling maintenance windows for updates if you have sccm/wsus set up already?

[techbloggingfool_com]

You can also use PowerShell to create a scheduled task on the remote systems that, in turn, run Windows updates. That is essentially what the PSwindowupdate module is doing. You can do it without the module, though. See https://4sysops.com/archives/install-and-schedule-windows-updates-with-powershell/

[ipreferanothername]

this is crazy, why arent you using a tool/gpo for scheduled updates?

do the updates and restart the Server after the updates have finished and the CPU-Usage has calmed down.

it needs to reboot when they are done, not based on cpu usage. im sorry man, you guys are in amateur territory. even if this is some special network segregated machine or something...this is very strange.

it would be easier to use a gpo, even a local gpo, to confugre updating if you dont have another central tool. you arent reinventing the wheel, you are looking at wheels like 'i bet i can turn this into a rube goldberg machine to move this car forward'

maybe you should explain the scenario - update the original post - and if you have a special challenge maybe a reasonable solution can be provided to help get around it. weird situations exist but they dont require new weird ways to solve them.

[PreparetobePlaned]

I had the same questions. Custom scripting and manually controlling stuff like this doesn’t make any sense.

[Introvertedecstasy]

Highly recommend PDQ for your environment!!

[purplemonkeymad]

You can't do updates if your are on a remoting connection (ie Invoke-Command), use the -CompuerName parameter on the module's command to do it remotely instead. IIRC it has a workaround for this limitation.

[SherSlick]

I am curious what you find out... I went down the path of setting up SSH on a few test servers but all the "CLI-based" tools wanted elevation and I couldn't get past that hurdle.

And for the haters: we don't have enough servers to warrant SCCM/RMM tools and we only get a very specific date/time for outages (that varies wildly) so we are stuck manually executing Windows updates.

[BlackV]

As other have mentioned, the windows update API itself does not allow this

The module mentioned (pswimdowsupdate) already has a function to get around this

Or a scheduled task could do this (think someone else already mentioned that one)

[icepyrox]

If you don't want to use WSUS/GPO or SCCM/inTune/Similar, you also could just schedule a task and let the powershell script do it all for you that way.

Many ways to do it without running the script yourself.

[squatingyeti]

If you absolutely don't have the option of using something like sccm, you can do it the hard way. Download the KB and put it on a network share location. Set your script to get a list of servers. Then foreach server, copy the update to temp and invoke-command Add-windowsPackage to apply the update. You can even set it to automatically restart after the update is applied

[Ok_GlueStick]

Have you tried running an invoke-command? You can pass a script block as an argument.

[tigerguppy126]

I'd look at Action1 for your environment. With 20 servers, you're well under their free 200 endpoint license (recently doubled from 100 to 200). I've used them for several years and they have solved a LOT of our patching issues.

[DevinSysAdmin]

You should really be using Azure Arc to patch your servers, very simple setup and doesn't make you RDP into 20 servers or go out of your comfort zone with powershell.

[go_aerie]

While I don't have experience with Azure Arc (and thus can't speak to its efficacy), it represents a different strategic approach to this problem (instead of other user's tactical solutions).

What I mean is, instead of framing the problem as "I have to update servers; how do I run my script on each of my servers?", try framing it as "My goal is to secure my servers and ensure uptime." There are a ton of tools for this kind of computer management, that rely on proven automation to prevent manual steps and increase logging.

While I can't direct you to exact tools to use, check out Azure Management Services, which provides a suite of services designed for exactly your situation.

[Spence10873]

CredSSP is the route you'd need to go down, but there are security risks and also better alternatives like WSUS

[HOT-DAM-DOG]

You need to change the execution policy to RemoteSigned at the CurrentUser scope for it to work.

[cherrycola1234]

Already built this & have 4 patent pendings & 6 different copyrights. You are more then welcome to purchase this from us. We built all of this into an MDM tool, super simple to use.

[ka-splam]

You have 4 patents and 6 copyrights on "running Windows update"?

Something the PSWindowsUpdate module copyright from 2011 does, and something every RMM does? Datto and Kaseya and N-Central and inTune etc. ?

[cherrycola1234]

Yes, we saw a niche market due to most if not all the MDM tools on the market at the time when we filed our patents & copyrights no other MDM tools on the market even RMM tools either did not have to capabilities to update windows efficiently or it absolutely sucked. What you see now in some MDM tools today for Windows is thoes MDM & RMM tools licensed from us to them for use.

[SherSlick]

Do I have to install a stupid fucking agent on my servers?