Introduction to WSUS and PowerShell

Summary: Guest blogger, Boe Prox, shows how to use Windows PowerShell to install WSUS and configure clients for updates.

Microsoft Scripting Guy, Ed Wilson, is here. You are in for a treat this week. Boe Prox has written a week’s worth of goodies, and we will share them here.

Photo of Boe Prox

Boe Prox is currently a senior systems administrator with BAE Systems. He has been in the IT industry since 2003, and he has been working with Windows PowerShell since 2009. Boe looks to script whatever he can, whenever he can. He is also a moderator on the Hey, Scripting Guy! Forum. Check out his current projects published on CodePlex: PoshWSUS and PoshPAIG.
Boe’s blog: Learn PowerShell | Achieve More

Now, without further ado, here is Boe!

For those of you who are unfamiliar with Windows Software Update Services (WSUS), I am going to start with a brief description of what WSUS is and how it is used to manage patching in an environment. Then I will dive into installing the server by using Windows PowerShell, configuring clients via GPO or the registry to report to the WSUS server and to receive the updates from the server. Lastly, I will discuss how to use Windows PowerShell with the associated assemblies for the WSUS Administrator Console to connect to the WSUS Server.

What is WSUS?

Windows Software Update Services (WSUS) is used by system administrators to manage the distribution of updates and hotfixes that are released by Microsoft for an environment. Currently, the most recent version is WSUS 3.0 with Service Pack 2, and it is available to download. This installation allows you to install the full server installation option or only the console installation (which can be installed on any client or server). It also has the assemblies required to use Windows PowerShell to manage the WSUS server. To determine the version of WSUS, refer to Appendix G: Detect the Version of WSUS on Microsoft TechNet.

Installing a WSUS Server

Before you begin the installation of WSUS, make sure you install the following on the selected server:

  • Internet Information Services (IIS)
  • At a minimum, .NET Framework 2.0

You could install WSUS 3.0 with SP2 on your server by using the file specified in the previous download link and running through the UI installation. But c’mon, this is a scripting blog, so surely we can script something out…right? Right!

Because there are several switches available with the executable file, we can easily script an unattended installation of the WSUS server along with specific configurations that meet our requirements. For more information about those switches, see Appendix A: Unattended Installations. The script I wrote that will allow a local or remote installation of a WSUS server or to install only the WSUS Administration Console is called Install-WSUSServer.ps1.

Note: I chose to require a dependency for PSExec.exe to complete the remote installation requirements. There were a number of reasons why I chose to do this, but the main reason is that I wanted to make sure that if an issue occurs that cancels the installation, an error would returned in the script that lets you know something happened.

You can run this script against only one computer at a time. This is because only one SUSDB database can be used for each SQL Server instance (unless you are setting up a WSUS server as a front-end server). You can specify whether to install a console or a server core installation, and it allows for using the internal database installation or a local/remote SQL Server instance to write data to. Lastly, if the required installation file (WSUS30-KB972455-x86.exe or WSUS30-KB972455-x64.exe) is not in the same directory as the script, you will be given a prompt to download the required file to use for installation. I also wrote an Uninstall-WSUSServer.ps1 script that performs exactly like the Install-WSUSServer.ps1 script.

So enough talking about this script and let’s see it in action. First, let’s install our WSUS server and make sure that we save the content locally and save that content on the D drive. I am also going to make sure that I do not have the updates made available so it asks me to download the update prior to the installation.

. .\Install-WSUSServer.ps1 -Computername DC1 -StoreUpdatesLocally -ContentDirectory “D:\WSUS” -InternalDatabasePath “D:\” –CreateDatabase –Verbose

The command and the associated output are shown in the following image.

Image of command output

The following image shows the newly created folders.

Image of folders

Now let’s fire up the console. To do this, I make an RDP connection to my DC1 server as shown in the following image.

Image of menu

Yep, it’s all there! OK, now let’s install the Administration Console on my laptop so I can make use of the assemblies for Windows PowerShell integration. Here is the command line that I use to install only the console.

. .\Install-WSUSServer.ps1 –ConsoleOnly -verbose

The following image shows the command that I use to install the console, and the output from the Install-WSUSServer.ps1 script.

Image of command output

This was a little simpler because I already had the installation file that I needed to complete the Administration Console installation.

Configure clients to use WSUS

OK, we have our WSUS server installed and running, and we have our Administration Console installed on the laptop. The next step is to configure my laptop and the server to communicate to the WSUS application so we can image the patches that are required for each client. There are a couple of ways to accomplish this task. If the client is in an Active Directory environment, all you have to is use Group Policy to make the configuration changes. 

Note: For non-domain systems, you can make this change by using gpedit.msc.

For the sake of simplicity, I am just going to configure the GPO to point my client to the WSUS server (Specify intranet Microsoft update service location), set the update client to only download (Configure Automatic Updates) the approved updates, and change the detection to every four hours (Automatic Updates detection frequency). The changes are reflected in the following image.

Image of menu

Another way is to do some registry hacking to make the changes, which leads me to my next set of Windows PowerShell scripts that accomplish this task. The first script allows you to view the settings in the registry and the other script allows you to change the registry settings to configure the client. You can find these scripts in the Script Center Repository:

For more information about the registry information that I used in these scripts, see Configure Automatic Updates in a Non–Active Directory Environment.

First, let’s see the settings that we will be changing to talk to our WSUS server on DC1. To do this, I use the Get-ClientWSUSSetting command as shown here.

Get-ClientWSUSSetting | Select WUServer,WUStatusServer,DetectionFrequency,AUOptions

The following image shows the output from this command.

Image of command output

Now let’s change these to reflect the same GPO we configured for the domain. Here is the command that does that.

Set-ClientWSUSSetting -Options DownloadOnly -DetectionFrequency 4 -UpdateServer ‘http://DC1’ -Verbose

The image shown here illustrates the output from the command.

Image of command output

Now, I use the Get-ClientWSUSSetting command to verify that the changes worked properly. As shown in the following image, it worked just fine.

Image of command output

Perfect. Now our clients are talking to the WSUS server, and they will begin reporting what patches are needed to be compliant.

WSUS and Windows PowerShell

Now we are at the point where we can begin working with the assemblies by using Windows PowerShell, and make our initial connection to the WSUS server. We want to use the Microsoft.UpdateServices.Administration assembly. Here is the command that I use to load that assembly.

[reflection.assembly]::LoadWithPartialName(“Microsoft.UpdateServices.Administration”) | Out-Null

Now it is time to make the initial WSUS connection by using the .NET accelerator [Microsoft.UpdateServices.Administration.AdminProxy] and the static method getUpdateServer(), which requires two values: the WSUS server name and a Boolean value for a secure connection. Because I am not using a secure connection for the WSUS server, we will set it for False. Here is the command.

$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer(‘DC1’,$False)


The output from the command is shown in the following image.

Image of command output

Here you can see some information regarding the remote WSUS server, such as the port number that is being used and the version of the WSUS server.

That is all for today with WSUS. I have shown the beginnings of using Windows PowerShell to make the initial connection to the WSUS server. Tomorrow I will expand on this by showing how you can use Windows PowerShell to perform some basic administration for your WSUS server.


Thanks Boe, that is a great introduction to WSUS. WSUS Week will continue tomorrow.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy 

Comments (14)

  1. Boe Prox says:

    @Chris Here is my followup article for installing WSUS on Windows Server 2012.…/installing-wsus-on-windows-server-2012.aspx

  2. Anonymous says:

    It seems I have a newbie question about the Get-WSUSClientSetting function (or Get-ClientWSUSSetting.ps1 as it is named in the download).  I cannot get any results back when attempting to run the script.  Are there precursors I missed?  As it is written as a function, perhaps I've forgotten how to either 1) include it as a callable cmdlet within the shell, or 2) run the .ps1 file directly.

    I’m using PS 2.0 on an XP SP2 workstation.  I've tried invoking the script as it is described in the blog and also from the directory where my downloaded copy resides (i.e. “./ Get-ClientWSUSSetting.ps1”), but nothing is returned to the screen.  I’ve tried piping to format-list and format-table, and with and without the –computername parameter.

    What am I missing?

  3. Anonymous says:

    I'm having the same issue as Donovan Oliver in that while the GET script runs without any error it returns nothing.  I know how to run scripts so it isn't that I'm "doing it wrong" I'm sure.  This is using PS2.0 on Windows Server 2008 R2 but I don't have domain rights only local administration.  Could that be the issue?

    Any assistance would be appreciated as this script would really help me out.

  4. jrv says:


    Look inside of the file.  Note that it is a function.  Functions need to be loaded by dot-sourcing before than can be executed.

    The article text shows you how to dot-source the files to run the contents.

  5. Patrick S. says:

    There are some instances of "conimage" in this post. I think you mean "configure."

  6. Ed Wilson says:

    @Patrick S.  Oops a bit of over zealous find and replace manuever. The text has been corrected.

  7. Chris says:

    I would love to see this post updated for installing WSUS 4.0 on Server 2012… specifically a way to automate installing WSUS and specify a SQL db for the database (either remote or local).  There just doesn't seem to be any documentation on how to do this (I guess because Server 2012 is so new)… I know the names of the services that need to be installed but there doesn't seem to be any parameters published to use with those powershell commands.

  8. Ed Wilson says:

    @Chris I am planning on playing with WSUS on Windows Server 2012 really soon … I will also ask Boe if he would like to revise this article for Windows Server 2012 … great suggestion. Stay tuned …

  9. JBO1982 says:

    Good introduction to WSUS and what can be done with POWERSHELL.

  10. John says:

    I couldn’t get this to run, even when I was at the WSUS server console:
    $wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer(‘DC1’,$False)
    Exception calling "GetUpdateServer" with "2" argument(s): "The request failed with HTTP status 404: Not Found."

    It turned out that my WSUS installation uses the default port of 8530, and I had not moved it to 80. I needed to use the third parameter to pass the port number, like this:

    $wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer(‘DC1’,$False,8530)

  11. The_Yeti says:

    I am connecting to WSUS and searching for updates just fine. This works as expected

    #Connect to the WSUS 3.0 interface.
    [reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | out-null
    $WsusServerAdminProxy = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer($WsusServer,$UseSSL,$PortNumber);

    I can Search for an Update just fine using this:

    $KBs = $WsusServerAdminProxy.SearchUpdates($KB123456) | ?{-not $_.IsDeclined}

    If KB123456 exist, then $KBS returns a list, and I can select Titles.

    What I want to know, is, if KB123456 does not return any results, how can I flag it? Some sort of output line like :

    If ($kbs -eq $null)
    $kbs | export-csv -append d:NullUpdates.csv

    The problem is, that does not work. I guess its not returning $Null, but not returning anything.

  12. I am getting an error trying to run this script.

    cmd exited on SRV03 with error code -2147216288

    I can’t seem to find what that means. It is copying the wsus install file to the C: drive of the server though.

  13. Gau says:

    We are using SCCM for updates and I am building the automation to build the server. the SCCM takes almost 15 minutes to connect to it even if it is configured so I need to use the Internal Update URL to do windows updates. Suppose I have the URL as http://xxx:8534 . How can I use Powershell Windows update to get the updates from URL instead of going out the server or over Internet.

  14. Mike says:


    I have been trying to run the Get-ClientWSUSSetting.ps1 from Windows Powershell as administrator and when I type in .\Get-ClientWSUSSetting, it just returns with the current directory. I’m new to Powershell, am I missing something?

    Any help would be appreciated.
    Thank you,