microsoft:windows:update

WSUS uses a cookie on client computers to store various types of information, including computer group membership when client-side targeting is used. By default, this cookie expires an hour after WSUS creates it. If you are using client-side targeting and change group membership, use this option in combination with detectnow to expire the cookie, initiate detection, and have WSUS update computer group membership.

Note that when combining parameters, you can use them only in the order specified as follows:

wuauclt.exe /resetauthorization /detectnow

Source:Manipulate Client Behavior Using Command-line Options

Command-line options for updates from Windows Update

Silent unattended installation:

WindowsXP-KB935843-x86-ENU.exe /quiet /norestart

Standard switch	Description of the switch	Versions of Update.exe that support this switch
/help	Displays command-line help.	Version 5.3.24.3 and later versions support the /help switch. For compatibility with older versions, the /? switch can be used.
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.	Version 5.3.24.3 and later versions support the /passive switch. For compatibility with older versions, the /u switch can be used.
/quiet	Quiet mode - same as unattended mode, but no status or error messages are displayed.	Version 5.3.24.3 and later versions support the /quiet switch. For compatibility with older versions, the /q switch can be used.
/norestart	Do not restart the computer when the installation is finished.	Version 5.3.24.3 and later versions support the /norestart switch. For compatibility with older versions, the /z switch can be used.
/warnrestart	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (Default is 30 sec). Intended for use with either /quiet or /passive switches.	Version 6.1.22.0 and later versions support the /warnrestart switch.
/forcerestart	Restart the computer after installation and force other applications to close at shutdown without saving open files first.	Version 5.3.24.3 and later versions support the /forcerestart switch.
/promptrestart	Presents a dialog box to prompt user to restart if required. Intended for use with /quiet.	Version 6.1.22.0 and later versions support the /promptrestart switch.
/forceappsclose	Forces other programs to close when the computer shuts down.	Version 5.4.15.0 and later versions support the /forceappsclose switch. For compatibility with older versions, the /f switch can be used.
/nobackup	Do not back up files for uninstall.	Version 6.1.22.0 and later versions support the /nobackup switch. For compatibility with older versions, the /n switch can be used.
/overwriteoem	Overwrite OEM files without prompting.	Version 6.1.22.0 and later versions support the /overwriteoem switch. For compatibility with older versions, the /o switch can be used.
/integrate:path	Integrates the software updates into the Windows installation source files located at the path specified. Note that :path refers to the folder that contains the i386 folder.	Version 5.4.15.0 and later versions support the /integrate:path switch. For compatibility with older versions, the /s switch can be used.
/log:path	Allows user to specify where to create the log file.	Version 6.1.22.0 and later versions support the /log switch.
/ER	Enable extended error reporting.	All versions support the ER switch.
/verbose	Enable verbose logging. Creates %Windir%\CabBuild.log upon install that details files to be copied. Using this switch may cause the installation to occur much slower.	Version 5.3.24.3 and later versions support the /verbose switch. For compatibility with older versions, the /v switch can be used.
/d:path	Specifies a backup directory for Windows Service Pack installation. :path indicates the destination folder for the backup files. The default backup location is %Systemdrive%\$ntservicepackuninstall$.	This switch is not available for updates other than Service Packs and is available only in Installer versions 5.3.16.5 and later versions.
/extract[:path]	Extracts files without starting Setup. If “:path” is not included, you are prompted for the path of a destination folder to extract the files. If “:path” is used, the files are extracted to the specified destination folder.	Version 5.3.24.3 and later versions support the /extract switch. For compatibility with older versions, the /x switch can be used.
/hotpatch:disable	Disables hotpatching functionality, and installs the cold patch only.	This is only to be used for Windows Server 2003 packages that support hotpatching and is available in versions 6.1.22.0 and later. For more information on hotpatching, see the “References” section in this article for a link to the “Inside Update.exe” whitepaper.

Source: Command-line switches for Windows software update packages

WSUS and high CPU usage by svchost.exe on Windows XP

After login the proces svchost.exe under which the Windows Automatic Update Client runs takes up a full CPU en during the scan the PC is unuseable. If you look at svchost.exe with Sysinternals' Process Explorer you see that “ntdll.dll!RtlAllocateHeap” is claiming all the CPU time. This problem seems to be connected to the installation of a Microsoft Office product for which it is scanning for updates and/or the use of Microsoft Update (updates check for all Microsoft products) instead of Windows Update (updates check for Windows only). This should be solved by the installation of KB927891 which replaces hotfix KB916089 and, together with WSUS 3.0 client build 0374, should be the solution for the frozen PC with svchost.exe consuming 100% CPU. The scan will still be executed and can consume one CPU, but the computer should stay responsive during the scan.

Notes

WSUS cleanup

To make sure that the WSUS cleanup wizard deletes updates for product categories you no longer have selected under “Products and Classifications”, you have to decline these updates before cleanup.
Source:PatchAholic...The WSUS Blog! - Purge / Delete corrupted or Un-needed patches on WSUS Server

WSUS Cleanup This tool can automate the cleanup process within WSUS.

Install WSUS on an RODC

Tested on a Windows Server 2012 R2 RODC.

Installing WSUS on an RODC with the following command:

CD "C:\Program Files\Update Services\Tools"
WsusUtil.exe postinstall CONTENT_DIR=D:\WSUS

Will fail with the message:

Log file is located at C:\Users\<login>\AppData\Local\Temp\tmpF64B.tmp
Post install is starting
Fatal Error: The request is not supported.

This occurs because wsusutil tries to create the following two local security groups, which it can't do on an RODC:

WSUS Administrators
WSUS Reporters

The solution is to create both groups in Active Directory as Domain Local Groups and force a replication on/to the RODC.

After this is done the wsusutil postinstall command should now work.

Source:Microsoft Windows Server Forums - WSUS 3.0 SP1 on RODC

Event ID 10012 - The permissions on directory %1 are incorrect.

Example: “The permissions on directory D:\WSUS are incorrect.”

Check that the Users account or at least the NT AUTHORITY\Network Service account has Read permissions on D:\ and D:\WSUS. If not, add these permissions. This folder read-only is sufficient for permissions for Network Service on D:\.

Restart the Update Services service and the event id 10012 should not return.

Source: Source: Windows Server Update Services Event ID: 10012
See also: Windows Server Forum - Event ID 10012 Directory Icorrect

Block updates

How to temporarily block the installation of the .NET Framework 4.6.1
How to temporarily block the installation of the .NET Framework 4.5.2
How to temporarily block the installation of the .NET Framework 4.5.1 and its corresponding language packs
How to temporarily block the installation of the .NET Framework 4 Client Profile on a computer that is running Windows Vista or Windows 7
How to temporarily block the installation of the .NET Framework 2.0 Service Pack 1

How to block the automatic upgrade of Internet Explorer 9 or Internet Explorer 8

Windows 10 offers Dual Scan

Scans against WSUS *AND* Windows Update, but downloads the latest Windows updates from Windows Update.
This cause the client tot download newer updates for Windows than configured to in your WSUS server.

It is caused by the presence of update deferral settings.

If the output of the following shows IsDefaultAUService true for Windows Update and false for Windows Server Update Services, then that system will apply updates only from Windows Update and not from WSUS:

$ServiceManager = New-Object -ComObject "Microsoft.Update.ServiceManager"
$ServiceManager.Services | Select-Object Name,IsDefaultAUService

To disable Dual Scan:
For Windows 10 1607 and higher configure “Do not allow update deferral policies to cause scans against Windows Update” in a GPO if you want to use deferral setings with WSUS.
Also make sure DeferUpgrade is set to 0 or removed from HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsUpdate\UX\Settings.

Sources:

Table of Contents