- Patching
Automating Windows Server Patching with WuInstall: A Step-by-Step Guide
Keeping Windows Servers patched is one of the most critical responsibilities for any IT administrator. Unpatched servers are a magnet for attackers, and manual patching across dozens or hundreds of machines is neither scalable nor reliable. WuInstall solves this by giving you full command-line control over Windows Update, making it easy to integrate patching into your existing automation workflows.
In this guide, we walk through a practical end-to-end patching workflow using WuInstall that you can adapt to your own environment.
- WuInstall Team
Step 1: Audit What Needs Patching
Before touching anything, you want to know what updates are pending. Run a search across your servers to get a clear picture:
wuinstall /searchThis queries the Windows Update API and lists all available software updates. Drivers are excluded by default. If your servers are configured with WSUS, WuInstall automatically detects it and routes the search through your WSUS server.
To narrow the search to just critical and security updates — the ones that matter most for server environments — add a classification filter:
wuinstall /search /classification CSThe letters stand for Critical and Security. You can combine as many classification codes as you need: R for Update Rollups, E for Service Packs, and so on.
Step 2: Filter by Severity
Not all security updates carry the same weight. If you only want to address the most urgent vulnerabilities first, filter by severity:
wuinstall /search /severity CIThis returns only Critical and Important severity updates. You can also add M for Moderate or L for Low, but in most server patching scenarios, focusing on Critical and Important gives you the best risk-reduction-to-downtime ratio.
Step 3: Install Updates with Automatic EULA Acceptance
Once you know what needs to be installed, the actual deployment is a single command. For unattended server patching, always include the /autoaccepteula flag so the process does not stall waiting for interactive input:
wuinstall /install /classification CS /severity CI /autoaccepteulaWuInstall will search, download, and install all matching updates in one pass. After installation, it reports individual results per update and an overall return code.
Step 4: Handle Reboots Gracefully
Many updates require a reboot. Rather than rebooting immediately (and catching administrators off guard), you can schedule the reboot with a delay:
wuinstall /install /classification CS /autoaccepteula /reboot 120This installs all critical and security updates, then initiates a reboot after 120 seconds — giving any logged-in users or running services time to wrap up.
If your patching window allows for it, /reboot_if_needed is a smarter choice: it only triggers a reboot when the installed updates actually require one.
Step 5: Multi-Reboot Update Sequences
Some cumulative updates require multiple reboot cycles to fully install. WuInstall handles this natively with the /rebootcycle option:
wuinstall /install /reboot_if_needed /rebootcycle 3 /autoaccepteula /logfile_append "C:\patching_log.txt"After each reboot, WuInstall registers itself with the Windows Task Scheduler and re-runs automatically before the next logon — repeating until no further updates are pending, up to a maximum of 3 cycles. The /logfile_append flag captures a complete log across all reboot cycles, invaluable for post-patching audits.
Step 6: Shut Down After Patching
For servers that should be powered off after maintenance windows (lab environments, staging servers, etc.), combine the reboot cycle with a shutdown:
wuinstall /install /rebootcycle /shutdown /autoaccepteulaOnce all updates are fully installed and no further reboots are needed, the server shuts down cleanly.
Scaling Across Multiple Servers
WuInstall is a standalone executable with no agent to install. Copy it to a network share and invoke it remotely using PsExec, PowerShell remoting, or your configuration management tool of choice. A simple PowerShell loop can patch an entire fleet:
$servers = Get-Content "C:\servers.txt"
foreach ($server in $servers) {
Invoke-Command -ComputerName $server -ScriptBlock {
& "\\fileserver\tools\wuinstall.exe" /install /classification CS /autoaccepteula /reboot 300
}
}Because WuInstall handles the entire update lifecycle — search, download, install, reboot — in a single command, there is minimal scripting overhead.
Conclusion
Automated server patching does not have to mean complex infrastructure like WSUS or SCCM. WuInstall gives you a lightweight, scriptable alternative that fits into any automation pipeline. Whether you are patching five servers or five hundred, the workflow stays the same: search, filter, install, reboot. All from the command line.
