Start free trial
  • Compliance, WuInstall

Generating Windows Update Compliance Reports from the Command Line with WuInstall

Compliance reporting is a cornerstone of enterprise patch management. Whether you are preparing for an audit, tracking SLA adherence, or simply trying to answer the question “are all our machines up to date?”, you need reliable data about the update state of every endpoint.

WuInstall’s command-line nature makes it straightforward to collect this data programmatically, feed it into reports, and integrate with monitoring systems. Here is how to build a practical compliance reporting workflow.

Listing Installed Updates

The foundation of any compliance report is knowing what is already installed. Use the /criteria switch to query installed updates:

wuinstall /search /criteria "IsInstalled=1"

This returns every software update that has been installed on the machine. The output includes the update name, severity, classification, and product — all the data you need for a compliance report.

To narrow it down to just security-relevant updates:

wuinstall /search /criteria "IsInstalled=1" /classification CS

Identifying Missing Patches

The default search — with no criteria override — already shows you what is missing:

wuinstall /search

Every update listed here is available but not yet installed. For compliance purposes, you likely care most about missing Critical and Important security updates:

wuinstall /search /severity CI /classification CS

If this returns zero results (exit code 2 — no updates found), the machine is fully compliant for that severity level.

Using Return Codes For Automated Checks

WuInstall’s exit codes are designed for scripting. The most relevant ones for compliance reporting:

Exit CodeMeaning
0Updates found (matching your criteria)
2No updates found — machine is up to date
3Updates found but none matched your filters

A simple compliance check script can leverage these codes:

wuinstall /search /severity CI /classification CS
if ($LASTEXITCODE -eq 2) {
    Write-Output "$env:COMPUTERNAME - COMPLIANT"
} else {
    Write-Output "$env:COMPUTERNAME - NON-COMPLIANT ($LASTEXITCODE)"
}

Exporting to XML for Detailed Reports

For richer data, WuInstall supports XML output with the /xmlout switch. Combined with /query_history, you get a full update history per machine:

wuinstall /search /xmlout "C:\reports\%COMPUTERNAME%_updates.xml" /query_history

The XML file contains structured data about each update — title, KB number, severity, classification, install date, and result code. This data can be parsed by PowerShell, imported into a database, or fed into a reporting dashboard.

A PowerShell snippet to parse the XML and create a CSV summary:

$servers = Get-Content "C:\servers.txt"
$results = @()
foreach ($server in $servers) {
    $xml = [xml](Get-Content "\\$server\c$\reports\${server}_updates.xml")
    foreach ($update in $xml.Updates.Update) {
        $results += [PSCustomObject]@{
            Server       = $server
            Title        = $update.Title
            KB           = $update.KBArticleID
            Severity     = $update.Severity
            IsInstalled  = $update.IsInstalled
        }
    }
}
$results | Export-Csv "C:\reports\compliance_report.csv" -NoTypeInformation

Checking Specific Patches Across the Fleet

After a Patch Tuesday, you may need to verify that a specific KB was installed on all production servers. Combine remote execution with WuInstall’s search capabilities:

$servers = Get-Content "C:\servers.txt"
foreach ($server in $servers) {
    $result = Invoke-Command -ComputerName $server -ScriptBlock {
        & "C:\tools\wuinstall.exe" /search /criteria "IsInstalled=1" /match "KB5040442"
    }
    if ($LASTEXITCODE -eq 0) {
        Write-Output "$server - KB5040442 INSTALLED"
    } else {
        Write-Output "$server - KB5040442 MISSING"
    }
}

After a Patch Tuesday, you may need to verify that a specific KB was installed on all production servers. Combine remote execution with WuInstall’s search capabilities:

$servers = Get-Content "C:\servers.txt"
foreach ($server in $servers) {
    $result = Invoke-Command -ComputerName $server -ScriptBlock {
        & "C:\tools\wuinstall.exe" /search /criteria "IsInstalled=1" /match "KB5040442"
    }
    if ($LASTEXITCODE -eq 0) {
        Write-Output "$server - KB5040442 INSTALLED"
    } else {
        Write-Output "$server - KB5040442 MISSING"
    }
}

 

Scheduling Regular Compliance Scans

Set up a Windows Task Scheduler job to run a compliance scan daily or weekly. Since WuInstall’s /search command is read-only — it never downloads or installs anything — it is completely safe to run on production systems at any time:

wuinstall /search /severity CI /classification CS /logfile "C:\reports\daily_scan_%DATE%.txt"

The log file gives you a timestamped record of what was pending on each day, making it easy to track how quickly patches are being deployed after release.

 

Tying It All Together

A complete compliance workflow with WuInstall might look like this:

  1. Daily scan: Automated /search across all endpoints, logging results to a central share.
  2. Report generation: PowerShell script parses the logs or XML output and generates a compliance dashboard.
  3. Alerting: Any machine with outstanding Critical or Important updates for more than 7 days triggers a notification.
  4. Remediation: Non-compliant machines are patched using /install with the appropriate filters during the next maintenance window.

No additional infrastructure required. No agents to install. Just WuInstall, a file share for logs, and a few PowerShell scripts to tie it together.

Take control of your Windows updates

Try WuInstall free for 30 days – full command-line control, no credit card required.

Start free trial