- Uncategorized
Targeted Windows Updates Deployment: How to Select Exactly Which Patches to Install
One of the most common frustrations with Windows Update is the lack of granular control. You either install everything or install nothing. For production environments, this all-or-nothing approach is risky — a single problematic update can take down a line-of-business application, and rolling it back under pressure is never pleasant.
WuInstall provides fine-grained filtering that lets you install exactly the updates you want, skip the ones you do not, and verify everything before committing. Here is how to build a targeted deployment strategy.
- WuInstall Team
Filter by KB Article Number
The most precise way to target a specific update is by its KB number. Use the /match switch:
wuinstall /install /match "KB5034441" /autoaccepteulaThis searches all available updates, selects only the one containing “KB5034441” in its title, and installs it. Nothing else is touched.
Need to install multiple specific KBs? With WuInstall Pro, you can use regular expressions:
wuinstall /install /match "(KB5034441|KB5034439|KB5034467)" /autoaccepteulaInstall from a Curated List
Not all security updates carry the same weight. If you only want to address the most urgent vulnerabilities first, filter by severity:
wuinstall /search /severity CIThis returns only Critical and Important severity updates. You can also add M for Moderate or L for Low, but in most server patching scenarios, focusing on Critical and Important gives you the best risk-reduction-to-downtime ratio.
Exclude Known-Problematic Updates
Sometimes you want to install everything except a specific update that is known to cause issues. The /nomatch switch handles this:
wuinstall /install /nomatch "KB5034441" /autoaccepteulaYou can also maintain an exclusion file for persistent blocklists:
# C:\blocked_updates.txt
KB5034441
Silverlight
Language Packwuinstall /install /nomatchfile "C:\blocked_updates.txt" /autoaccepteulaCombine both for maximum control — install only approved updates while excluding known bad ones:
wuinstall /install /matchfile "C:\approved.txt" /nomatchfile "C:\blocked.txt" /autoaccepteulaFilter by Release Date
Another useful strategy is to avoid installing updates that were released very recently — giving them time to be tested by the wider community first. The /releasedate switch supports both absolute dates and relative day offsets:
wuinstall /install /releasedate +14 /autoaccepteulaThis installs only updates that are at least 14 days old. Combine it with severity filtering for a conservative but effective patching policy:
wuinstall /install /severity CI /releasedate +14 /autoaccepteulaOnly Critical and Important updates older than two weeks get installed — a reasonable balance between security and stability.
Limit Update Size
On machines with limited bandwidth or disk space, you can cap the size of individual updates or the total download:
wuinstall /install /updateSize lt:100MB /autoaccepteulaThis skips any update larger than 100 MB. Alternatively, set a total cap across all updates:
wuinstall /install /maxTotalSize 500MB /autoaccepteulaPreview before installing
Every one of these filters works with /search too. Always preview your filter combination before deploying:
wuinstall /search /severity CI /releasedate +14 /nomatchfile "C:\blocked.txt"Review the output. If the list looks right, swap /search for /install and run it for real. This preview-then-deploy workflow eliminates surprises and gives you an auditable record of exactly what was evaluated.
Putting It All Together
A realistic enterprise command combining several filters might look like this:
wuinstall /install /classification CS /severity CI /releasedate +7 /nomatchfile "\\fileserver\config\blocked.txt" /autoaccepteula /reboot_if_needed /logfile_append "C:\logs\patching.txt"This installs Critical and Security classification updates with Critical or Important severity, at least 7 days old, excluding anything in the blocklist, auto-accepting EULAs, rebooting only if necessary, and appending everything to a persistent log file. One command, full control.
