如何使用 PowerShell 在远程计算机上安装 Windows 更新

Question

I'm trying to install Windows Updates on a Remote Computer with this command:

$InstallSplat = @{
    AcceptAll = $true
    SendReport = $true
    IgnoreReboot = if ($Reboot) { $false } else { $true }
    PSWUSettings = @{
        SmtpServer = "my mail server"
        From = "myfrom <myfrom@myfrom.com>"
        To = "myto <myto@myto.com>"
        Port = 25
    }
}

Invoke-Command -ComputerName $_ -Credential $cred -AsJob -ArgumentList $InstallSplat -ScriptBlock { 
    param([hashtable]$InstallSplat)
    Import-Module PSWindowsUpdate
    Install-WindowsUpdate @InstallSplat
    $Error | out-file C:\install\installwinupdate.log -Append
}

I pass a credential Object with domain admin privileges in $cred but I still always get this error

Install-WindowsUpdate : Access denied (Ausnahme von HRESULT: 0x80070005 (E_ACCESSDENIED)) In Zeile:4 Zeichen:25
+                         Install-WindowsUpdate @InstallSplat
+                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-WindowsUpdate], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,PSWindowsUpdate.GetWindowsUpdate

The Command Install-WindowsUpdate itself does not have a credential parameter I could use. The Command needs to run in an elevated PowerShell, but I use an elevated PowerShell when starting this command on my Computer.

I Also tried creating a New-PSSession with my $cred and run Invoke-Command -Session $session instead of Invoke-Command -ComputerName $_ with the same result.

Does anybody know what's happening here? Why do I get Access denied?

It can't have anything to do with passing the $InstallSplat because the same thing happens if I don't pass any parameter at all and write the parameters and their Values directly at the command instead of splatting.

Answer 1

The Problem was, that you can't Download or Install Updates on a machine from another remote machine. Here's a list what you can or can't do remotely when it comes to Windows Updates

The solution is, to create a scheduled task on each server you want to install updates from a remote script, and start that task.

luckily, when you use the PSWindowsUpdate module, you don't have to do that yourself, you can just use Invoke-WUJob (formerly Invoke-WUInstall ) which does the trick for you.

I used it like so ( $ServerData.Value contains a list of my Servers) and it works like a charm. It creates a scheduled task on each server, and runs them immediately, if you add the -RunNow Parameter.

invoke-WUJob -ComputerName $ServerData.Value -Script { Import-Module PSWindowsUpdate ; Install-WindowsUpdate -AcceptAll -SendReport -IgnoreReboot -PSWUSettings @{From='xy';Port=25;SmtpServer='xy';To='xy'} | Out-File C:\install\PSWindowsUpdateLog.txt -Append} -Confirm:$false -verbose -RunNow

Note that what you specify as a script block in -Script will be pasted to -Command " <here> " in your scheduled task, so you should work with ' inside -Script .