--- title: "Master PowerShell Windows Updates Reporting" description: "Build a comprehensive PowerShell Windows Updates report and stay informed on your systems' update status." canonical: "https://adamtheautomator.com/powershell-windows-update/" --- # Master PowerShell Windows Updates Reporting > Build a comprehensive PowerShell Windows Updates report and stay informed on your systems' update status. Source: https://adamtheautomator.com/powershell-windows-update/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Master PowerShell Windows Updates Reporting](https://adamtheautomator.com/wp-content/uploads/2019/07/rawpixel-983726-unsplash-1024x683-1.jpg) # Master PowerShell Windows Updates Reporting [![](https://secure.gravatar.com/avatar/4147968aa2332aa682bcebf295e4e9d0eb2672dee3d9ae0523a00ac51e7d6017?s=192&d=mm&r=g)Bill Kindle](https://adamtheautomator.com/author/bill/)25 July 20194 min. read Categories: [IT Ops](/category/it-ops/) Tags:[PowerShell](/tag/powershell/)[Windows Updates](/tag/windows-updates/) Table of Contents * [How to Tell When a PowerShell Report is Needed](#how-to-tell-when-a-powershell-report-is-needed) * [Brainstorming a Windows Update Report](#brainstorming-a-windows-update-report) If you’ve ever deployed Windows Updates to clients on your network, you have probably been asked by your manager(s) what KB’s were deployed, and when if an issue comes up on a workstation or server. Unfortunately, sometimes the built-in WSUS server reporting tool can leave you frustrated and doesn’t have great functionality for generating them outside of the WSUS management GUI. You have an alternative; a [PowerShell](https://adamtheautomator.com/tag/powershell/) Windows Update report! ## How to Tell When a PowerShell Report is Needed I was recently asked by a group of managers that were working on validating a security vulnerability scan for some assistance. This vulnerability scan was claiming that a set of systems were missing particular Microsoft KB’s, KB’s that were recently approved, deadlined, and showing as installed in the WSUS management console. I sent some screenshots of the console status along with my sysadmin reply. I didn’t give it much thought at the time because I was busy with other projects and this was a routine request. A day or so went by, and another vulnerability scan was run, producing the same results. Management was not convinced that the updates were installed. Having issues with WSUS from time to time, I started to distrust the built in reports and the management console. I didn’t know updating Windows as this hard! To be cautious, and a little more diligent, I decided to bypass the WSUS management console and go straight to the workstations and servers that were showing up in the security vulnerability scan. ## Brainstorming a Windows Update Report Luckily, the security vulnerability scan only found about 4 workstations and 12 servers with these supposedly missing KB’s. So I created a simple list in a text file using the fully qualified domain name (FQDN) of each host. I also knew for a fact, that the missing KB’s would have been installed in the past 30 days as I just completed a maintenance cycle. With this knowledge in hand, I jotted down some pseudo code to help me begin. Here’s what I outlined: * Store my text file that contains the list of hosts. * For each of the hosts in that file, run a command. * The command must gather installed KB’s installed in the last 30 days. * The output only needs to contain the hostname, KB/HotFix ID, and the install date. * The output needs to be readable, and just needs to be a simple file. * No fancy coding needed, just comparing visually to what WSUS reporting was displaying. Based on my notes, I had a good idea of what I was looking for and what cmdlets I might need. The primary focus was on the `Get-HotFix` cmdlet. This cmdlet queries all the hotfixes (more commonly referred to as security updates) that have been applied to a Windows host. It can find all or specific updates on Windows machines. You can read more about this cmdlet and how to use it [here](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-hotfix?view=powershell-5.1). `Get-HotFix` does not support implicit remoting so I needed to come up with method to run this cmdlet on the systems I needed to report on. [`Invoke-Command`](https://adamtheautomator.com/invoke-command/ "Invoke-Command") does and you can pass multiple values to the `ComputerName` parameter. I already have saved a list of hosts I am targeting, so I’ll save myself some typing and store those hosts as a variable. To do so, I’ll have to assign a variable name and make the value the list of hosts. [`Get-Content`](https://adamtheautomator.com/powershell-get-content/ "Get-Content") will read the content of the text file line by line creating an array of sorts. Let’s call this array `$Hosts`. Now I have a command, some data to feed to the next set of commands, but I need to make the resulting data readable and concise. I want to take a moment here to emphasize **_“Filter First, Format Last.”_** . Remembering this will help you when working with these types of scripts. Opening up a PowerShell session and running the `Get-Hotfix` cmdlet by itself will typically result in a long list of updates that have been applied to a host. ```powershell PS51> Get-HotFix Source Description HotFixID InstalledBy InstalledOn ------ ----------- -------- ----------- ----------- MACWINVM Update KB2693643 MACWINVM\Administ... 3/14/2019 12:00:00 AM MACWINVM Update KB4100347 NT AUTHORITY\SYSTEM 2/17/2019 12:00:00 AM MACWINVM Update KB4230204 NT AUTHORITY\SYSTEM 7/6/2018 12:00:00 AM MACWINVM Security Update KB4287903 NT AUTHORITY\SYSTEM 7/8/2018 12:00:00 AM MACWINVM Security Update KB4338832 NT AUTHORITY\SYSTEM 7/21/2018 12:00:00 AM MACWINVM Update KB4338853 NT AUTHORITY\SYSTEM 7/6/2018 12:00:00 AM MACWINVM Update KB4343669 NT AUTHORITY\SYSTEM 7/19/2018 12:00:00 AM MACWINVM Security Update KB4343902 NT AUTHORITY\SYSTEM 8/15/2018 12:00:00 AM MACWINVM Update KB4346084 NT AUTHORITY\SYSTEM 5/11/2019 12:00:00 AM MACWINVM Update KB4456655 NT AUTHORITY\SYSTEM 9/12/2018 12:00:00 AM --snip-- ``` Filtering helps gather just the information you need. Without filtered data, formatting is useless at this point. Think of filtering as your data type requirements, and formatting as how you want that data displayed. For my purposes, I already had the requirements thought out. I needed to get updates installed in the past 30 days. To filter, I will need to use the `Where-Object` cmdlet and then pass along some [member](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-member?view=powershell-6) properties and [comparison operators](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_comparison_operators?view=powershell-6) with a dash of math. To do this, I will take every object returned (`$_`) from `Get-HotFix` and pass those to [`Where-Object`](https://adamtheautomator.com/powershell-where-object/ "Where-Object") to find all updates installed on a date that is greater than (`-gt`) today’s date (or whenever I run the script) minus (-30) days ago. That will get the initial data I’m looking for. ```powershell Get-HotFix | Where-Object { $_.InstalledOn -gt ((Get-Date).AddDays(-30)) } ``` But I want to filter the returned objects and their properties a little more. This is where `Select-Object` will help, allowing me to further trim the amount of data to be displayed to just a couple of crucial properties. ```powershell Get-HotFix | Where-Object { $_.InstalledOn -gt ((Get-Date).AddDays(-30)) } | Select-Object -Property PSComputerName, Description, HotFixID, InstalledOn ``` Now that I have the data properly filtered, now I can move on to formatting the results into a usable format. To do so I’ll pipe ( | ) the results from my previous filtering to `Format-Table -Autosize` and output as a file type of my choosing. I’ll need to use `Append` and `-ErrorAction SilentlyContinue` parameters to ensure that each result is written to the next line in the output file and if an error occurs, it won’t cause the rest of the hosts to not be contacted. ```powershell Format-Table -AutoSize | Out-File -Encoding utf8 -FilePath '.\Recent_OS_Updates.txt' -Append -ErrorAction SilentlyContinue ``` I chose to go with a text file because I didn’t require anything fancy. You can change the output to meet your needs. My output looked something similar to this: ![Simple Windows update report in PowerShell](https://adamtheautomator.com/content/images/2019/07/example_output-300x68.png) Simple Windows update report in PowerShell Here’s the final script came up with and used: ```powershell $Hosts = Get-Content -Path '.\hosts.txt' Invoke-Command -ComputerName $Hosts -ScriptBlock { Get-HotFix | Where-Object { $_.InstalledOn -gt ((Get-Date).AddDays(-30)) } | Select-Object -Property PSComputerName, Description, HotFixID, InstalledOn } | Format-Table -AutoSize | Out-File -Encoding utf8 -FilePath '.\Recent_OS_Updates.txt' -Append -ErrorAction SilentlyContinue ``` For me, this was simple, concise, and offered proof that the KB’s were indeed installed. The report was well received by the management team and in a format easily read. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fpowershell-windows-update%2F&text=Master%20PowerShell%20Windows%20Updates%20Reporting)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fpowershell-windows-update%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fpowershell-windows-update%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/06/26995-troubleshoot-dns-issues-powershell-codex.webp) ### [Troubleshoot DNS Issues with PowerShell](/troubleshoot-dns-issues-powershell/) Troubleshoot DNS issues with PowerShell by testing name resolution, DNS client settings, cache entries, and network connectivity in a repeatable workflow. ![](https://adamtheautomator.com/wp-content/uploads/2025/10/image_2025-10-24_095322075.png) ### [Migrating from PowerShell 6 to 7.5: Breaking Changes/New Features](/migrating-powershell-6-to-7-5/) Migrate from PowerShell Core 6 to 7.5: breaking changes, features, and testing tips. ![](https://adamtheautomator.com/wp-content/uploads/2025/06/featured-image-6.png) ### [How to Add Timeouts to Pester Tests with PowerShell Runspaces](/pester-test-timeout-runspaces/) Prevent Pester tests from hanging indefinitely using PowerShell runspaces. Learn to handle variable scoping, module loading, TestDrive access, and stream capture challenges with timeout protection. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)