Windows Update¶
An unpatched machine has holes that are public, documented, and often have working exploits available. Patching closes more of them at once than any other single change.
Start it early¶
Updates download slowly and may need a restart. Start them in the first few minutes of a round and let them run while you work on accounts and services.
Settings → Windows Update → Check for updates. Install everything offered. When it asks to restart, finish what you're doing, make sure no other change is half done, and restart.
On Server 2022 the same page exists under Settings → Update & Security → Windows Update, or run sconfig and choose option 6.
From the command line¶
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate
Install-WindowsUpdate -AcceptAll -AutoReboot
The module isn't built in; the first line installs it, which needs internet access. If that's blocked, use the Settings page.
Check what's installed¶
Get-HotFix | Sort InstalledOn -Descending | Select -First 5 HotFixID, InstalledOn
HotFixID InstalledOn
-------- -----------
KB5044285 8/14/2026
KB5043130 7/10/2026
A machine whose newest update is months old has been neglected. (Get-HotFix).Count gives the total; a maintained Windows 11 install has dozens.
Other Microsoft products¶
Office, SQL Server, and other Microsoft software only get patches through Windows Update if you opt in.
Settings → Windows Update → Advanced options → Receive updates for other Microsoft products: On.
Try it¶
- Run Windows Update from Settings and, while it runs, list installed updates with
Get-HotFix. - Find the update history in Settings and match it to
Get-HotFix.
Build it¶
A one-liner that prints the newest Get-HotFix InstalledOn date, so your baseline script tells you how stale the image is.