How to get time:
use “win32_reliabilityRecords” WMI class to get Windows update logs time
Get-WmiObject -Class win32_reliabilityRecords -filter "sourcename = 'Microsoft-Windows-WindowsUpdateClient'" -ErrorAction SilentlyContinue |select @{LABEL = "date";EXPRESSION = {$_.ConvertToDateTime($_.timegenerated)}}, @{LABEL = 'Update';EXPRESSION = {$_.message}}, @{LABEL = 'User';EXPRESSION = {$_.User}} |FT -AutoSize -Wrap
Hot to get pending reboot:
Source: https://thesysadminchannel.com/remotely-check-pending-reboot-status-powershell/
Function Get-PendingRebootStatus {
<#
.Synopsis
This will check to see if a server or computer has a reboot pending.
For updated help and examples refer to -Online version.
.NOTES
Name: Get-PendingRebootStatus
Author: theSysadminChannel
Version: 1.0
DateCreated: 2018-Jun-6
.LINK
https://thesysadminchannel.com/remotely-check-pending-reboot-status-powershell -
.PARAMETER ComputerName
By default it will check the local computer.
.EXAMPLE
Get-PendingRebootStatus -ComputerName PAC-DC01, PAC-WIN1001
Description:
Check the computers PAC-DC01 and PAC-WIN1001 if there are any pending reboots.
#>
[CmdletBinding()]
Param (
[Parameter(
Mandatory = $false,
ValueFromPipeline=$true,
ValueFromPipelineByPropertyName=$true,
Position=0
)]
[string[]] $ComputerName = $env:COMPUTERNAME
)
BEGIN {}
PROCESS {
Foreach ($Computer in $ComputerName) {
Try {
$PendingReboot = $false
$HKLM = [UInt32] "0x80000002"
$WMI_Reg = [WMIClass] "\\$Computer\root\default:StdRegProv"
if ($WMI_Reg) {
if (($WMI_Reg.EnumKey($HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing")).sNames -contains 'RebootPending') {$PendingReboot = $true;$PendingRebootRaison = "Component Based Servicing, RebootPending. "}
if (($WMI_Reg.EnumKey($HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update")).sNames -contains 'RebootRequired') {$PendingReboot = $true; $PendingRebootRaison += "Windows update, RebootRequired. " }
if ($WMI_Reg.GetMultiStringValue($HKLM,"SYSTEM\CurrentControlSet\Control\Session Manager",'PendingFileRenameOperations').sValue) {$PendingReboot = $true; $PendingRebootRaison += "PendingFileRenameOperations. "}
#Checking for SCCM namespace
$SCCM_Namespace = Get-WmiObject -Namespace ROOT\CCM\ClientSDK -List -ComputerName $Computer -ErrorAction Ignore
if ($SCCM_Namespace) {
if (([WmiClass]"\\$Computer\ROOT\CCM\ClientSDK:CCM_ClientUtilities").DetermineIfRebootPending().RebootPending -eq $true) {$PendingReboot = $true}
}
if ($PendingReboot -eq $true) {
[PSCustomObject]@{
ComputerName = $Computer.ToUpper()
PendingReboot = $true
PendingRebootRaison = $PendingRebootRaison
}
} else {
[PSCustomObject]@{
ComputerName = $Computer.ToUpper()
PendingReboot = $false
}
}
}
} catch {
Write-Error $_.Exception.Message
} finally {
#Clearing Variables
$WMI_Reg = $null
$SCCM_Namespace = $null
}
}
}
END {}
}
Get reboot time
Get-EventLog -LogName system -Source user32 | Select TimeGenerated, Message
Kill windows update service
Get-WmiObject Win32_service -Filter “name=’wuauserv'”
Taskkill.exe /F /PID 0000
How to get WSUS registry key with PowerShell
Get-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
How to uninstsall a windows update
#=============================================================================================================================
#
# Script Name: UninstallHotfix.ps1
# Description: Uninstall scpecific KB updates
# Notes: inspired by https://techibee.com/powershell/powershell-uninstall-windows-hotfixesupdates/1084
#
#=============================================================================================================================function Uninstall-Hotfix {
[cmdletbinding()]param(
[string] $HotfixID
)$hotfixes = Get-WmiObject -Class Win32_QuickFixEngineering | select hotfixid
if($hotfixes -match $hotfixID) {
#Remove KB from begin to pass on wusa command
$hotfixID = $HotfixID.Replace(“KB”,””)
Write-host “Found the hotfix KB” + $HotfixID
Write-Host “Uninstalling the hotfix”
#$UninstallString = “cmd.exe /c wusa.exe /uninstall /KB:$hotfixID /quiet /norestart”
$status = (Start-Process -NoNewWindow -FilePath cmd.exe “/c wusa.exe /uninstall /KB:$hotfixID /quiet /norestart” -Wait).ExitCodewrite-host “Completed the uninstallation of $hotfixID”
}
else {write-host “Given hotfix($hotfixID) not found”
return
}
}
à copier:
How to check Windows Update History using PowerShell (thewindowsclub.com)
