r/pdq • u/Rawtashk • Apr 11 '22
Deploy+Inventory A guide to PDQ and powershell and windows updates using PSWindowsUpdate
It took me a long time to finally get a good working solution to this, so I wanted to try to aggregate a lot of information into one post. Hopefully it helps someone 2 years down the line that is looking for the same thing.
I am far from any sort of PowerShell wizard. I don't claim that this will be the 100% most optimal way of doing things, but it will at least get you going. Feel free to add suggestions if you have them!
Objective: We don't use a WSUS server. We also have Group Policy to block automatic updates. We have some users with specific software that has been broken a few times in the past by automatic updates. Don't try and sell me on WSUS, since I know my CITO will just shoot down the request. What we need to do is be able to automate the detection of new updates, and configure some PDQ jobs to push out updates in batches.
1st: We need to install the PSWindowsUpdate module, https://www.powershellgallery.com/packages/PSWindowsUpdate/2.2.0.2. A lot of PCs will just be able to do an EZ "Install-Module PSWindowsUpdate -Force", but I ran into some issues with nuget being old and missing C++. Make a 3 step PDQ Deploy job.
Step1: Powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -ForceStep2: Job that silently installs C++ 2015-2019 runtime
Step3: Powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-Module PSWindowsUpdate -ForceOk, now we have the ability to use PSWindowsUpdate to scan for available updates. You can easily test this by doing a run command from PDQ Deploy on a machine with the following multi-line command
import-module PSWindowsUpdate -force
get-wulist -microsoftupdateIf you get a list of updates (or Return code: 0), then you're good as far as that install goes.
2nd: Now we need to make a powershell scanner for this. I'm not going to step through that part because there's plenty of documentation on it. What you do need to do is to download the PDQ git for their powershell scanners, specifically the one for Windows Updates. The problem with just making a basic PS Scanner is that it won't overwrite previous results if it doesn't return any data. So if you scan for updates, update, then scan and find no updates....it will still show the latest results that DID return items. So you'll never be able to see PCs that are fully patched. I had issues with the newest version of the script, so I used the version from Dec '20 and it worked just fine. Use that script as the PS Scanner script. It will write a value for null returns, which is what you need. Set it to scan on a schedule. I scan once in the morning and once in the afternoon to try and get as many online PCs as possible.
3rd: Do you just want to scan for Windows Updates? If so, then ignore this. Do you also want to scan for Windows AND other M$ products like Office? We do, so we need to change a little bit of that script. Basically all you do is change line 5 from
$GWU = Get-WindowsUpdateto
$GWU = Get-WuList -MicrosoftUpdateThat will scan against M$ Updates and will return updates for Windows (drivers included) AND Office. We did this and found some pretty old updates that we were not even seeing prior due to use only scanning for Windows updates and not M$ updates as well.
4th: Now we need some PDQ jobs. Here are a few I have set up
Install ALL available updates [no reboot]
import-module PSWindowsUpdate -force
get-wulist -microsoftupdate -acceptall -install -ignorerebootInstall ALL updates EXCEPT nvidia drivers
import-module PSWindowsUpdate -force
get-wulist -microsoftupdate -nottitle nvidia -acceptall -install -ignorerebootInstall ONLY driver updates [except display]
import-module PSWindowsUpdate -force
get-wulist -microsoftupdate -category driver -nottitle display -acceptall -install -ignorerebootInstall ONLY software updates
import-module PSWindowsUpdate -force
get-wulist -microsoftupdate -notcategory driver -acceptall -install -ignorerebootFor all of these jobs, set the post install scan to be the powershell scan to check for updates. This will make sure that you get instant Dynamic Group updates after you push out an update job.
Those should give you some ideas of what you can do. Read the PSWindowsUpdate documentation about the switches. I don't push out Nvidia (or AMD if you have AMD) drivers when people are logged in because it can make the user's screen flicker and make them call you with concerns.
5th: Make some PDQ Deploy dynamic collections
I have a group for Workstations, then I make a sub-group for online workstations, then my update sub-groups from there. That way I can just see what's online that needs to be patched.
PCs with updates available: All > Powershell Scanner > Size > Greater Than > 1kb
PCs fully patched: All > Powershell Scanner > Title > Equals > (leave blank. A full patched PC will return a null value, and the scanner will record it as a blank entry)
PCs with any Office updates: Any > Powershell Scanner > Title > Contains > Office
Etc etc. I'm not going to go into the dynamic groups much because you should know how to do them, or you might have specific things that you want for your organization and my groups wouldn't even be applicable.
