SCCM Configmgr Powershell script to install software updates on remote clients


Few weeks ago ,colleague of mine was trying to perform patch management on bulk number of clients (servers) as monthly patching ,as part of it he made sure the maintenance window was in place,deployment was set rightly for software updates deployment.

Maintenance window started ,patches started installing and after a while ,he logged in ( browse the reports ) to check the status for deployed patches (software update groups) using reports. He found that, 30-40% was compliant and rest of them non-compliant (majority) /unknown (very few) .

By the time ,he found something wrong ,he has only 1 hr left to finish the patching activity due to the maintenance window and after the maintenance window passed ,cannot reboot the servers and you need confirm the patching status with the application teams so that they can perform the application testing.

What do do now and how to get these non-compliant servers get fix in 1hr before the maintenance window elapse ? Since there was not enough time to troubleshoot the clients and look for other methods to fix ,had preferred manual method Winking smile .

I got to know about this on the next day morning while I was chatting with him . I tried to sneak into the logs to help what could be the problem  but the logs are overwritten and nothing found for previous day issue.

The only status I got to know from him was that ,all updates available in software center showing  ‘Past due – will be installed’.


If you ever get into such issues ,I would suggest to start picking one problem client for troubleshooting ,go through the logs to check if the client is waiting for enough maintenance window or updates are waiting to complete something before they could start etc.

There could be various reasons why the software updates failed  or not even started on client and to troubleshoot ,you must check the logs.  I written couple of articles on software updates troubleshooting and reference guides .

coming to the problem ,how do I force to install the updates that are available in software center if I don’t have enough time to troubleshoot the issue or how do I install the updates that are made available on the client ?

Well ,we can use PowerShell script to select all the updates available in software center and install followed by settings configured in software update deployment like reboot or suppress reboot etc.

This script also useful to check if any updates are failed (from reporting you can get list of clients with status) for some reason and you want to install them without login to the client .

Part of the script taken from book Microsoft System Center Software Update Management Field Experience.pdf ,modified it to log the output,read notepad file for clients.

$MissingUpdates = Get-WMIObject -Namespace root\CCM\ClientSDK -Class CCM_SoftwareUpdate -Filter ComplianceState=0
$MissingUpdatesReformatted = @(MissingUpdates | Foreach-Object {if($_.ComplianceState -eq 0){[WMI]$_.__PATH}})
$InstallReturn = Invoke-WMIMethod -Namespace root\CCM\ClientSDK –Class CCM_SoftwareUpdatesManager -Name InstallUpdates –ArgumentList (,$MissingUpdatesReformatted)

Download the complete PowerShell script from TechNet Gallery Here.


To run the script on remote computers ,make sure you have enough permissions to connect wmi on remote computer and RPC (dynamic ) ports opened.

This script will check if the account you trying to run has enough permissions on remote computer ,if yes go into loop else move onto next client to perform the check and it repeat.

Script pipe the information into log file with client name, Targeted patches (approved patches) ,pending patches (include failed,waiting for MW etc) ,reboot pending and finally Compliant if it has nothing in software center to install.

If a client already installed all patches and waiting for reboot ,I considered it as compliant in the script as it will be rebooted either manually or auto reboot based on the settings you configured in deployment.



Post your feedback via comments section.

10 Responses to "SCCM Configmgr Powershell script to install software updates on remote clients"

  1. In my scenerio I have a part of servers (about 40 - where updates first need to be approved by external software provider and from time to time they not approved some specyfic updates) so I cannot force to install there all what is approved from SCCM point of view. I preffer to make exclusion on scipt level not on sccm - software group / collection level.
    So, is it possibe to point to the script to install just specyfic KB (for example 5 different KB?

    1. Hi,
      The script simply go and initiate the software updates that are available in software center. If you want to put some restrictions to install specific patch then every time when you run the script ,you need to change it or when running the script ,have a prompt to input the KB and list of clients to trigger the patch install remotely. This is possible.


  2. Hi Eswar - Thanks for the script!. I'm a beginner to the scripts and I'm trying to write a script to install only OS patches(Not app patches like Java) which are available in Software Center-->Updates. Is it possible to write PS script for the following tasks.
    1. How to include the Adm ID and Password in script to install patches on remote server.
    2. Provide multiple server in text file
    3. List of open OS patches on servers
    4. Status on Patching on Server.
    5. Check if the server rebooted and compliment with the updates.

    Please help me to write a new script or how to make changes to your script to achieve my requirements.


  3. I have found that this generates an error when running against Windows Server 2016 clients. I receive "Get-WmiObject : Generic failure". However, it does appear to correctly process the commands. Any ideas why?

    1. I do not have any server 2016 at the moment to check . since the error is generic failure ,i would look at connecting to remote server using wbemtest. Check event viewer for more defails about the error.
      is it happening for all server 2016 or very specific.


    1. Yes,it can be anything that you would like to name it but in this case ,it is clients.txt .Either you can change in script or rename the notepad file .
      I have now corrected the script to clients.txt ,thanks for pointing it.



Leave a Reply