The WSUS administration console shows computers with not installed (critical) updates.

To be clear:

  • The computers report their status every day.
  • These updates do have a deadline that has already been elapsed.

I assume that these updates have been hidden locally before the computer is joined to the active directory (after joining the AD no user can decline/hide an update with a deadline).

Is there a way to force installing updates?

WSUS version is 3.1.6001.65.


i'm using the script already mentioned by Oskar with psexec to patch a bunch of servers. if a server has a borked WU Agent i use this script:

net stop bits
net stop wuauserv
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /f
rd /s /q %WINDIR%\SoftwareDistribution
gpupdate /force
wuauclt /resetauthorization /detectnow
  • Would be nice if you could elaborate on how you detect a broken wsus client. Other then that very usefull. Thank you
    – EKS
    Oct 20 '09 at 14:25

Perhaps the script attached to the first post on the link to this forum can resolve the problem:

Force installation of WSUS or Windows Updates

(I'm afraid you have to register in order to download the files.)

If you are interested in a more sophisticated solution, you could take a look at the Eminentware Extension Pack for WSUS (not free).


In line with Oskar's solution. I've written a more comprehensive WUA script which can be used to force updates on client systems.

  • That script works well. Very handy after imaging computers and before releasing them into production. Jul 13 '09 at 18:51

Not really by WUS philosophy as it's a "clients pull and do what it tells them" solution. To force / push installs and patches you need something more stingy like SMS / Configuration Manager.

But some client-side scripting might be usefule, this vbscript sample searches for, downloads and installs updates (I use it at times to manually patch Server Core machines using only the command prompt).

Also, re-check the applied group policies for the troubled clients in question, perhaps they've not correctly applied them for automatic installation?

Often times however, the WUS agent itself is "borked" and need a manual kick in its back...


As others have mentioned, you can't push from the server, but you can force the client to re-check the server, by issuing the following command:

wuauclt.exe /detectnow

If you're sure that the client is connecting to your WSUS server correctly, this may solve your problem. Otherwise you can look in the client log for errors, which is located here: %windir%\windowsupdate.log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.