On a Windows Server VPS, clicking through Settings → Windows Update over RDP works, but PowerShell is faster, works on Server Core, and can be scripted for regular patching. The community module PSWindowsUpdate is the standard tool.

1. Install PSWindowsUpdate

In an elevated PowerShell window:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-PackageProvider -Name NuGet -Force
Install-Module -Name PSWindowsUpdate -Force
Import-Module PSWindowsUpdate

If your execution policy blocks the module, allow signed scripts for the session: Set-ExecutionPolicy -Scope Process RemoteSigned.

2. See what’s available

Get-WindowsUpdate
Get-WindowsUpdate -MicrosoftUpdate        # include other Microsoft products (SQL Server, .NET…)

To always include Microsoft Update:

Add-WUServiceManager -MicrosoftUpdate -Confirm:$false

3. Install updates

Install-WindowsUpdate -AcceptAll -AutoReboot
Install-WindowsUpdate -AcceptAll -IgnoreReboot          # install now, reboot later
Install-WindowsUpdate -KBArticleID KB5040000 -AcceptAll # a specific update
Install-WindowsUpdate -Category 'Security Updates' -AcceptAll

Use -AutoReboot only when a reboot right now is acceptable. Check whether a reboot is pending:

Get-WURebootStatus

4. Hide an update

If an update is known to break something you rely on:

Hide-WindowsUpdate -KBArticleID KB5040000 -Confirm:$false
Get-WindowsUpdate -IsHidden
Show-WindowsUpdate -KBArticleID KB5040000      # unhide later

Hiding should be temporary — security fixes skipped for months are a real risk.

5. Update history

Get-WUHistory -Last 20 | Format-Table Date, KB, Result, Title -AutoSize

Without the module:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15

6. Schedule patching

Run updates in a maintenance window with a scheduled task:

$action  = New-ScheduledTaskAction -Execute "powershell.exe" `
  -Argument '-NoProfile -Command "Import-Module PSWindowsUpdate; Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot | Out-File C:\Logs\wu-$(Get-Date -f yyyyMMdd).log"'
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 4am
Register-ScheduledTask -TaskName "Weekly Windows Update" -Action $action -Trigger $trigger -User "SYSTEM" -RunLevel Highest

Create C:\Logs first. Choose a time when a reboot won’t hurt — for trading servers, outside market hours. See Windows Task Scheduler.

7. Built-in alternatives (no module)

sconfig on Windows Server (2019/2022/2025) has an update menu — option 6 “Install updates” — usable over any console, including Server Core.

Settings / Group Policy controls automatic behaviour: Computer Configuration → Administrative Templates → Windows Components → Windows Update → “Configure Automatic Updates” (e.g. “Auto download and schedule the install” at a set day and time). Active hours keep restarts away from busy periods.

Troubleshooting stuck or failing updates

Updates stuck at 0% or failing repeatedly — reset the update components:

Stop-Service wuauserv, bits, cryptsvc -Force
Rename-Item C:\Windows\SoftwareDistribution SoftwareDistribution.old
Rename-Item C:\Windows\System32\catroot2 catroot2.old
Start-Service wuauserv, bits, cryptsvc

Repair the component store and system files (needs time and internet access):

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

See SFC and DISM on Windows Server.

Not enough disk space — updates need several GB free. Clean up with Disk Cleanup or DISM /Online /Cleanup-Image /StartComponentCleanup. See Windows temporary files.

Error codes — search the code (e.g. 0x800f0922) in the Windows Update log: Get-WindowsUpdateLog writes a readable log to the desktop.

Good practice

  • Patch at least monthly — Microsoft releases security updates on the second Tuesday (“Patch Tuesday”).
  • Take a backup before major updates; on a VPS, keep a recent backup of important data off the server.
  • Reboot after updates — many fixes only take effect after a restart.
  • After patching, check critical services and applications.

Related: Windows Server initial setup and RDP brute-force protection. Our Windows VPS plans give you full administrator access to manage updates on your own schedule.

  • Windows Server
  • PowerShell
  • Updates