Join us at Experience '19: The Digital Employee Experience Conference. Learn More

Nexthink Library

Windows Update

Ensure that all devices have installed the latest security updates by triggering Windows Update to scan for updates, detect if a device is reboot-pending, check execution status of latest Windows Feature Update and investigate its potential failure reason. Execute Microsoft patch installation using Windows Update Standalone Installer (wusa.exe).

Content

Remote actions - 5

Required Modules

Nexthink Act

Platforms

Windows

Compatibility

V6.14 and later

1.0.0.0 - Initial release

Description

This Library pack is a collection of different Remote Action scripts which help improve the compliance level by ensuring that the latest security updates have been installed.Please use the links on the left menu to learn more about the function and range of action of each script.

Get Last Feature Update Status

1.0.0.0 - Initial release

Script Description

Retrieves the local date, the installation status and the name of the Windows Feature Update that was most recently processed on the device.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label	Type	Description
Installation Date	DateTime	Local device time of the last Windows Feature Update installation attempt
Installation Status	String	Result status of the last Windows Feature Update installation attempt. Possible values are: 'Unknown', 'InProgress', 'Succeeded', 'SucceededWithErrors', 'Failed', 'Aborted'
Feature Name	String	Full name of the last Windows Feature Update processed on the device

Restrictions

Script is working with Windows 10 only.

Get Windows Feature Update Diagnosis

1.0.0.0 - Initial release

Script Description

Executes Microsoft tool SetupDiag.exe, that process Windows Feature update log files and returns a list of possible failure reasons or upgrade confirmation.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 1020 seconds is recommended.

Parameters

Label	Description
Maximum Delay In Seconds	Maximum random delay set to avoid overloading server hosting virtual machines. Provide number of seconds less than 600
Setup Diag Path	Absolute path to the location of SetupDiag.exe tool on target device. For example "C:tempSetupDiag.exe"

Outputs

Label	Type	Description
Total Matching Reasons Count	Int	Total count of matching rules detected by SetupDiag.exe tool
Matching Reason List	StringList	A list of matching rules with detailed description that may assist with further investigation

Restrictions

This Remote Action is compatible with Windows 10 only.
SetupDiag tool must be deployed to target device before executing this Remote Action.

Further Information

Depending on the size of the Windows Update log file, investigation time may vary. With a log file of a total size of 160MB, processing lasts around 5 minutes.

Install Windows Update

1.0.0.0 - Initial release

Script Description

Using Windows Update Standalone Installer (wusa.exe), performs .msu patch installation from a given either URL or UNC path.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 1200 seconds is recommended.

Parameters

Label	Description
Maximum Delay In Seconds	Maximum random delay set to avoid network overload. Provide number of seconds lower than 600
Hotfix Source	Provide URL or UNC path to retrieve the msu file. Example values: http(s)://domain/folder/windows6.1-kb4503292-x64.msu, \serverSharedFolderwindows6.1-kb4503292-x64.msu

Outputs

Label	Type	Description
Reboot Required	Bool	Whether the patch requires device reboot or not

Restrictions

Restricted to update packages which have an .msu file name extension only.
The KB code has to be included in the file name wrapped by dashes to extract the code and check whether it was installed previously, (e.g. windows6.1-kb4503292-x64.msu).
Update packages must have a valid certificate.

Further Information

In case of you want to install a specific patch on several devices, it is recommendable to download and share it over the internal network.
If you want more information about Servicing stack updates, please visit this link.
To get the URL for a KB patch follow these steps:
* Go to Microsoft Update Catalog.
* Search for target KB.
* Click on Download button
* Copy link from popup menu and set HotfixSource parameter value with it.

Test Scenarios

TestNonMsuFile
Test Case	Trying to install a non .msu file
Environment	VM Windows 10 x86/x64 several languages, VM Windows 7 x64 several languages
Results	Failure - Only MSU files can be installed

TestMsuFileForx86Devices
Test Case	Trying to install x86 hotfix on devices with x86/x64 devices
Environment	VM Windows 10 x86/x64 several languages, VM Windows 7 x64 several languages
Results	Success on x86 devices and failure on x64 as that patch is not available for that architecture

TestAlreadyInstalledPatches
Test Case	Trying to install hotfixes which are already installed
Environment	VM Windows 10 x86/x64 several languages, VM Windows 7 x64 several languages
Results	Success - Remote Action returns the hotfix was already installed

TestSuitablePatches
Test Case	Trying to install hotfixes which were available to be installed
Environment	VM Windows 10 x86/x64 several languages, VM Windows 7 x64 several languages
Results	Success - Hotfixes are installed and they required device reboot. (Exit code 3010)

Invoke Windows Update

1.0.0.0 - Initial release

Script Description

ADVANCED SCRIPTRestarts Windows Update service and starts BITS service (if needed). It forces the device to scan for system updates. The script is designed for Windows 10 and 7.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 720 seconds is recommended.

Parameters

Label	Description
Maximum Delay In Seconds	Maximum random delay set to avoid virtual environment and network overload. Provide number of seconds less than 600

Outputs

None.

Restrictions

The script should not be concurrently executed on many devices which are connected to the same network.
Windows Update execution may not be executed if user has it disabled due to Group Policy configuration.

Further Information

Parameter 'MaximumDelayInSeconds' can be used to add random script execution delay. It should be used to spread over time number of I/O requests on server hosting virtual machines and reduce network workload.

Test Pending Reboot

1.0.0.0 - Initial release

Script Description

Script retrieves information if device is pending reboot and the reason. Possible causes covered are as follow:

   * Computer renaming.
   * Domain join.
   * File rename operations.
   * SCCM Agent.
   * Software installation.
   * Windows update.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label	Type	Description
Pending Reboot	Bool	Device is reboot-pending (Yes/No)
Pending Reboot Reason	String	All detected reasons for reboot-pending