Protecting Windows Environment Using PowerShell #1: Automating patch management with PowerShell

Patch management is an essential aspect of maintaining the security and stability of a Windows environment. Keeping systems up to date with the latest security patches and software updates can help protect against vulnerabilities and prevent potential breaches. While patch management can be a time-consuming and tedious task, it can be automated using PowerShell.

One of the most useful PowerShell cmdlets for patch management is “Get-WUList.” This cmdlet allows you to check for available updates on a Windows system and can be used to automate the process of downloading and installing updates.

For example, the following script can be used to check for updates and install them on a single system:

powershellCopy code$updates = Get-WUList
If ($updates) {
    Install-WindowsUpdate -AcceptAll -IgnoreReboot
}

This script uses the Get-WUList cmdlet to check for available updates and assigns the result to the variable $updates. If updates are found, the script uses the Install-WindowsUpdate cmdlet to install them. The -AcceptAll parameter is used to automatically accept the license terms for the updates and the -IgnoreReboot parameter is used to prevent the system from rebooting after installation.

For automating patch management on multiple systems, we can use the Invoke-Command cmdlet to run the script on remote systems.

$computers = "computer1", "computer2", "computer3"

Invoke-Command -ComputerName $computers -ScriptBlock {
    $updates = Get-WUList
    If ($updates) {
        Install-WindowsUpdate -AcceptAll -IgnoreReboot
    }
}

In this example, the script is run on the remote systems specified in the $computers variable.

Another useful cmdlet for patch management is “Get-HotFix,” which allows you to check which updates have already been installed on a system. This can be useful for identifying which systems have not yet been patched.

Get-HotFix

To view only the installed updates that have a specific keyword in the title, use the -Description parameter:

Get-HotFix -Description "Security*"

This command will return all the installed updates that have a title that starts with “Security”.

You can also use the -ComputerName parameter to check the installed updates on remote systems:

Get-HotFix -ComputerName "computer1"

Another useful script for patch management is one that can check for missing updates and email the report to the administrator.

$computers = "computer1", "computer2", "computer3"
$missingUpdates = @()

foreach ($computer in $computers) {
    $updates = Get-WUHistory -ComputerName $computer -ErrorAction SilentlyContinue | Where-Object {$_.ResultCode -eq "Failed"}
    $missingUpdates += $updates
}

If ($missingUpdates) {
    $smtpServer = "smtp.example.com"
    $to = "admin@example.com"
    $from = "patchmanagement@example.com"
    $subject = "Missing updates report"
    $body = $missingUpdates | Format-Table -AutoSize | Out-String
    $message = New-Object System.Net.Mail.MailMessage $Net.Mail.MailAddress $from, $to
    $message.Subject = $subject
    $message.Body = $body
    $smtp = New-Object System.Net.Mail.SmtpClient $smtpServer
    $smtp.Send($message)
}

This script uses the Get-WUHistory cmdlet to check for updates that have failed to install on the specified computers and assigns the results to the $missingUpdates variable. If missing updates are found, the script uses the System.Net.Mail.MailMessage and System.Net.Mail.SmtpClient classes to send an email with the report to the administrator. The email details such as SMTP server, to, from, subject and body can be customized as per the requirement.

These are just a few examples of how PowerShell can be used to automate patch management in a Windows environment. With a little creativity, you can use PowerShell to create scripts that suit your specific needs and streamline your patch management process.

It is also important to note that before automating the patch management process it is important to have a testing environment and testing the scripts. It is also important to have a rollback plan in case something goes wrong during the automation process.