Can we remove security patch using powershell scripts?

PowerShell Help
1

This is required to run from sccm. The scrip need to have a log file to capture the activity. Please

2

Screenshot 2025-01-07 162532
Screenshot 2025-01-07 1625321350×924 22 KB

this is my script

Define the KB numbers of the updates you want to remove

$KBNumbers = @(“KB5048667”)

Define the log file path

$LogFile = “C:\Windows\Temp\RemoveOSPatch.log”

Function to write log entries

function Write-Log {
param (
[string]$Message
)
$Timestamp = Get-Date -Format “yyyy-MM-dd HH:mm:ss”
$LogEntry = “$Timestamp - $Message”
Add-Content -Path $LogFile -Value $LogEntry
}

Start logging

Write-Log “Script started.”

foreach ($KBNumber in $KBNumbers) {
try {
# Get the update object
$Update = Get-WmiObject -Query “Select * from Win32_QuickFixEngineering where HotFixID=‘$KBNumber’”

    # Check if the update exists
    if ($Update) {
        Write-Log "Update $KBNumber found. Attempting to uninstall."
        # Uninstall the update and allow reboot
        $UninstallCommand = "wusa.exe /uninstall /kb:$KBNumber /quiet /norestart"
        Invoke-Expression $UninstallCommand
        Write-Log "Update $KBNumber has been uninstalled. System will reboot if required."
    } else {
        Write-Log "Update $KBNumber not found."
    }
} catch {
    Write-Log "Error occurred while processing $KBNumber $($_.Exception.Message)"
}

}

End logging

Write-Log “Script completed.”

3

First, please put your script into the post as preformatted text (behind the gear icon) for easier readability.

Second, can you describe the issue you are having with the script? Is it throwing errors, and if so what are they?

4

To uninstall with wusa you need to drop the “KB” off the ID. It accepts only the number.

So if it’s KB5048667 the wusa command would be
wusa /uninstall /kb:5048667 /quiet /norestart

5

Hello Darwim,

Thanks for the feedback,

I have added the script as text format and there is no error from the script but it’s not removing the patch. Please advice.

$KBNumbers = @(“123456”)
$LogFile = “C:\Windows\Temp\RemoveOSPatch.log”
function Write-Log {
param (
[string]$Message
)
$Timestamp = Get-Date -Format “yyyy-MM-dd HH:mm:ss”
$LogEntry = “$Timestamp - $Message”
Add-Content -Path $LogFile -Value $LogEntry
}
Write-Log “Script started.”
foreach ($KBNumber in $KBNumbers) {
try {
$Update = Get-WmiObject -Query “Select * from Win32_QuickFixEngineering where HotFixID=‘$KBNumber’”
if ($Update) {
Write-Log “Update $KBNumber found. Attempting to uninstall.”
$UninstallCommand = “wusa.exe /uninstall /kb:$KBNumber /quiet /norestart”
Invoke-Expression $UninstallCommand
Write-Log “Update $KBNumber has been uninstalled. System will reboot if required.”
} else {
Write-Log “Update $KBNumber not found.”
}
} catch {
Write-Log “Error occurred while processing $KBNumber $($_.Exception.Message)”
}
}
Write-Log “Script completed.”

6

Hello Neemobeer,

I Have to that but the script is not doing anything, the patch is not getting removed and the log says update not found.

$KBNumbers = @(“123456”)
$LogFile = “C:\Windows\Temp\RemoveOSPatch.log”
function Write-Log {
param (
[string]$Message
)
$Timestamp = Get-Date -Format “yyyy-MM-dd HH:mm:ss”
$LogEntry = “$Timestamp - $Message”
Add-Content -Path $LogFile -Value $LogEntry
}
Write-Log “Script started.”
foreach ($KBNumber in $KBNumbers) {
try {
$Update = Get-WmiObject -Query “Select * from Win32_QuickFixEngineering where HotFixID=‘$KBNumber’”
if ($Update) {
Write-Log “Update $KBNumber found. Attempting to uninstall.”

$UninstallCommand = “wusa.exe /uninstall /kb:$KBNumber /quiet /norestart”
Invoke-Expression $UninstallCommand
Write-Log “Update $KBNumber has been uninstalled. System will reboot if required.”
} else {
Write-Log “Update $KBNumber not found.”
}
} catch {
Write-Log “Error occurred while processing $KBNumber $($_.Exception.Message)”
}
}
Write-Log “Script completed.”

7

Just to verify, as I’m not too familiar with the wusa.exe parameters… Does the wusa command work if you run it at the prompt?

wusa.exe /uninstall /kb:123456 /quiet /norestart

That would determine if the command has an issue or the PowerShell has the issue.

8

A quick search turned up this: Start-Process WUSA.exe Works, But Does Nothing - #9 by s31064 - Programming & Development - Spiceworks Community

The solution here uses start-process (which is better practice than invoke-expression). It’s installing instead of uninstalling, but it might give you some inspiration.

9

Also from your initial example and the test with just the ID, dropping the ‘KB’ you’re creating two different problems. In the initial code you are passing “KBXXXXX” to wusa that won’t work because it needs the ID without “KB”. In your second example code the WMI class Win32_QuickFixEngineering needs the ID with “KB”. So…

Pass the ID with “KB” to the WMI class, if found strip off “KB” and pass the ID to wusa

10

Can you please take a moment and edit your posts to put your code in “preformatted” blocks. It’s the little </> symbol which may be under the gear icon depending on your resolution/size. You can also simply put three backticks ` on the line before and three more on the line after. like this

backtickbacktickbacktick
code sample
more code
code
backtickbacktickbacktick

It will look like this

code sample
more code
code

Thanks in advance.