SystemUpdatePro

One evidence-first update run for Windows endpoints.

Download · Preview safely · Provider coverage · Safety model

SystemUpdatePro coordinates Windows Update and supported OEM tooling, then handles application packages from the same PowerShell run. It fits MSP, RMM, and local administrator workflows that need useful evidence without a hosted control server.

Firmware is excluded by default. Dry runs check that tracked persistent state did not change, and every completed run produces an operator report.

_{Representative dry-run report rendered by the production report generator with sample endpoint data.}

Why teams use it

• See the plan first. -DryRun inventories enabled channels and verifies the no-persistent-change contract before anyone approves an update window.
• Firmware fails closed. Unknown power, disk, model applicability, or BitLocker state blocks BIOS work. -Force can't bypass those gates.
• Privileged mutations use a protected journal with startup recovery and reverse-order restoration.
• Reports, event data, exit codes, webhook payloads, and Prometheus metrics give RMM operators evidence they can archive or parse.

What it updates

Channel	Coverage	How it is handled
Windows	Windows Update, Microsoft Update, servicing health, optional WSUS bypass	Policy-aware selection with built-in WUA fallback
Dell, Lenovo, HP	Drivers and optional firmware	Dell Command Update, LSUClient, or HP Image Assistant after capability checks
Other hardware	ASUS, Acer, MSI, Surface, Framework, Panasonic, Intel, AMD, NVIDIA	Verified installed vendor tools or a recorded acquisition plan
Applications	WinGet, Chocolatey, Scoop, StoreEdgeFD, supported WSL package managers	Scope-aware planning with exclusions, pins, and conflict deferrals

SystemUpdatePro checks platform support before each provider runs. An unsupported provider is recorded as skipped instead of being reported as a success.

Start with a dry run

1. Download SystemUpdatePro-v4.2.1.zip from the latest release.
2. Compare the archive with the published SHA-256 file.
3. Extract it, open an elevated PowerShell window in that folder, and run:

.\SystemUpdatePro.ps1 -DryRun

4. Review the HTML report in C:\ProgramData\SystemUpdatePro\Logs.
5. Run the same command without -DryRun when the plan matches your maintenance policy.

No firmware is installed unless -IncludeBIOS is supplied and every firmware prerequisite is known ready.

Common runs

Goal	Command
Preview all enabled channels	.\SystemUpdatePro.ps1 -DryRun
Windows Update only	.\SystemUpdatePro.ps1 -SkipOEM -SkipWinget
OEM updates only	.\SystemUpdatePro.ps1 -SkipWindows -SkipWinget
Include approved firmware	.\SystemUpdatePro.ps1 -IncludeBIOS
Back up the current driver store	.\SystemUpdatePro.ps1 -BackupDrivers
Preview driver rollback	.\SystemUpdatePro.ps1 -DryRun -RollbackDrivers
Repair Windows Update first	.\SystemUpdatePro.ps1 -RepairWindowsUpdate
Build a redacted support bundle	.\SystemUpdatePro.ps1 -CreateDiagnosticBundle
Review recent run history	.\SystemUpdatePro.ps1 -ShowHistory -HistoryCount 20

Run Get-Help .\SystemUpdatePro.ps1 -Full for the complete parameter reference and examples.

Safety model

• BIOS and firmware are opt-in. Free space, AC power, charge level, model applicability, and BitLocker status must all pass.
• A restore point is requested before a live run, subject to the Windows throttle. Driver exports provide a separate rollback path.
• -DryRun records tracked state before and after planning. Any persistent drift fails the run.
• Downloaded dependencies are restricted to approved HTTPS origins, hashes, versions, architectures, and publishers.
• Interrupted registry, service, cache, and scheduled-task work is recovered from a protected journal before a new run starts.
• Webhook secrets come from an environment variable or an administrator-protected JSON file, never a visible command argument.
• Active application conflicts are deferred by policy. Unattended runs don't force-close unknown user processes.
• Standard component cleanup keeps update rollback available. Irreversible DISM /ResetBase has its own explicit switch.

-Force only relaxes non-firmware warnings such as low free space or a pending reboot. It never overrides unknown firmware safety state.

Operator evidence

The report separates update availability from update application, redacts the device serial number, and records provider readiness. Dependency provenance includes the version, publisher or exact hash, architecture, and install path used during the run.

Every terminal run also records a schema-versioned history item. Optional integrations include Application event log XML, an Azure Monitor friendly webhook body, a Prometheus textfile, and durable webhook delivery evidence.

Install as a module

The release archive includes a PowerShell module manifest and launcher. Import it from its extracted directory, then pass script switches through the isolated child process:

Import-Module .\SystemUpdatePro.psd1
$exitCode = Invoke-SystemUpdatePro -ArgumentList '-DryRun', '-SkipOEM'

The launcher returns the script's exit code without closing the importing PowerShell session.

Direct script download

The release archive plus checksum is the recommended install path. For a source-only deployment, download the script directly:

Invoke-WebRequest `
  -Uri 'https://raw.githubusercontent.com/SysAdminDoc/SystemUpdatePro/main/SystemUpdatePro.ps1' `
  -OutFile 'SystemUpdatePro.ps1'

Platform contract

Platform	Windows servicing	WinGet	OEM adapters
Windows 10 build 14393 to 17762	Supported	Requires build 17763 or newer	Dell and Lenovo on supported x64 models
Windows 10 build 17763 or newer, Windows 11	Supported	Administrator user context	Matching Dell, Lenovo, or HP hardware
Server 2016, 2019, 2022	Supported	Skipped	Skipped
Server 2025 Desktop Experience	Supported	Administrator user context	Skipped
Server Core	Supported	Skipped	Skipped

Windows Update and inbox servicing support x86, x64, and ARM64. Provider tooling can impose narrower architecture or operating-system limits, which the capability report states before execution.

Policy and offline use

Use -PolicyPath for package exclusions, pins, conflict handling, maintenance windows, and Windows Update selection. -RolloutPolicyPath adds deterministic endpoint cohorts with local promote, hold, or halt evidence.

Air-gapped or proxy-restricted endpoints can use an administrator-prefilled content-addressed cache:

.\SystemUpdatePro.ps1 `
  -Offline `
  -DependencyCachePath 'C:\ProgramData\SystemUpdatePro\Cache' `
  -DryRun

Offline mode accepts only artifacts that match the built-in acquisition manifest.

Files written on the endpoint

Path	Purpose
C:\ProgramData\SystemUpdatePro\Logs\	Logs, transcripts, and HTML reports
C:\ProgramData\SystemUpdatePro\update_history.json	Schema-versioned run history
C:\ProgramData\SystemUpdatePro\DriverBackups\	Driver export snapshots
C:\ProgramData\SystemUpdatePro\Cache\	Optional verified offline artifacts
C:\ProgramData\SystemUpdatePro\metrics.prom	Optional Prometheus textfile

Retention limits cover owned logs, reports, transcripts, provider output, quarantined recovery files, and driver backups.

Exit codes

Code	Meaning
0	Success, no reboot required
1	Success, reboot required
2	Partial success
3	Critical failure
4	Insufficient disk space
5	Pending reboot blocked the run
6	Another instance owns the lock
7	Firmware safety prerequisites blocked firmware work

Requirements

• Windows build 14393 or newer
• Windows PowerShell 5.1 or PowerShell 7
• An administrator account or NT AUTHORITY\SYSTEM
• Network access to each enabled provider, unless -Offline is used

Development

Run the same Pester suite in Windows PowerShell 5.1 and PowerShell 7:

Invoke-Pester .\tests\SystemUpdatePro.Tests.ps1

Then validate the module and run static analysis:

Test-ModuleManifest .\SystemUpdatePro.psd1
Invoke-ScriptAnalyzer .\SystemUpdatePro.ps1
Invoke-ScriptAnalyzer .\SystemUpdatePro.psm1
Invoke-ScriptAnalyzer .\tests\SystemUpdatePro.Tests.ps1

Open an issue before a large behavior change so the safety contract is clear. Changes to privileged update behavior need tests for both successful execution and recovery after failure.

License

SystemUpdatePro is available under the MIT License.