UsoClient StartScan and StartInstall: Windows Update from the command line

UsoClient.exe is the command-line client of the Update Session Orchestrator, the Windows component that schedules scans, downloads and installs. Admins use it to start Windows Update from a script or a remote session, because wuauclt is deprecated on current Windows.

The catch is that UsoClient prints nothing, and Microsoft publishes no reference page for its switches. This page lists the switches people use and, more importantly, shows how to find out whether a command did anything.

This guide at a glance

Who it's for

Windows admins

You trigger updates from CMD, PowerShell, an RMM job or a scheduled task.

What you get

Switches and checks

The switches in call order, plus three ways to read the result.

The trap

Silence

A command that did nothing looks exactly like a command that worked.

Want to run it on a schedule? Build the task with the Scheduled Task Builder.

Applies to: Windows 10, Windows 11 and current Windows Server. Run every command from an elevated prompt (Run as administrator).

Quick answer

This starts a scan, then a download, then an install. Each command returns without printing anything. The second block reads the Windows Update client log, which is where you see what happened.

rem Run in an elevated CMD window, any folder.
rem Step 1: ask Windows Update to look for updates
usoclient StartScan
rem Step 2: download what the scan found (run after the scan has finished)
usoclient StartDownload
rem Step 3: install what was downloaded (run after the download has finished)
usoclient StartInstall
# Run in an elevated PowerShell window.
# Shows the ten newest Windows Update client events, newest first
Get-WinEvent -LogName Microsoft-Windows-WindowsUpdateClient/Operational -MaxEvents 10 |
    Format-Table TimeCreated, Id, Message -Wrap

You should see one row per event, with a time that matches the moment you ran the command. If the newest row is hours old, nothing was triggered.

What the switches do

Microsoft Learn describes the orchestrator as the component that sequences scan, download, install and restart. It does not describe UsoClient.exe itself. The table below comes from community write-ups, so treat it as reported behaviour and test it on your build.

SwitchReported behaviour
StartScanChecks for updates.
StartInteractiveScanChecks for updates and opens a dialog.
StartDownloadDownloads the updates a scan found.
StartInstallInstalls downloaded updates.
ScanInstallWaitScans, downloads and installs in one call.
RefreshSettingsReloads the Windows Update settings.
RestartDeviceRestarts the computer to finish the installation.
Warning: In a Microsoft forum thread about usoclient, a reply says the command "isn't meant to be called outside of the internal OS". Switches can change or stop working between builds, so do not build a long-term process on them without a check step.

Practical examples

The problem: a server is in its maintenance window and you want updates installed from a script, in order, without opening Settings.

The solution: ScanInstallWait asks for scan, download and install in one call, so you do not have to time three separate commands. The prompt coming back does not mean the work is finished, so check the log afterwards.

rem Run in an elevated CMD window.
rem ScanInstallWait does scan, download and install in one call.
rem Use it when you cannot wait between steps, then check the log as shown below.
usoclient ScanInstallWait

The problem: you ran a switch and nothing appeared on screen. Did it work?

The solution: read the client event log, then the orchestrator scheduled tasks. The first command lists the newest events. The second lists the tasks in the orchestrator folder with their last run time.

# Run in an elevated PowerShell window.
# 1. Newest Windows Update client events
Get-WinEvent -LogName Microsoft-Windows-WindowsUpdateClient/Operational -MaxEvents 20 |
    Format-Table TimeCreated, Id, Message -Wrap

# 2. Orchestrator tasks and when they last ran
Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\' |
    Get-ScheduledTaskInfo | Format-Table TaskName, LastRunTime, LastTaskResult

You should see the newest events at the top. A community write-up also points to C:\Windows\SoftwareDistribution\ReportingEvents.log, a plain text log you can open in Notepad.

The problem: the event log tells you a result but not why it failed.

The solution: Windows Update writes trace files (.etl), not a text log. Get-WindowsUpdateLog merges them into one readable file. Microsoft states the result is a static copy, so run it again to refresh it.

# Run in an elevated PowerShell window.
# Creates the folder, then writes a readable copy of the Windows Update log into it
New-Item -Path 'C:\bat\test' -ItemType Directory -Force | Out-Null
Get-WindowsUpdateLog -LogPath 'C:\bat\test\WindowsUpdate.log'

# Read the last 30 lines
Get-Content 'C:\bat\test\WindowsUpdate.log' -Tail 30

You should see a short progress message while the file is built, then the last 30 log lines. The file is C:\bat\test\WindowsUpdate.log.

The problem: you need a list of missing updates that you can read, not a silent trigger.

The solution: use the documented Windows Update Agent API through COM. It needs a reachable update source, Microsoft Update or your WSUS server.

# Run in PowerShell. Lists updates that are not installed and not hidden. Changes nothing.
$session  = New-Object -ComObject Microsoft.Update.Session
$searcher = $session.CreateUpdateSearcher()
$result   = $searcher.Search('IsInstalled=0 and IsHidden=0')
$result.Updates | Select-Object Title

You should see one title per pending update, or nothing if the machine is up to date.

Undo and cleanup

A scan changes nothing. A download only stages files. An install and a restart do change the machine, and UsoClient has no switch to reverse them. Use these instead.

rem Run in an elevated CMD window.
rem Removes one installed update. 5000000 is a placeholder, use your real KB number.
wusa /uninstall /kb:5000000

rem Remove the log folder created in the examples
rmdir /s /q C:\bat\test
Note: RestartDevice restarts the computer. Use it only inside your maintenance window.

Tips and limitations

  • Do not assume a step has finished when the prompt returns. Read the log between steps, or use ScanInstallWait.
  • Scanning needs a reachable update source. A lab VM with no internet can run StartScan and still find nothing.
  • One community write-up says not every Windows 10 and 11 build supports these switches. Test on one machine first.
  • For results you can parse, prefer the COM script above over UsoClient.
  • The orchestrator logs live in C:\ProgramData\USOShared\Logs as .etl files, which Get-WindowsUpdateLog can merge.

Official documentation

Five cheat sheets, one PDF

Subnet masks, PowerShell, Linux commands, HTTP status codes and the ESXi command line - one page each, free to keep. Leave an address and it arrives in a minute.