WIN-031 · Script

Windows Update Component Reset

Checks the Windows Update services and caches and, in Fix mode, resets them by renaming the SoftwareDistribution and catroot2 folders.

What it does

Report mode (default) logs the state and start mode of the Windows Update (wuauserv), Background Intelligent Transfer (BITS), Cryptographic (CryptSvc) and Windows Installer (msiserver) services, the size of the SoftwareDistribution and catroot2 folders, and whether a restart is pending. It flags disabled or stuck services and logs exactly what Fix would do. Nothing is changed.

Fix mode: 1. stops wuauserv, BITS, CryptSvc and msiserver (waits up to 60 seconds each) 2. renames C:\Windows\SoftwareDistribution and C:\Windows\System32\catroot2 to <name>.rbk-<date-time> (Windows rebuilds both on the next scan) 3. starts CryptSvc, BITS and wuauserv again If a service will not stop, its folder is left alone and the services are started again. Old renamed copies from earlier runs can be deleted with -RemoveOldBackups. Update history in Settings is cleared by the reset; installed updates are not affected.

By default Fix will not run while Windows Modules Installer (TrustedInstaller) is busy installing, to avoid breaking an install in progress; use -Force to override. Runs silently as SYSTEM from any RMM or Intune. No prompts, no user interaction.

Requirements

Windows PowerShell 5.1+, run as SYSTEM or local admin

How to run it

• Run as: SYSTEM or a local administrator
• Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
• Script type: PowerShell, 64-bit
• User interaction: none; the script never prompts
• Timeout: 10 minutes (30 for Windows Update installs)

Settings

Exit codes

• 0 = Services healthy (Report), or reset done and services running
• 1 = Problem found (Report), or a step failed during Fix
• 2 = Script error

Testing steps

1. Run it first with the mode set to Report on one test device. Nothing is changed in that mode.
2. Read the log and confirm the planned changes are what you expect.
3. Run your chosen settings on the same test target and confirm the result.
4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
5. Roll out to a small group next, then everyone.

Rollback steps

Stop wuauserv, BITS and CryptSvc, delete the newly created SoftwareDistribution and catroot2 folders, rename the SoftwareDistribution.rbk-<date-time> and catroot2.rbk-<date-time> folders back to their original names, then start the services. Unless -RemoveOldBackups was used on a later run, the renamed folders remain in C:\Windows and C:\Windows\System32.

Version and change log