How to check Windows Update status on all company PCs

One unpatched laptop is enough. Here is how to find out which PCs are missing updates — on a single machine with PowerShell, across a network, and without opening each PC.

On a single PC

Settings → Windows Update shows pending updates and whether a restart is needed; Update history shows what was installed and when. Fine for one machine, not for twenty.

With PowerShell

Recently installed updates

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, Description, InstalledOn

Get-HotFix lists Windows updates (KBs). It does not list driver or Microsoft Store updates.

Pending updates

$session  = New-Object -ComObject Microsoft.Update.Session
$searcher = $session.CreateUpdateSearcher()
$result   = $searcher.Search("IsInstalled=0 and IsHidden=0 and Type='Software'")
$result.Updates | Select-Object Title, MsrcSeverity

This asks the Windows Update Agent the same question the Settings page asks. The search can take a minute. MsrcSeverity is filled in for security updates (Critical, Important…).

Is a restart pending?

Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'

True means installed updates are waiting for a restart — and are not protecting the PC yet.

Across many PCs

PowerShell Remoting

With WinRM enabled you can wrap the commands above in Invoke-Command -ComputerName PC-01, PC-02 { ... }. Searching for updates usually works this way; installing updates through a remote session is blocked by Windows, so this is a reporting method. It has the usual Remoting limits: the PCs must be reachable on your network or through a VPN.

WSUS, Intune and Windows Update for Business reports

Larger organisations control and report updates centrally with WSUS (on-premises server, domain) or Microsoft Intune and Windows Update for Business reports (cloud, Microsoft Entra ID and the matching licences). They are powerful — and a lot of setup for a 15-PC office.

An agent that reports by itself

An RMM agent can run the pending-updates search on every PC on a schedule and send the result to one panel. Nothing to run by hand, and laptops at home report too.

How CtrlSoft shows it

• The agent checks Windows Update about 5 minutes after it starts, then every 12 hours.
• The Devices list shows the number of pending updates per PC.
• Each device page lists the pending updates, with security updates first, plus restart required and the date of the last successful installation.

What to look for

• Security updates pending for more than a week — the main risk.
• "Restart required" for days — common on laptops that are only ever put to sleep.
• No successful installation in 30+ days — often a broken Windows Update service, a full disk or a paused update policy.
• Search errors — usually the Windows Update service is disabled.