ansible.windows.win_updates – Download and install Windows updates¶
Note
This plugin is part of the ansible.windows collection (version 1.4.0).
To install it use: ansible-galaxy collection install ansible.windows.
To use it in a playbook, specify: ansible.windows.win_updates.
Synopsis¶
Searches, downloads, and installs Windows updates synchronously by automating the Windows Update client.
Note
This module has a corresponding action plugin.
Parameters¶
Notes¶
Note
ansible.windows.win_updates must be run by a user with membership in the local Administrators group.
ansible.windows.win_updates will use the default update service configured for the machine (Windows Update, Microsoft Update, WSUS, etc).
ansible.windows.win_updates will become SYSTEM using runas unless
use_scheduled_taskisyesBy default ansible.windows.win_updates does not manage reboots, but will signal when a reboot is required with the reboot_required return value. reboot can be used to reboot the host if required in the one task.
ansible.windows.win_updates can take a significant amount of time to complete (hours, in some cases). Performance depends on many factors, including OS version, number of updates, system load, and update server load.
Beware that just after ansible.windows.win_updates reboots the system, the Windows system may not have settled yet and some base services could be in limbo. This can result in unexpected behavior. Check the examples for ways to mitigate this.
More information about PowerShell and how it handles RegEx strings can be found at https://technet.microsoft.com/en-us/library/2007.11.powershell.aspx.
See Also¶
See also
- chocolatey.chocolatey.win_chocolatey
The official documentation on the chocolatey.chocolatey.win_chocolatey module.
- ansible.windows.win_feature
The official documentation on the ansible.windows.win_feature module.
- community.windows.win_hotfix
The official documentation on the community.windows.win_hotfix module.
- ansible.windows.win_package
The official documentation on the ansible.windows.win_package module.
Examples¶
- name: Install all security, critical, and rollup updates without a scheduled task
ansible.windows.win_updates:
category_names:
- SecurityUpdates
- CriticalUpdates
- UpdateRollups
- name: Install only security updates as a scheduled task for Server 2008
ansible.windows.win_updates:
category_names: SecurityUpdates
use_scheduled_task: yes
- name: Search-only, return list of found updates (if any), log to C:\ansible_wu.txt
ansible.windows.win_updates:
category_names: SecurityUpdates
state: searched
log_path: C:\ansible_wu.txt
- name: Install all security updates with automatic reboots
ansible.windows.win_updates:
category_names:
- SecurityUpdates
reboot: yes
- name: Install only particular updates based on the KB numbers
ansible.windows.win_updates:
category_name:
- SecurityUpdates
whitelist:
- KB4056892
- KB4073117
- name: Exclude updates based on the update title
ansible.windows.win_updates:
category_name:
- SecurityUpdates
- CriticalUpdates
blacklist:
- Windows Malicious Software Removal Tool for Windows
- \d{4}-\d{2} Cumulative Update for Windows Server 2016
# One way to ensure the system is reliable just after a reboot, is to set WinRM to a delayed startup
- name: Ensure WinRM starts when the system has settled and is ready to work reliably
ansible.windows.win_service:
name: WinRM
start_mode: delayed
# Optionally, you can increase the reboot_timeout to survive long updates during reboot
- name: Ensure we wait long enough for the updates to be applied during reboot
ansible.windows.win_updates:
reboot: yes
reboot_timeout: 3600
# Search and download Windows updates
- name: Search and download Windows updates without installing them
ansible.windows.win_updates:
state: downloaded
Return Values¶
Common return values are documented here, the following are the fields unique to this module:
Authors¶
Matt Davis (@nitzmahone)