win_updates – Download and install Windows updates¶
Synopsis¶
Searches, downloads, and installs Windows updates synchronously by automating the Windows Update client.
Parameters¶
Notes¶
Note
win_updatesmust be run by a user with membership in the local Administrators group.win_updateswill use the default update service configured for the machine (Windows Update, Microsoft Update, WSUS, etc).win_updateswill become SYSTEM using runas unlessuse_scheduled_taskisyesBy default
win_updatesdoes not manage reboots, but will signal when a reboot is required with the reboot_required return value, as of Ansible v2.5rebootcan be used to reboot the host if required in the one task.win_updatescan take a significant amount of time to complete (hours, in some cases). Performance depends on many factors, including OS version, number of updates, system load, and update server load.Beware that just after
win_updatesreboots the system, the Windows system may not have settled yet and some base services could be in limbo. This can result in unexpected behavior. Check the examples for ways to mitigate this.More information about PowerShell and how it handles RegEx strings can be found at https://technet.microsoft.com/en-us/library/2007.11.powershell.aspx.
See Also¶
See also
- win_chocolatey – Manage packages using chocolatey
The official documentation on the win_chocolatey module.
- win_feature – Installs and uninstalls Windows Features on Windows Server
The official documentation on the win_feature module.
- win_hotfix – Install and uninstalls Windows hotfixes
The official documentation on the win_hotfix module.
- win_package – Installs/uninstalls an installable package
The official documentation on the win_package module.
Examples¶
- name: Install all security, critical, and rollup updates without a scheduled task
win_updates:
category_names:
- SecurityUpdates
- CriticalUpdates
- UpdateRollups
- name: Install only security updates as a scheduled task for Server 2008
win_updates:
category_names: SecurityUpdates
use_scheduled_task: yes
- name: Search-only, return list of found updates (if any), log to C:\ansible_wu.txt
win_updates:
category_names: SecurityUpdates
state: searched
log_path: C:\ansible_wu.txt
- name: Install all security updates with automatic reboots
win_updates:
category_names:
- SecurityUpdates
reboot: yes
- name: Install only particular updates based on the KB numbers
win_updates:
category_name:
- SecurityUpdates
whitelist:
- KB4056892
- KB4073117
- name: Exclude updates based on the update title
win_updates:
category_name:
- SecurityUpdates
- CriticalUpdates
blacklist:
- Windows Malicious Software Removal Tool for Windows
- \d{4}-\d{2} Cumulative Update for Windows Server 2016
# One way to ensure the system is reliable just after a reboot, is to set WinRM to a delayed startup
- name: Ensure WinRM starts when the system has settled and is ready to work reliably
win_service:
name: WinRM
start_mode: delayed
# Optionally, you can increase the reboot_timeout to survive long updates during reboot
- name: Ensure we wait long enough for the updates to be applied during reboot
win_updates:
reboot: yes
reboot_timeout: 3600
# Search and download Windows updates
- name: Search and download Windows updates without installing them
win_updates:
state: downloaded
Return Values¶
Common return values are documented here, the following are the fields unique to this module:
Status¶
This module is not guaranteed to have a backwards compatible interface. [preview]
This module is maintained by the Ansible Core Team. [core]
Red Hat Support¶
More information about Red Hat’s support of this module is available from this Red Hat Knowledge Base article.
Authors¶
Matt Davis (@nitzmahone)
Hint
If you notice any issues in this documentation, you can edit this document to improve it.