Skip to main content

TEST

powershell.exe -NoProfile -ExecutionPolicy Bypass -File Reset-WindowsUpdateClient.ps1
cmd.exe /c net stop wuauserv /y & net stop bits /y & net stop cryptsvc /y & net stop msiserver /y & ren "%systemroot%\SoftwareDistribution" SoftwareDistribution.bak & ren "%systemroot%\System32\catroot2" catroot2.bak & net start cryptsvc & net start bits & net start msiserver & net start wuauserv

<#
.SYNOPSIS
    Resets the Windows Update client by stopping dependent services,
    renaming SoftwareDistribution and catroot2, then restarting services.

.DESCRIPTION
    Tanium remediation for failed "Reset Windows Update Client" packages
    where wureset.vbs fails during cleanup (typically due to a locked
    file handle held by BITS, cryptsvc, or wuauserv itself).

.NOTES
    Exit 0  = success
    Exit 1  = failure (see console output / $LASTEXITCODE for reason)
#>

$ErrorActionPreference = 'Stop'

$services = 'wuauserv', 'bits', 'cryptsvc', 'msiserver'

# Remove stale backups from a previous run so Rename-Item doesn't fail
foreach ($old in @(
    (Join-Path $env:SystemRoot 'SoftwareDistribution.bak'),
    (Join-Path $env:SystemRoot 'System32\catroot2.bak')
)) {
    if (Test-Path $old) {
        Write-Output "Removing stale backup: $old"
        Remove-Item -Path $old -Recurse -Force -ErrorAction SilentlyContinue
    }
}

try {
    Write-Output "Stopping services: $($services -join ', ')"
    Stop-Service -Name $services -Force -ErrorAction SilentlyContinue

    $swDist  = Join-Path $env:SystemRoot 'SoftwareDistribution'
    $catroot = Join-Path $env:SystemRoot 'System32\catroot2'

    if (Test-Path $swDist) {
        Write-Output "Renaming $swDist"
        Rename-Item -Path $swDist -NewName 'SoftwareDistribution.bak' -Force -ErrorAction Stop
    } else {
        Write-Output "$swDist not found, skipping"
    }

    if (Test-Path $catroot) {
        Write-Output "Renaming $catroot"
        Rename-Item -Path $catroot -NewName 'catroot2.bak' -Force -ErrorAction Stop
    } else {
        Write-Output "$catroot not found, skipping"
    }

    Write-Output "Starting services: $($services -join ', ')"
    Start-Service -Name $services -ErrorAction Stop

    Write-Output "SUCCESS: Windows Update client reset complete"
    exit 0
}
catch {
    Write-Output "FAILED: $($_.Exception.Message)"
    # Best-effort: try to bring services back up even on failure
    Start-Service -Name $services -ErrorAction SilentlyContinue
    exit 1
}

Back to top