Start a project

2026-09-08 · 19:00

The night your PC updates itself

The evening before, Microsoft patched 964 vulnerabilities. At 8:49 a.m., the PC boots; two minutes later, a script installs the updates that apply to it and records every action. Drag the screen’s curtain to follow its work.

Follow the updateRead the script on GitHub

By Published updated

  1. Sept. 8

    Microsoft patches 964 vulnerabilities in its monthly bulletin — a record.

  2. Sept. 8

    Two are already being exploited. One affects Windows Update itself.

  3. In 2025

    On average, the vulnerabilities observed were exploited seven days before their fix.

Sources: Tenable (Sept. 8, 2026), CISA KEV catalog (CVE-2026-81963, Sept. 8, 2026), Mandiant M-Trends 2026 (Mar. 23, 2026).

Reconstruction · Wednesday, September 9, 2026, a front-desk PC

drag
What the person at the PC sees What the script does underneath

018:49 a.m.: the PC boots. Two minutes later, the script starts in the background.

The starting point

In a company, Intune distributes the script. At home, I needed another route.

During my master’s in Cybersecurity & Cloud Computing, I managed Intune, Entra ID and Active Directory. I also administered Microsoft Defender for Endpoint across a fleet of 70 workstations and servers, then tracked critical vulnerabilities across the organization’s IT systems.

In a company, Intune holds a package of scripts, assigns it to groups of devices and reports the status of each run. The team maintains one central version; the service distributes it to the devices concerned.

At home, the central console gives way to a local scheduled task. I wanted the same discipline: look for updates, write down what happened and keep control of the restart. That is how this public PowerShell script came to be.

SourcesMicrosoft Intune — scripts and remediationsthe script on GitHub

In a companyIntune

  1. 01Script package
  2. 02Device groups
  3. 03Status of each run

At homeScheduled task

  1. 01Look for updates
  2. 02Write down what happened
  3. 03Keep control of the restart

Why automate

The fix exists. Your PC is still waiting.

On September 8, 2026, two vulnerabilities were already being exploited when Microsoft published its bulletin. Over 2025, the vulnerabilities Mandiant studied were exploited seven days before their fix, on average.

Automation acts as soon as a fix becomes available. It shortens the time between its release, its installation and the restart that completes it.

  1. 01 · Before release

    The vendor analyzes the flaw and prepares the fix. Monitoring and existing protections hold the line.

  2. 02 · At release

    The PC queries Microsoft Update, receives the updates that match its version and writes the result to its log.

  3. 03 · At restart

    Windows reloads the patched components and drivers. The update becomes active.

SourcesTenable — Microsoft’s September 2026 Patch Tuesday bulletinCISA’s KEV catalogMandiant — M-Trends 2026

Six actions, one trail

It checks, installs, records and hands control back.

  1. 1

    Schedule

    A task runs the script at startup and every day as soon as a connection is available.

  2. 2

    Check rights

    Installation starts with the rights needed to modify Windows.

  3. 3

    Open the log

    Every command, success and error gets a timestamp and stays readable after the run.

  4. 4

    Update Windows

    Microsoft Update offers only the updates that match this PC’s version and components.

  5. 5

    Look for drivers

    The same channel checks the drivers published for the recognized hardware: graphics card, Wi-Fi, audio and other components.

  6. 6

    Ask for a restart

    The script hands the PC back to the person at work and lets them choose when to restart.

Its scope

The script covers Windows and the drivers offered by Microsoft Update. Chrome, Acrobat and other software keep their own update channels.

The next version: applications

A winget mode will start by exporting the applications recognized on the PC. The user selects which apps to keep updated; the script keeps their identifiers and then looks for their updates on every run.

WinGet can already list available updates and run winget upgrade --all. The selection adds a simple choice: update all recognized apps, or only a selected list such as 7-Zip, Chrome, WinRAR and the tools of daily work.

A macOS edition is the next step. It will keep the same promise — a chosen list, a scheduled run and a readable log — with an update engine suited to macOS.

SourcesMicrosoft Learn — WinGet commandswinget upgrade

  1. Today

    Windows and its drivers

  2. Next version

    Chosen applications, with winget

  3. After that

    The macOS edition

What “updating” really changes

An old version keeps its old vulnerabilities, too.

  • 7-Zip26.02

    CVE-2026-14266

    Version 26.02 fixed a memory overflow while decompressing an XZ archive. The vendor classifies its impact as remote code execution.

    Read 7-Zip’s security history

  • Google Chrome137.0.7151.68

    CVE-2025-5419

    Version 137.0.7151.68/.69 fixed an out-of-bounds read and write in the V8 engine. Google had already reported that an exploit existed in the wild.

    Read Chrome’s security advisory

  • WinRAR7.13

    CVE-2025-8088

    Version 7.13 fixed a critical directory traversal flaw. An archive crafted to exploit it could write files outside the chosen folder.

    Read WinRAR’s security advisory

An up-to-date version removes the known attack paths of the version it replaces. Security level also depends on configuration and use; the application counter measures only the tracked scope.

The last step

Restarting reloads Windows. Shutting down can keep part of the session.

Windows Fast Startup keeps some system components across a shutdown. A restart reloads the kernel and the drivers, then finishes replacing the files still in use.

This difference explains the script’s final notification. The PC keeps working; the person then picks a time slot to finish the update.

SourcesMicrosoft — updates and Fast Startup, KB 4011287Microsoft — vulnerable driver blocklist

Update installed. The new files are on the disk.

Our own review

We started by updating our own script.

The first version installed the updates. The security review also examined where the file runs, the evidence it leaves and how it reacts to errors. Nine fixes are now visible in the repository.

commit 65421ebauto_update.ps1+9

  1. A protected location

    The task copies the script into a folder that requires administrator rights to write to.

  2. Two triggers

    The script runs at startup and daily, catching up on missed runs when the network connection returns.

  3. A visible notification

    The open session receives the restart request, even when the task runs under the system account.

  4. A persistent log

    Output stays in a dated file under ProgramData.

  5. Explicit errors

    Each step records its failure and returns a usable exit code.

  6. TLS 1.2

    PowerShell 5.1 uses the expected protocol to fetch its dependencies.

  7. Publisher verification

    The module’s publisher signature is checked during installation.

  8. Two separate searches

    Windows, then drivers: each search targets a single type of update, and the summary counts them separately.

  9. A restart you choose

    -IgnoreReboot keeps an invisible prompt from blocking the task and leaves the decision to the person at the PC.

Read the script and its history on GitHub

In your business

At home or across a fleet: the proof you need stays the same.

Every PC should be able to answer four questions:

  1. 01

    When did it last look for updates?

  2. 02

    Which ones did it install?

  3. 03

    Which error needs attention?

  4. 04

    Which restart is still pending?

  • At home

    A scheduled task runs the local script. Its log says what it installed, and the restart stays in your hands.

  • In a managed fleet

    Intune holds the central package, assigns it to groups, tracks results per device and lets the team maintain and improve a single version.

  • A service provider

    The contract specifies how often checks run, which software is covered, how errors are followed up and the proof of restart.

France’s national cybersecurity agency (ANSSI) recommends that small and mid-sized businesses turn on automatic updates for their software and hardware. The tool changes with the size of the fleet; this requirement stays the same.

SourceANSSI — Cybersecurity for small and mid-sized businesses in thirteen questions

Your fleet

Do you know which PCs are still waiting for a restart?

An audit starts with an inventory of Windows versions, update tasks, the latest installed updates and pending restarts. Those four answers separate an automation that runs from a fleet that is truly up to date.

Check your PCsRead the script on GitHub

LAB sources

  1. The PowerShell script on GitHub
  2. Microsoft Intunedeploy and monitor remediation scripts
  3. Microsoft Learninventory and manage applications with WinGet
  4. Microsoft Learnupdate applications with winget upgrade
  5. Tenablethe 964 vulnerabilities patched on September 8, 2026
  6. MandiantM-Trends 2026
  7. Microsoftwhy some updates require “Restart”
  8. Microsoftvulnerable driver blocklist
  9. ANSSICybersecurity for small and mid-sized businesses in thirteen questions