WSUS Maintenance Utility

Clean up your WSUS

o       o  o-o  o   o  o-o      o   o             o
|       | |     |   | |         |\ /|     o       |
o   o   o  o-o  |   |  o-o      | O |  oo   o-o  -o- o-o o-o   oo o-o   o-o o-o
 \ / \ /      | |   |     |     |   | | | | |  |  |  |-' |  | | | |  | |    |-'
  o   o   o--o   o-o  o--o      o   o o-o-| o  o  o  o-o o  o o-o-o  o  o-o o-o

o   o  o    o    o
|   |  |  o | o  |
|   | -o-   |   -o- o  o
|   |  |  | | |  |  |  |                 Version 20.03.03 ��
 o-o   o  | o |  o  o--O
                       |            Mike Galvin

For full instructions and documentation, visit my site.

Please consider supporting my work:

WSUS Maintenance Utility can also be downloaded from:

Tweet me if you have questions: @mikegalvin_

TechNet no longer reliably notifies me of any feedback so please send feeback to my site or my twitter, thank you.


Features and Requirements

This utility has been tested on Windows 10, Windows Server 2019 and Windows Server 2016.

Generating A Password File

The password used for SMTP server authentication must be in an encrypted text file. To generate the password file, run the following command in PowerShell on the computer and logged in with the user that will be running the utility. When you run the command, you will be prompted for a username and password. Enter the username and password you want to use to authenticate to your SMTP server.

Please note: This is only required if you need to authenticate to the SMTP server when send the log via e-mail.

$creds = Get-Credential
$creds.Password | ConvertFrom-SecureString | Set-Content c:\scripts\ps-script-pwd.txt

After running the commands, you will have a text file containing the encrypted password. When configuring the -Pwd switch enter the path and file name of this file.


Here’s a list of all the command line switches and example configurations.

Command Line Switch Description Example
-Server The WSUS server to run the maintenance routine on. wsus01
-Port The port WSUS is running on the server. If you do not configure this, the default port of 8530 will be used. If the WsusSSL switch is used the default port will be 8531. 6969
-WsusSsl Use this option if your WSUS server uses SSL. N/A
-L The path to output the log file to. The file name will be WSUS-Maint_YYYY-MM-dd_HH-mm-ss.log. Do not add a trailing \ backslash. C:\scripts\logs
-NoBanner Use this option to hide the ASCII art title in the console. N/A
-Subject The subject line for the e-mail log. Encapsulate with single or double quotes. If no subject is specified, the default of "WSUS Maintenance Utility Log" will be used. 'Server: Notification'
-SendTo The e-mail address the log should be sent to.
-From The e-mail address the log should be sent from.
-Smtp The DNS name or IP address of the SMTP server. OR
-User The user account to authenticate to the SMTP server.
-Pwd The txt file containing the encrypted password for SMTP authentication. C:\scripts\ps-script-pwd.txt
-UseSsl Configures the utility to connect to the SMTP server using SSL. N/A


WSUS-Maintenance.ps1 -Server wsus01 -L C:\scripts\logs -Subject 'Server: WSUS Maintenance' -SendTo -From -Smtp -User -Pwd C:\foo\pwd.txt -UseSsl

The above command will run the maintenance on the server wsus01 using the default port. The log file will be output to C:\scripts\logs and sent via e-mail with a custom subject line.