Grille Windows Update

Overview

This skill covers Grille's windows_update module — query Windows updates via the Windows Update Agent (WUA) COM API. Read-only. No elevation required.

Three modes:

• Search mode (history=false, default): calls IUpdateSearcher::Search() — returns pending, installed, or all updates. No dates.
• History mode (history=true): calls IUpdateSearcher::QueryHistory() — returns install/uninstall history with dates and result codes.
• Search filter (search): client-side substring filter on title or KB number, works in both modes.
• Exclude filter (exclude): client-side substring filter that drops matching titles, applied after search. Works in both modes.

Tools

• wu_status — Query Windows updates. Pending, installed, all, or history with dates.

Parameters

Patterns

Check pending updates (default):

grille:wu_status

List installed updates:

grille:wu_status
  status="installed"

Full update history with install dates:

grille:wu_status
  history=true

Check whether a specific KB is installed:

grille:wu_status
  status="installed"
  search="KB5048685"

Search history for a specific KB:

grille:wu_status
  history=true
  search="KB5048685"

Search pending updates for Defender:

grille:wu_status
  search="Defender"

Exclude noisy entries from history (recommended default):

grille:wu_status
  history=true
  exclude="WinAppRuntime"

When reviewing update history, always pass exclude="WinAppRuntime" unless the user specifically asks about WinAppRuntime updates — they otherwise flood the history with dozens of near-identical runtime entries.

Large WSUS environment:

grille:wu_status
  status="installed"
  max_results=200

Output format

Search mode:

3 pending update(s)
Severity summary:  1 Critical  1 Important  1 Other

  1. 2024-12 Cumulative Update for Windows 11 [KB5048685]
     Severity: Critical  Size: 312.4 MB
     Categories: Security Updates, Windows

  2. Security Intelligence Update for Microsoft Defender Antivirus [KB2267602]
     Severity: Unspecified  Size: unknown
     Categories: Definition Updates, Microsoft Defender Antivirus

History mode:

50 history entries (total on machine: 312)

  1. 2024-12 Cumulative Update for Windows 11 [KB5048685]  [2024-12-10]
     Installed  —  Succeeded
     Categories: Security Updates, Windows

  2. Security Intelligence Update for Microsoft Defender Antivirus [KB2267602]  [2024-12-09]
     Installed  —  Succeeded

Configuration

[roles.developer]
modules = ["windows_update", ...]

No additional configuration keys — enable the module and it is ready.

Notes

• First call may be slow (10–30s) if the WUA cache is stale.
• Size may show as unknown for driver and definition updates — expected, not an error.
• WSUS-managed machines return the policy-approved update set, not the full catalog.
• History mode filters failures — ResultCode 4 (Failed) and 5 (Aborted) are excluded by default. Pass max_results=200 to get a broader view.
• KB numbers in history — extracted from the title if not exposed directly by the WUA interface.
• Combine with grille_diagnose for the full picture: grille_diagnose gives OS version/build, wu_status gives what's been applied on top.

Error patterns