Knowledge Base
How to Uninstall Windows Updates from the Command Prompt
To uninstall a Windows update from the command prompt, use wusa /uninstall /kb:5012345, replacing the number with the KB number of the update you want to remove. Run the command prompt as administrator. This is the quickest way to roll back a single problem update, and it works well in scripts and remote sessions where the graphical update history is awkward to reach.
Key facts
- The command to remove a Windows update is
wusa /uninstall /kb:NUMBER, run as administrator. - Add
/quiet /norestartto remove an update silently without an immediate reboot. - List installed updates with
wmic qfe list brief /format:tableto find the KB number first. - Some cumulative and feature updates cannot be removed with wusa and need DISM instead.
- Removing a security update reopens the vulnerability it patched, so only do it to fix a specific fault.
How do you find the KB number to remove?
Before you can uninstall an update you need its KB number, and the command line gives you that quickly. Run wmic qfe list brief /format:table to list installed updates with their KB identifiers and install dates, which makes it easy to spot the one that landed just before a problem started. On newer systems where wmic is being retired, the PowerShell equivalent is Get-HotFix, which returns the same information. Note the KB number, then move on to the removal command.
How do you uninstall the update?
With the KB number in hand, the removal is one command in an administrator command prompt. Run wusa /uninstall /kb:5012345 and confirm the prompt. To do it without interaction, for example in a script or across several machines, add the silent flags: wusa /uninstall /kb:5012345 /quiet /norestart. The /norestart flag lets you control when the reboot happens rather than having the machine restart immediately, which matters during business hours.
What if wusa will not remove the update?
Some updates, particularly cumulative updates, report that they cannot be uninstalled through wusa, in which case DISM is the tool to use. List the installed packages with dism /online /get-packages /format:table, find the package name that matches the update, then remove it with dism /online /remove-package /packagename:PACKAGENAME. DISM works at the package level rather than the KB level, so it can remove components wusa refuses to touch. (It is also less forgiving, so copy the package name exactly.)
Frequently asked questions
Is it safe to uninstall a Windows update?
It is safe in the mechanical sense, but it has a cost. Removing a security update reopens whatever vulnerability that update fixed, so the machine becomes less secure until the update is reapplied. Only remove an update to resolve a specific fault it caused, and plan to reinstall a fixed version once one is available.
Will the update just reinstall itself?
Often yes. Windows Update will usually offer the same update again, so it can return on the next check unless you pause updates or block that specific KB. If you removed an update because it broke something, pause updates while you wait for Microsoft to release a corrected version.
How do I uninstall an update if Windows will not boot?
Boot into the Windows Recovery Environment and use the command prompt there with DISM against the offline Windows image, or use the built-in “Uninstall Updates” recovery option. This lets you remove a bad update that is stopping the machine from starting, without needing to log in normally.
Managing Windows updates so a bad patch never reaches every machine at once is part of what proper patch management gives a business. If updates keep catching you out, happy to look at a more controlled approach for your Sydney team.
