wuauclt.exe command line switches

Does anyone have a list of all wuauclt.exe command line switches (e.g.
/detectnow) ?

Any idea of the undocumented ones? I googled and found some that did not
work; they may have been just a wishlist.

I'm looking for one that can start the (already downloaded) installation
process from a command line, the equivalent of having the user click the
yellow shield icon -> "Express Install".

wuauclt.exe /detectnow is the one documented.
Actually, there are /two/ documented switches.
/detectnow to execute an immediate detection from the client.
/resetauthorization to purge (timeout) the WUA targeting information cookie.

The second switch must be used with the first, and must be executed exactly
in this fashion:
wuauclt /resetauthorization /detectnow

The /resetauthorization switch is only useful if the client has been
reassigned to a new target group and is not properly picking up that target
group assignment (most likely because it's using a cached targeting cookie).
The switch will force the deletion of the cookie.

There are no undocumented switches.

The ones you found existed in a prior 'beta' version of the WUA and were
there strictly for internal development testing purposes.

I learned of them sometime last year. Did a bit of testing and found their
function extremely limited. At best, the only one that actually did anything
merely launched the UI of the WUA, but nothing more.

I'm not aware of any way to do that from the wuauclt.exe executable, Dave.
Your best bet is VBScripting.

[Sachin Nagpal]

wuauclt /r /reportnow

This is very useful command which sends all queued reporting events to the server immediately

[ckilmer75]

I found this on another site:

Reposting for you guys.
***
From a dump of the .exe (W2k3 R2 version ) we can extract the following options:
/DetectNow
/ReportNow
/RunHandlerComServer
/RunStoreAsComServer
/ShowSettingsDialog
/ResetAuthorization
/ResetEulas
/ShowWU
/ShowWindowsUpdate
/SelfUpdateManaged
/SelfUpdateUnmanaged
/UpdateNow
/ShowWUAutoScan
/ShowFeaturedUpdates
/ShowOptions
/ShowFeaturedOptInDialog
/DemoUI

Most of these options don't give any noticable response, but that may be because of the state of the service.
The command 'wuauclt /ResetAuthorization /DetectNow' worked for me right away.

No need to need to be a troll. A simple explanation would have sufficed without being a jerk. I simply reposted some info I found on another site while researching the same topic as I just learned about the command the other day. If you make yourself feel better by making others feel inferior to you, then I hope you find something better to do with your life.

Or because there's no code behind the switches.

There *is* a reason the options are not documented!

Yes, this is one of only *three* functional command options.

The other two are:
wuauclt /detectnow

and

wuauclt /reportnow

Not really. It's ancient information and you're replying to an ancient
thread.

Trust me.. I'm not the troll. But the *information* is five years old and
it's every bit as invalid today as it was when it was first posted by the
person who thought something useful was being posted the first time. If
somebody had pointed out in the source where you got this bad information
that it was bad information, perhaps you would not have been so excited to
post whereever else you might have posted it. Now, in this thread, that's
been done, and hopefully another novice WSUS admin won't use this thread to
proliferate this bad information other places.

I'm not trying to make anybody feel inferior.. I'm merely suggesting (and
perhaps in a poor manner) that you ought to read the thread, notice the
datestamps, and *research* the situation before you offer up the dozenth
repost of the same useless information. The lesson to be learned is to not
blindly repost information you "find on the net", until you've verified it's
accuracy and value.

Perhaps, even, if you had *asked* if it was valid information, rather than
posting as if it were . . . ???

[jMerliN]

Sure, because most people wouldn't find them useful.
You'll find you're wrong on the "there's no code behind the switches."

.text:004043C9 loc_4043C9:                             ; CODE XREF: wWinMain(x,x,x,x)+212j
.text:004043C9                 mov     eax, [ebp+var_C]
.text:004043CC                 mov     esi, [ebp+eax*4+lpString1]
.text:004043D0                 push    offset String2  ; "/ShowWU"
.text:004043D5                 push    esi             ; lpString1
.text:004043D6                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:004043DB                 test    eax, eax
.text:004043DD                 jz      loc_4045DB
.text:004043E3                 push    offset aShowwindowsupd ; "/ShowWindowsUpdate"
.text:004043E8                 push    esi             ; lpString1
.text:004043E9                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:004043EE                 test    eax, eax
.text:004043F0                 jz      loc_4045DB
.text:004043F6                 push    offset aClosewindowsup ; "/CloseWindowsUpdate"
.text:004043FB                 push    esi             ; lpString1
.text:004043FC                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404401                 test    eax, eax
.text:00404403                 jz      loc_40456E
.text:00404409                 push    offset aSelfupdateunma ; "/SelfUpdateUnmanaged"
.text:0040440E                 push    esi             ; lpString1
.text:0040440F                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404414                 test    eax, eax
.text:00404416                 jz      loc_404578
.text:0040441C                 push    offset aSelfupdatemana ; "/SelfUpdateManaged"
.text:00404421                 push    esi             ; lpString1
.text:00404422                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404427                 test    eax, eax
.text:00404429                 jz      loc_404592
.text:0040442F                 push    offset aDetectnow ; "/DetectNow"
.text:00404434                 push    esi             ; lpString1
.text:00404435                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:0040443A                 test    eax, eax
.text:0040443C                 jz      loc_404599
.text:00404442                 push    offset aReportnow ; "/ReportNow"
.text:00404447                 push    esi             ; lpString1
.text:00404448                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:0040444D                 test    eax, eax
.text:0040444F                 jz      loc_4045A0
.text:00404455                 push    offset aUpdatenow ; "/UpdateNow"
.text:0040445A                 push    esi             ; lpString1
.text:0040445B                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404460                 test    eax, eax
.text:00404462                 jz      loc_4045A7
.text:00404468                 push    offset aRunhandlercoms ; "/RunHandlerComServer"
.text:0040446D                 push    esi             ; lpString1
.text:0040446E                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404473                 test    eax, eax
.text:00404475                 jz      loc_4045AE
.text:0040447B                 push    offset aRunstoreascoms ; "/RunStoreAsComServer"
.text:00404480                 push    esi             ; lpString1
.text:00404481                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404486                 test    eax, eax
.text:00404488                 jz      loc_4045B5
.text:0040448E                 push    offset aResetauthoriza ; "/ResetAuthorization"
.text:00404493                 push    esi             ; lpString1
.text:00404494                 call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404499                 test    eax, eax
.text:0040449B                 jnz     short loc_4044BC
.text:0040449D                 cmp     ebx, 2
.text:004044A0                 jnb     loc_4045CB
.text:004044A6                 cmp     [ebp+var_18], eax

You see at each stop it's comparing a parameter against each of these and doing a jump if it matches.
Those jumps go to a dispatch table down further in the code:

.text:00404599 ; ---------------------------------------------------------------------------
.text:00404599
.text:00404599 loc_404599:                             ; CODE XREF: wWinMain(x,x,x,x)+FDj
.text:00404599                 call    ?DetectNow@@YGJXZ ; DetectNow(void)
.text:0040459E                 jmp     short loc_404557
.text:004045A0 ; ---------------------------------------------------------------------------
.text:004045A0
.text:004045A0 loc_4045A0:                             ; CODE XREF: wWinMain(x,x,x,x)+110j
.text:004045A0                 call    ?ReportNow@@YGJXZ ; ReportNow(void)
.text:004045A5                 jmp     short loc_404557
.text:004045A7 ; ---------------------------------------------------------------------------
.text:004045A7
.text:004045A7 loc_4045A7:                             ; CODE XREF: wWinMain(x,x,x,x)+123j
.text:004045A7                 call    ?UpdateNow@@YGJXZ ; UpdateNow(void)
.text:004045AC                 jmp     short loc_404557
.text:004045AE ; ---------------------------------------------------------------------------
.text:004045AE
.text:004045AE loc_4045AE:                             ; CODE XREF: wWinMain(x,x,x,x)+136j
.text:004045AE                 call    ?RunUpdateHandler@@YGJXZ ; RunUpdateHandler(void)
.text:004045B3                 jmp     short loc_404626
.text:004045B5 ; ---------------------------------------------------------------------------
.text:004045B5
.text:004045B5 loc_4045B5:                             ; CODE XREF: wWinMain(x,x,x,x)+149j
.text:004045B5                 mov     eax, [ebp+var_C]
.text:004045B8                 lea     ecx, [eax+1]
.text:004045BB                 cmp     ecx, [ebp+var_20]
.text:004045BE                 jnb     short loc_4045CB
.text:004045C0                 push    [ebp+eax*4+hLibModule] ; hLibModule
.text:004045C4                 call    ?RunDatastoreAsComServer@@YGJPBG@Z ; RunDatastoreAsComServer(ushort const *)
.text:004045C9                 jmp     short loc_404626

Etc. To see what they do, you can follow their code. Let's start with one we "know" works (DetectNow):

.text:00403EC0 ; long __stdcall DetectNow(void)
.text:00403EC0 ?DetectNow@@YGJXZ proc near             ; CODE XREF: wWinMain(x,x,x,x):loc_404599p
.text:00403EC0
.text:00403EC0 ppv             = dword ptr -4
.text:00403EC0
.text:00403EC0                 mov     edi, edi
.text:00403EC2                 push    ebp
.text:00403EC3                 mov     ebp, esp
.text:00403EC5                 push    ecx
.text:00403EC6                 push    esi
.text:00403EC7                 push    edi
.text:00403EC8                 xor     esi, esi
.text:00403ECA                 push    esi             ; dwCoInit
.text:00403ECB                 push    esi             ; pvReserved
.text:00403ECC                 call    ds:__imp__CoInitializeEx@8 ; CoInitializeEx(x,x)
.text:00403ED2                 push    3
.text:00403ED4                 mov     edi, eax
.text:00403ED6                 call    ?RegisterProxyStubCLSIDs@@YGXK@Z ; RegisterProxyStubCLSIDs(ulong)
.text:00403EDB                 cmp     edi, esi
.text:00403EDD                 jl      short loc_403F13
.text:00403EDF                 lea     eax, [ebp+ppv]
.text:00403EE2                 push    eax             ; ppv
.text:00403EE3                 push    offset __GUID_7ae22377_b19d_497d_808e_307860c5660a ; riid
.text:00403EE8                 mov     [ebp+ppv], esi
.text:00403EEB                 call    ?CoCreateAU@@YGJABU_GUID@@PAPAX@Z ; CoCreateAU(_GUID const &,void * *)
.text:00403EF0                 mov     edi, eax
.text:00403EF2                 cmp     edi, esi
.text:00403EF4                 jl      short loc_403F0D
.text:00403EF6                 mov     eax, [ebp+ppv]
.text:00403EF9                 mov     ecx, [eax]
.text:00403EFB                 push    esi
.text:00403EFC                 push    esi
.text:00403EFD                 push    esi
.text:00403EFE                 push    eax
.text:00403EFF                 call    dword ptr [ecx+5Ch]
.text:00403F02                 mov     edi, eax
.text:00403F04                 mov     eax, [ebp+ppv]
.text:00403F07                 mov     ecx, [eax]
.text:00403F09                 push    eax
.text:00403F0A                 call    dword ptr [ecx+8]
.text:00403F0D
.text:00403F0D loc_403F0D:                             ; CODE XREF: DetectNow(void)+34j
.text:00403F0D                 call    ds:__imp__CoUninitialize@0 ; CoUninitialize()
.text:00403F13
.text:00403F13 loc_403F13:                             ; CODE XREF: DetectNow(void)+1Dj
.text:00403F13                 mov     eax, edi
.text:00403F15                 pop     edi
.text:00403F16                 pop     esi
.text:00403F17                 leave
.text:00403F18                 retn
.text:00403F18 ?DetectNow@@YGJXZ endp

So it calls CoInitializeEx(NULL,NULL), which initializes the COM lib in multithreaded mode, then registers some files with the system. The CoCreateAU is a function almost every switch that "does something" calls, it creates a COM AutomaticUpdates object and returns the result of the CoCreateInstance call. This COM object has GUID string: "__GUID_7ae22377_b19d_497d_808e_307860c5660a". You could always create an instance of this object yourself and play around with what it can do, I may reverse the DLLs responsible for implementing its functionality at some point and see if I can document these switches. The 'ReportNow' uses a different GUID, so it seems there's a windows update and a windows update reporting COM differentiation.

You can see after it gets that HRESULT back, it compares it against 0 (esi is used as zero here, as by the ABI it must be preserved across interfacing function calls), if it's 0 it uninits the COM library and returns false. Otherwise it calls some thiscall function in the class instance returned as a pointer from the CoCreateAU call.

The switches do work similarly through COM. The base API in the wuaueng.dll though is particularly interesting.

[qballco]

jmerlin, I'd be interested to find out what tool(s) you used to interrogate the wuauclt command and switches.

[jMerliN]

IDA Pro, Ollydbg, and a lot of experience.

[mimp]

Originally Posted by jMerliN

"I may reverse the DLLs responsible for implementing its functionality at some point and see if I can document these switches."

Yes, please. I lack the required skills to do so myself but would be very interested to read your findings.