How to Install, Uninstall or Block a Specific Windows Update (KB)

A Windows update breaks your printer, a VPN client or a line-of-business app, and you need it gone. Or the opposite: you need one specific fix right now, before Windows Update offers it. This is the guide I use in the field to install, uninstall and block individual Windows updates by KB number on Windows 11, Windows 10 and Windows Server.

Step 1: find out which updates are installed

The quick way is Settings › Windows Update › Update history. For an exact list with dates, use PowerShell:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15 HotFixID, Description, InstalledOn

To see the full build number, which tells you exactly which cumulative update you are on:

winver

Step 2: install a specific KB manually

1. Search for the KB number (for example KB5059093) in the Microsoft Update Catalog at catalog.update.microsoft.com.
2. Download the package that matches your Windows version and architecture (x64 or ARM64).
3. Install it from an elevated prompt:

wusa C:\Updates\windows11.0-kb5059093-x64.msu /quiet /norestart

Or with PowerShell, which handles newer packages well:

Add-WindowsPackage -Online -PackagePath "C:\Updates\windows11.0-kb5059093-x64.msu" -NoRestart

Recent Windows 11 cumulative updates are sometimes released as a set of several .msu files. Put them all in the same folder and point the command at the folder, so Windows installs them in the right order.

Step 3: uninstall a problem update

The easy way (Settings)

Settings › Windows Update › Update history › Uninstall updates, then pick the KB and click Uninstall.

Command line, for standalone updates

wusa /uninstall /kb:5059093 /quiet /norestart

Command line, for cumulative updates bundled with the servicing stack

Monthly cumulative updates are now shipped together with a servicing stack update, and wusa /uninstall cannot remove that combined package. Use DISM instead: first find the package name, then remove it.

DISM /Online /Get-Packages /Format:Table | findstr RollupFix

DISM /Online /Remove-Package /PackageName:Package_for_RollupFix~31bf3856ad364e35~amd64~~26100.4061.1.10

Replace the package name with the one from your own list. The servicing stack part cannot be removed, which is by design.

When Windows will not boot

Boot into the recovery environment (hold Shift while clicking Restart, or let Windows fail to start twice), then go to Troubleshoot › Advanced options › Uninstall Updates and choose “Uninstall latest quality update”.

Step 4: stop it from coming back

• Pause updates: Settings › Windows Update › Pause updates, for one to five weeks. Simple, and enough to wait for Microsoft’s fix.
• Hide one specific update with the community PSWindowsUpdate module:

Install-Module PSWindowsUpdate -Scope CurrentUser
Hide-WindowsUpdate -KBArticleID KB5059093 -Confirm:$false
# later, to allow it again:
Show-WindowsUpdate -KBArticleID KB5059093 -Confirm:$false

• In a business: use deferral rings in Intune or Windows Update for Business, or decline the update in WSUS, instead of touching each PC.
• Check for Known Issue Rollback: Microsoft often switches off a buggy change remotely within days. Check the “Known issues” section of the KB’s support page before uninstalling anything.

Uninstalling a cumulative update also removes that month’s security fixes. Treat it as a temporary workaround, and re-install the next month’s update once the issue is fixed.

RooSho

Full practical flow

# 1. what is installed?
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15
# 2. remove the bad cumulative update (find the exact name first)
DISM /Online /Get-Packages /Format:Table | findstr RollupFix
DISM /Online /Remove-Package /PackageName:<Package_for_RollupFix~...>
# 3. keep it away until Microsoft ships a fix
Hide-WindowsUpdate -KBArticleID KB5059093 -Confirm:$false