# Using Ansible to update Windows servers

**URL:** <https://forum.ansible.com/t/using-ansible-to-update-windows-servers/17849>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [March 26, 2015, 2:27pm UTC](https://forum.ansible.com/t/using-ansible-to-update-windows-servers/17849 "2015-03-26T14:27:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dyioulos](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dyioulos/32/8363_2.png) [@dyioulos](https://forum.ansible.com/u/dyioulos)\
**Post date:** [March 26, 2015, 2:27pm UTC](https://forum.ansible.com/t/using-ansible-to-update-windows-servers/17849/1 "2015-03-26T14:27:10Z")

</div>

All,

I’ve got Ansible working on a few Windows 2008 servers. The Ansible command server runs CentOS 6. I’m trying to get the module “win\_updates” working, but am not having much success. I’d like to be able to run this both via the command line, and via a playbook. The extant documentation isn’t very detailed. Here’s what I’ve done/am trying (sorry, this will probably be long):

- I had to download the windows module of which win\_updates is a part, and manually put it in “/usr/lib/python2.6/site-packages/ansible/modules/extras/”
- I installed “PSWindowsUpdate” on the Windows server
- If I run the command “ansible myhost -m win\_updates”, I get the following output:

myhost | success \>\> {  
“changed”: false,  
“updates\_already\_present”: null,  
“updates\_category”: “critical”,  
“updates\_installed”: ,  
“updates\_installed\_afterwards”: null,  
“updates\_installed\_count”: 0,  
“updates\_reboot\_needed”: true,  
“updates\_success”: “true”  
}

Fine, but the updates aren’t done. So, I figure I need an argument. The win\_updates document gives the following example:

```auto
# Install updates from security category
win_updates:
  category: security

I've tried every combination I can think of, as in:

"ansible myhost -m win_updates -a category=security" and "ansible myhost -m win_updates -a security" and "ansible myhost -m win_updates -a category:security", and I get something like this:

myhost | FAILED >> {
    "failed": true, 
    "msg": "\nProcess is terminated due to StackOverflowException.\n", 
    "parsed": false
}

* I created the following playbook:

---

- name: update windows
  hosts: windows
  gather_facts: true
  tasks:
    - name: win update
      win_updates:
        category: security

It, too, fails, with a much more verbose error message (which I'll skip posting, for now). I've tried other combinations in the playbook and, they too, fail.

I would greatly appreciate help in getting this to work, both from the command line and from a playbook.

Dimitri

```

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [March 26, 2015, 6:46pm UTC](https://forum.ansible.com/t/using-ansible-to-update-windows-servers/17849/2 "2015-03-26T18:46:26Z")

</div>

Hi Dimitri,

A few others have reported StackOverflow and OutOfMemory exceptions on unpatched Server 2008 machines - see [https://github.com/ansible/ansible/pull/8345#issuecomment-52074837](https://github.com/ansible/ansible/pull/8345#issuecomment-52074837) for a hotfix that worked for me.

By the way you can put any custom modules you want to use in your /etc/ansible/library rather than have to insert things into your actual ansible installation.

What ansible version are you using?  
Are you connecting as a local user or a domain user?

Also possibly sounds close to this bug report:

[https://github.com/ansible/ansible-modules-extras/issues/275](https://github.com/ansible/ansible-modules-extras/issues/275)

Hope some of the above helps,

Jon

---

<div class="post-metadata">

**Author:** ![dyioulos](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dyioulos/32/8363_2.png) [@dyioulos](https://forum.ansible.com/u/dyioulos)\
**Post date:** [March 26, 2015, 7:16pm UTC](https://forum.ansible.com/t/using-ansible-to-update-windows-servers/17849/3 "2015-03-26T19:16:01Z")

</div>

Hi, Jon.

I appreciate the response, and certainly will look into your suggestions. I’m using version 1.8.4.

As I’ve continued to hack away, I’ve got this to work, kind of:

ansible somehost -m win\_updates -a category:security

The output looks like this:

somehostb | success \>\> {  
“changed”: true,  
“updates\_already\_present”: [  
“2506014”,  
“2506212”,  
“2511455”,  
“2509553”,  
“2506928”,

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [March 26, 2015, 10:00pm UTC](https://forum.ansible.com/t/using-ansible-to-update-windows-servers/17849/4 "2015-03-26T22:00:27Z")

</div>

What happens if you reboot the box? I haven’t tried this myself but I’ve seen windows delay applying updates until shutdown (and I think following a reboot too in some cases).

Might need a bit of work judging by the comments but there is a win\_reboot module which you could try.  
[https://github.com/ansible/ansible/pull/8946/files](https://github.com/ansible/ansible/pull/8946/files)

Jon

---

<div class="post-metadata">

**Author:** ![dyioulos](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dyioulos/32/8363_2.png) [@dyioulos](https://forum.ansible.com/u/dyioulos)\
**Post date:** [March 30, 2015, 4:06pm UTC](https://forum.ansible.com/t/using-ansible-to-update-windows-servers/17849/5 "2015-03-30T16:06:32Z")

</div>

Jon,

I would think that, at a minimum, WSUS would show that the updates were downloaded and applied, then would request a reboot. That said, there’s no way of knowing from the Windows servers themselves whether or not the updates occurred. Also, as noted in my last post, Ansible seems to say that the command ran fine, but that no updates were applied, as per the following output:

“updates\_installed\_count”: 0,  
“updates\_reboot\_needed”: true,  
“updates\_success”: “true”

Dimitri