Remove Windows 11 Update Patch using Different Methods

In this post, we will look at different methods using which you can remove Windows 11 update. You can use PowerShell, Command Prompt, and even manually uninstall Windows 11 updates from your computer.

Windows 11 operating system is now receiving the new updates from Microsoft. In the coming months, we shall see more updates released for Windows 11. This includes security updates, cumulative updates and servicing stack updates.

It is important to keep your Windows 11 installed with the latest patches as they fix the loopholes and improve overall performance of your Windows 11 PC. If you haven’t upgraded to Windows 11 yet, you can upgrade to Windows 11 using multiple methods.

As an end user, you can manually check for updates on your Windows 11 computer and install the latest updates. If you use a tool like SCCM or ConfigMgr to manage Windows 11 updates, you can deploy the Windows 11 updates using ADR (Automatic Deployment Rule).

According to Microsoft, Windows 11 will have an annual feature update cadence. Windows 11 feature updates will release in the second half of the calendar year. The feature updates will come with 24 months of support for Home, Pro, Pro for Workstations, and Pro Education editions. And 36 months of support for Enterprise and Education editions.

Why Remove Windows 11 Updates?

When you install a new Windows 11 update, then why do you have to remove it? The answer is some Windows updates when installed causes issues on computers. The issues are also listed under Windows Update known issues.

Some updates released by Microsoft are aimed to patch a specific issue however some of them unknowingly triggers another issue. We have seen this happening several times and that’s why most IT admins prefer to wait and deploy the new patches.

When you update your Windows 11 computer, and you start noticing issues, your first task is to identify the update that is causing issues. You can easily do that by checking the updates installed on a specific date.

You have to identify the culprit update(s) and remove it or wait for Microsoft to release a separate patch for the issue. If you notice Windows 11 update causing issues on the computer, you can remove it using multiple ways. Let’s learn how to remove Windows 11 update or the latest patch installed on Windows 11 PC.

On Windows 11 PC, you can roll-back any installed update using Windows Updates Standalone installer (WUSA.exe) command via SCCM. Of course, you can use WUSA to uninstall updates from Windows 11 command prompt or even PowerShell.

Manually Remove Windows 11 Update

The easiest and most recommended method to remove Windows 11 update is via Control Panel > Programs and Features. In the below example, we will uninstall a newly installed Windows 11 update – Update for Microsoft Windows (KB5005537).

On your Windows 11 PC, click Start and launch the Control Panel. Open Programs and Features and select View Installed Updates. This should now list all the updates installed on your Windows 11 computer.

If you have identified the problematic Windows Update (using KB number), select that Windows update from the list that you want to remove and click Uninstall.

You are now presented with the Are you sure you want to uninstall this update? Window when uninstalling an update. Select Yes to proceed with uninstalling the update from your Windows 11 PC.

This begins the update removal process, and you must wait until the update is completely removed from Windows 11.

Whenever you manually uninstall an update from Windows 11, a computer restart is required. Not all updates require a reboot after uninstallation however most of them do. To complete the update uninstallation on Windows 11 PC, restart the computer, select Restart Now.

After the restart, log in to your Windows 11 PC and check the installed updates. The update that you uninstalled shouldn’t appear in the list of installed updates anymore. This completes the steps to manually remove or uninstall updates from Windows 11 computer.

Event ID’s for Windows Update Uninstall

When you uninstall or remove Windows update from Windows 11 computer, you can confirm if the update was successfully removed using the Event ID’s. For every action that you perform on Windows 11, an event is logged with Event ID and description.

You should find the event ID’s for Windows Updates in the following path – Event Viewer > Windows Logs > Setup.

When you install an update on Windows 11, the update along with KB number is marked as installed. Windows marks the state of the update as present state, meaning, the update is installed and currently present on the computer.

In the above example, we removed the Update for Microsoft Windows (KB5005537) from Windows 11 computer. After you uninstall Windows 11 updates, the update name along with KB number is marked as absent state. Windows considers an update as Absent state when the update is uninstalled or not present on the computer.

The uninstall information about that update is logged with event ID’s. Whenever you uninstall Windows 11 updates, you should see these event ID’s in event viewer. Here are the list of event ID’s logged when you uninstall an update from Windows 11.

1. Event ID 1 – The update uninstallation is initiated.
2. Event ID 4 – The Windows update requires a reboot in order to mark the update as absent state.
3. Event ID 2 – Confirms the update uninstall and changes the update state to absent state.

Windows Update Servicing – Event ID 1

When you uninstall an update from Windows 11, first the event ID 1 is logged with event source as servicing. The event ID 1 contains the status information about the Windows Update and notifies that an update has been triggered for uninstallation.

Initiating changes for package KB5005537. Current state is Installed. Target state is Absent. Client id: Software Explorer.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Servicing" Guid="{bd12f3b8-fc40-4a61-a307-b7a013a069c1}" />
    <EventID>1</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-10-21T09:12:53.8699405Z" />
    <EventRecordID>35</EventRecordID>
    <Correlation />
    <Execution ProcessID="2556" ThreadID="6932" />
    <Channel>Setup</Channel>
    <Computer>CORPWIN11.prajwal.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <CbsPackageInitiateChanges xmlns="http://manifests.microsoft.com/win/2004/08/windows/setup_provider">
      <PackageIdentifier>KB5005537</PackageIdentifier>
      <InitialPackageState>5112</InitialPackageState>
      <InitialPackageStateTextized>Installed</InitialPackageStateTextized>
      <IntendedPackageState>5000</IntendedPackageState>
      <IntendedPackageStateTextized>Absent</IntendedPackageStateTextized>
      <Client>Software Explorer</Client>
    </CbsPackageInitiateChanges>
  </UserData>
</Event>

Windows Update Servicing – Event ID 4

After the event ID 1, the event ID 4 is logged with event source as Windows Update servicing. Event ID 4 means a reboot is necessary before package can be changed to the Absent state.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Servicing" Guid="{bd12f3b8-fc40-4a61-a307-b7a013a069c1}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-10-21T09:12:57.3904784Z" />
    <EventRecordID>36</EventRecordID>
    <Correlation />
    <Execution ProcessID="2556" ThreadID="6932" />
    <Channel>Setup</Channel>
    <Computer>CORPWIN11.prajwal.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <CbsPackageChangeState xmlns="http://manifests.microsoft.com/win/2004/08/windows/setup_provider">
      <PackageIdentifier>KB5005537</PackageIdentifier>
      <IntendedPackageState>5000</IntendedPackageState>
      <IntendedPackageStateTextized>Absent</IntendedPackageStateTextized>
      <ErrorCode>0x0</ErrorCode>
      <Client>Software Explorer</Client>
    </CbsPackageChangeState>
  </UserData>
</Event>

Windows Update Servicing – Event ID 2

After the event ID 4, the event ID 2 is logged with event source as Windows Update servicing. Event ID 2 confirms the windows update is uninstalled and Package was successfully changed to the Absent state.

If the package is marked as absent state, it means the update has been uninstalled from the computer.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Servicing" Guid="{bd12f3b8-fc40-4a61-a307-b7a013a069c1}" />
    <EventID>2</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-10-21T09:16:33.6058898Z" />
    <EventRecordID>37</EventRecordID>
    <Correlation />
    <Execution ProcessID="2496" ThreadID="2532" />
    <Channel>Setup</Channel>
    <Computer>CORPWIN11.prajwal.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <CbsPackageChangeState xmlns="http://manifests.microsoft.com/win/2004/08/windows/setup_provider">
      <PackageIdentifier>KB5005537</PackageIdentifier>
      <IntendedPackageState>5000</IntendedPackageState>
      <IntendedPackageStateTextized>Absent</IntendedPackageStateTextized>
      <ErrorCode>0x0</ErrorCode>
      <Client>Software Explorer</Client>
    </CbsPackageChangeState>
  </UserData>
</Event>

Uninstall Windows 11 Update from Command Prompt

Using Windows update standalone installer(WUSA.exe), you can uninstall Windows 11 update from Command Prompt.

• On Windows 11, launch the command prompt as administrator.
• Run the command wusa.exe /uninstall /kb:<kb number> and press enter key.
• On the Windows Update Standalone Installer window, select Yes to uninstall the Windows Update.

After the update is uninstalled from Windows 11 PC, you must restart the computer. Select Restart Now and the Windows 11 update is completely uninstalled using WUSA.

Tip – You can use the command wusa.exe /uninstall /kb:<kb number> /norestart if you want to uninstall the Windows Update silently and suppress the computer restart.

Uninstall Windows 11 Update using PowerShell

Using WUSA.exe, you can remove Windows 11 update using PowerShell.

• On Windows 11, launch the PowerShell as administrator.
• Run the command wusa.exe /uninstall /kb:<kb number> and press enter key.
• On the Windows Update Standalone Installer window, select Yes to uninstall the Windows Update.

The update is now uninstalling and should be done in a couple of moments.

After the update is uninstalled, you must restart the computer. Click Restart Now to restart the computer and complete the update uninstallation on Windows 11. We have successfully uninstalled Windows 11 update using WUSA.

I hope you learned different methods for uninstalling updates from Windows 11. Which one do you like most?. If you know other methods or if you have anything to add to this guide, do not hesitate to leave a comment below.