Prajwal Desai

SCCM | ConfigMgr | Intune | Windows 11 | Azure

  • Home
  • Cloud
    • Autopilot
    • Azure
    • Endpoint Analytics
    • Intune
    • PowerShell
    • Teams
    • Windows 365
  • Microsoft
    • Active Directory
    • Group Policy
    • SCCM
    • SCOM
    • Windows 10
    • Windows 11
    • Windows Server
    • WSUS
  • Software
  • Forums
  • Newsletter
  • Contact
Notification Show More
Latest News
Fix Windows Autopilot Reset Error 0x80070032
Fix Windows Autopilot Reset Error 0x80070032
Autopilot Intune
Windows activation error 0xc004c020
Fix: Windows Activation Error 0xC004C020 with 2 Easy Methods
Windows 11 Windows 10
Find the Package ID of SCCM Application
3 Best Ways to Find the Package ID of SCCM Application
SCCM
SCCM Updates Install Error 0x800b0109 0x8024b303
Fix: SCCM Updates Install Error 0x800b0109 | 0x8024b303
SCCM
Disable Windows Hello for Business using Intune ftimg
Disable Windows Hello for Business using Intune – Comprehensive Guide
Intune Autopilot
Aa

Prajwal Desai

SCCM | ConfigMgr | Intune | Windows 11 | Azure

Aa
Search
  • Home
  • Cloud
    • Autopilot
    • Azure
    • Endpoint Analytics
    • Intune
    • PowerShell
    • Teams
    • Windows 365
  • Microsoft
    • Active Directory
    • Group Policy
    • SCCM
    • SCOM
    • Windows 10
    • Windows 11
    • Windows Server
    • WSUS
  • Software
  • Forums
  • Newsletter
  • Contact
Follow US

Home » Windows 11 » Remove Windows 11 Update Patch using Different Methods

Windows 11

Remove Windows 11 Update Patch using Different Methods

By Prajwal Desai 1 View 2 comments August 3, 2022 13 Min Read

In this post, we will look at different methods using which you can remove Windows 11 update. You can use PowerShell, Command Prompt, and even manually uninstall Windows 11 updates from your computer.

Windows 11 operating system is now receiving the new updates from Microsoft. In the coming months, we shall see more updates released for Windows 11. This includes security updates, cumulative updates and servicing stack updates.

It is important to keep your Windows 11 installed with the latest patches as they fix the loopholes and improve overall performance of your Windows 11 PC. If you haven’t upgraded to Windows 11 yet, you can upgrade to Windows 11 using multiple methods.

As an end user, you can manually check for updates on your Windows 11 computer and install the latest updates. If you use a tool like SCCM or ConfigMgr to manage Windows 11 updates, you can deploy the Windows 11 updates using ADR (Automatic Deployment Rule).

- Advertisement -
Ad image

According to Microsoft, Windows 11 will have an annual feature update cadence. Windows 11 feature updates will release in the second half of the calendar year. The feature updates will come with 24 months of support for Home, Pro, Pro for Workstations, and Pro Education editions. And 36 months of support for Enterprise and Education editions.

Table of Contents

  • Why Remove Windows 11 Updates?
  • Manually Remove Windows 11 Update
  • Event ID’s for Windows Update Uninstall
    • Windows Update Servicing – Event ID 1
    • Windows Update Servicing – Event ID 4
    • Windows Update Servicing – Event ID 2
  • Uninstall Windows 11 Update from Command Prompt
  • Uninstall Windows 11 Update using PowerShell

Why Remove Windows 11 Updates?

When you install a new Windows 11 update, then why do you have to remove it? The answer is some Windows updates when installed causes issues on computers. The issues are also listed under Windows Update known issues.

Some updates released by Microsoft are aimed to patch a specific issue however some of them unknowingly triggers another issue. We have seen this happening several times and that’s why most IT admins prefer to wait and deploy the new patches.

When you update your Windows 11 computer, and you start noticing issues, your first task is to identify the update that is causing issues. You can easily do that by checking the updates installed on a specific date.

You have to identify the culprit update(s) and remove it or wait for Microsoft to release a separate patch for the issue. If you notice Windows 11 update causing issues on the computer, you can remove it using multiple ways. Let’s learn how to remove Windows 11 update or the latest patch installed on Windows 11 PC.

On Windows 11 PC, you can roll-back any installed update using Windows Updates Standalone installer (WUSA.exe) command via SCCM. Of course, you can use WUSA to uninstall updates from Windows 11 command prompt or even PowerShell.

Manually Remove Windows 11 Update

The easiest and most recommended method to remove Windows 11 update is via Control Panel > Programs and Features. In the below example, we will uninstall a newly installed Windows 11 update – Update for Microsoft Windows (KB5005537).

On your Windows 11 PC, click Start and launch the Control Panel. Open Programs and Features and select View Installed Updates. This should now list all the updates installed on your Windows 11 computer.

If you have identified the problematic Windows Update (using KB number), select that Windows update from the list that you want to remove and click Uninstall.

Manually Uninstall Windows 11 Updates
Manually Uninstall Windows 11 Updates

You are now presented with the Are you sure you want to uninstall this update? Window when uninstalling an update. Select Yes to proceed with uninstalling the update from your Windows 11 PC.

This begins the update removal process, and you must wait until the update is completely removed from Windows 11.

Whenever you manually uninstall an update from Windows 11, a computer restart is required. Not all updates require a reboot after uninstallation however most of them do. To complete the update uninstallation on Windows 11 PC, restart the computer, select Restart Now.

Remove Windows 11 Update
Remove Windows 11 Update

After the restart, log in to your Windows 11 PC and check the installed updates. The update that you uninstalled shouldn’t appear in the list of installed updates anymore. This completes the steps to manually remove or uninstall updates from Windows 11 computer.

Event ID’s for Windows Update Uninstall

When you uninstall or remove Windows update from Windows 11 computer, you can confirm if the update was successfully removed using the Event ID’s. For every action that you perform on Windows 11, an event is logged with Event ID and description.

You should find the event ID’s for Windows Updates in the following path – Event Viewer > Windows Logs > Setup.

When you install an update on Windows 11, the update along with KB number is marked as installed. Windows marks the state of the update as present state, meaning, the update is installed and currently present on the computer.

In the above example, we removed the Update for Microsoft Windows (KB5005537) from Windows 11 computer. After you uninstall Windows 11 updates, the update name along with KB number is marked as absent state. Windows considers an update as Absent state when the update is uninstalled or not present on the computer.

The uninstall information about that update is logged with event ID’s. Whenever you uninstall Windows 11 updates, you should see these event ID’s in event viewer. Here are the list of event ID’s logged when you uninstall an update from Windows 11.

  1. Event ID 1 – The update uninstallation is initiated.
  2. Event ID 4 – The Windows update requires a reboot in order to mark the update as absent state.
  3. Event ID 2 – Confirms the update uninstall and changes the update state to absent state.

Windows Update Servicing – Event ID 1

When you uninstall an update from Windows 11, first the event ID 1 is logged with event source as servicing. The event ID 1 contains the status information about the Windows Update and notifies that an update has been triggered for uninstallation.

Initiating changes for package KB5005537. Current state is Installed. Target state is Absent. Client id: Software Explorer.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Servicing" Guid="{bd12f3b8-fc40-4a61-a307-b7a013a069c1}" />
    <EventID>1</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-10-21T09:12:53.8699405Z" />
    <EventRecordID>35</EventRecordID>
    <Correlation />
    <Execution ProcessID="2556" ThreadID="6932" />
    <Channel>Setup</Channel>
    <Computer>CORPWIN11.prajwal.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <CbsPackageInitiateChanges xmlns="http://manifests.microsoft.com/win/2004/08/windows/setup_provider">
      <PackageIdentifier>KB5005537</PackageIdentifier>
      <InitialPackageState>5112</InitialPackageState>
      <InitialPackageStateTextized>Installed</InitialPackageStateTextized>
      <IntendedPackageState>5000</IntendedPackageState>
      <IntendedPackageStateTextized>Absent</IntendedPackageStateTextized>
      <Client>Software Explorer</Client>
    </CbsPackageInitiateChanges>
  </UserData>
</Event>
Windows Update Servicing - Event ID 1
Windows Update Servicing – Event ID 1

Windows Update Servicing – Event ID 4

After the event ID 1, the event ID 4 is logged with event source as Windows Update servicing. Event ID 4 means a reboot is necessary before package can be changed to the Absent state.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Servicing" Guid="{bd12f3b8-fc40-4a61-a307-b7a013a069c1}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-10-21T09:12:57.3904784Z" />
    <EventRecordID>36</EventRecordID>
    <Correlation />
    <Execution ProcessID="2556" ThreadID="6932" />
    <Channel>Setup</Channel>
    <Computer>CORPWIN11.prajwal.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <CbsPackageChangeState xmlns="http://manifests.microsoft.com/win/2004/08/windows/setup_provider">
      <PackageIdentifier>KB5005537</PackageIdentifier>
      <IntendedPackageState>5000</IntendedPackageState>
      <IntendedPackageStateTextized>Absent</IntendedPackageStateTextized>
      <ErrorCode>0x0</ErrorCode>
      <Client>Software Explorer</Client>
    </CbsPackageChangeState>
  </UserData>
</Event>
Windows Update Servicing - Event ID 4
Windows Update Servicing – Event ID 4

Windows Update Servicing – Event ID 2

After the event ID 4, the event ID 2 is logged with event source as Windows Update servicing. Event ID 2 confirms the windows update is uninstalled and Package was successfully changed to the Absent state.

If the package is marked as absent state, it means the update has been uninstalled from the computer.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Servicing" Guid="{bd12f3b8-fc40-4a61-a307-b7a013a069c1}" />
    <EventID>2</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-10-21T09:16:33.6058898Z" />
    <EventRecordID>37</EventRecordID>
    <Correlation />
    <Execution ProcessID="2496" ThreadID="2532" />
    <Channel>Setup</Channel>
    <Computer>CORPWIN11.prajwal.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <CbsPackageChangeState xmlns="http://manifests.microsoft.com/win/2004/08/windows/setup_provider">
      <PackageIdentifier>KB5005537</PackageIdentifier>
      <IntendedPackageState>5000</IntendedPackageState>
      <IntendedPackageStateTextized>Absent</IntendedPackageStateTextized>
      <ErrorCode>0x0</ErrorCode>
      <Client>Software Explorer</Client>
    </CbsPackageChangeState>
  </UserData>
</Event>
Windows Update Servicing - Event ID 2
Windows Update Servicing – Event ID 2

Uninstall Windows 11 Update from Command Prompt

Using Windows update standalone installer(WUSA.exe), you can uninstall Windows 11 update from Command Prompt.

  • On Windows 11, launch the command prompt as administrator.
  • Run the command wusa.exe /uninstall /kb:<kb number> and press enter key.
  • On the Windows Update Standalone Installer window, select Yes to uninstall the Windows Update.
Uninstall Windows 11 Updates using Command Prompt
Uninstall Windows 11 Update using Command Prompt

After the update is uninstalled from Windows 11 PC, you must restart the computer. Select Restart Now and the Windows 11 update is completely uninstalled using WUSA.

Uninstall Windows 11 Updates using Command Prompt
Uninstall Windows 11 Update using Command Prompt

Tip – You can use the command wusa.exe /uninstall /kb:<kb number> /norestart if you want to uninstall the Windows Update silently and suppress the computer restart.

Uninstall Windows 11 Update using PowerShell

Using WUSA.exe, you can remove Windows 11 update using PowerShell.

  • On Windows 11, launch the PowerShell as administrator.
  • Run the command wusa.exe /uninstall /kb:<kb number> and press enter key.
  • On the Windows Update Standalone Installer window, select Yes to uninstall the Windows Update.

The update is now uninstalling and should be done in a couple of moments.

Remove Windows 11 Update using PowerShell
Remove Windows 11 Update using PowerShell

After the update is uninstalled, you must restart the computer. Click Restart Now to restart the computer and complete the update uninstallation on Windows 11. We have successfully uninstalled Windows 11 update using WUSA.

Remove Windows 11 Update using PowerShell
Remove Windows 11 Update using PowerShell

I hope you learned different methods for uninstalling updates from Windows 11. Which one do you like most?. If you know other methods or if you have anything to add to this guide, do not hesitate to leave a comment below.

Sign Up For Weekly Newsletter

Get the most recent information on Configuration Manager, Intune, Windows 11, Windows 365, Autopilot, Azure, Software Reviews, and much more by subscribing to the newsletter.
By signing up, you agree and acknowledge the data practices in our Privacy Policy. You may unsubscribe at any time.
Share this Article
Facebook Twitter Copy Link Print
Avatar photo
By Prajwal Desai
Follow:
Prajwal Desai is a Microsoft MVP in Enterprise Mobility. He writes articles on SCCM, Intune, Configuration Manager, Microsoft Intune, Azure, Windows Server, Windows 11, WordPress and other topics, with the goal of providing people with useful information.
Previous Article How to Create a Windows 11 VM in Azure Learn how to Create a Windows 11 VM in Azure
Next Article Schedule Out Of Office In Microsoft Teams 2 Easy Methods to Schedule Out Of Office In Microsoft Teams
2 Comments 2 Comments
  • Avatar photo Emil says:
    August 3, 2022 at 4:50 pm

    Wusa with /quiet is depreciated Prajwal…

    Reply
    • Avatar photo Katie says:
      September 17, 2022 at 6:06 am

      What switch should we use to uninstall it silently?

      Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recast Sponsored AD
Ad image
Patch My PC Sponsored AD
Ad image

Latest Articles

Fix Windows Autopilot Reset Error 0x80070032
Fix Windows Autopilot Reset Error 0x80070032
Autopilot Intune
Windows activation error 0xc004c020
Fix: Windows Activation Error 0xC004C020 with 2 Easy Methods
Windows 11 Windows 10
Find the Package ID of SCCM Application
3 Best Ways to Find the Package ID of SCCM Application
SCCM
SCCM Updates Install Error 0x800b0109 0x8024b303
Fix: SCCM Updates Install Error 0x800b0109 | 0x8024b303
SCCM
Subscribe to Our Newsletter

Subscribe to our newsletter to get our newest articles instantly!

You Might Also Like

Windows activation error 0xc004c020
Windows 11Windows 10

Fix: Windows Activation Error 0xC004C020 with 2 Easy Methods

By Prajwal Desai
How to Uninstall Snipping Tool from Windows 11
SoftwareWindows 11

Remove or Uninstall Snipping Tool from Windows 10 / 11

By Prajwal Desai
Azure VM Remote Computer Requires Network Level Authentication
Azure

Azure VM: Remote Computer Requires Network Level Authentication

By Prajwal Desai

Removed from reading list

Undo
Welcome Back!

Sign in to your account

Lost your password?