Update-WindowsSystem.ps1

<#
.SYNOPSIS
    Automated Windows Update script using PSWindowsUpdate.

.DESCRIPTION
    Installs Windows updates with configurable profile modes:
      1. All: Installs all OS updates, software, drivers, and firmware/BIOS.
      2. DriversNoFirmware: Installs OS updates and hardware drivers, but skips firmware/BIOS updates.
      3. NoDriversOrFirmware: Installs OS and software updates only (skips all drivers and firmware).

.PARAMETER Mode
    Selection of updates to apply: 'All', 'DriversNoFirmware', or 'NoDriversOrFirmware'.
    Default is 'All'.

.PARAMETER AutoReboot
    Automatically reboots the system if an update requires a restart.
    Default is false (system will NOT reboot automatically).

.PARAMETER ScanOnly
    Scans and lists pending updates matching the selected mode without installing them.

.EXAMPLE
    .\Update-WindowsSystem.ps1 -Mode All -AutoReboot
    Installs all available updates including drivers and firmware, and reboots if required.

.EXAMPLE
    .\Update-WindowsSystem.ps1 -Mode DriversNoFirmware
    Installs updates and drivers, skipping firmware/BIOS updates. No automatic reboot.

.EXAMPLE
    .\Update-WindowsSystem.ps1 -Mode NoDriversOrFirmware -ScanOnly
    Previews pending OS updates excluding drivers and firmware.
#>

[CmdletBinding()]
param (
    [Parameter(Position = 0)]
    [ValidateSet('All', 'DriversNoFirmware', 'NoDriversOrFirmware')]
    [string]$Mode = 'All',

    [Parameter()]
    [switch]$AutoReboot,

    [Parameter()]
    [switch]$ScanOnly
)

# 1. Require Administrator Privileges
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
    Write-Error "This script must be run as an Administrator. Please restart PowerShell with elevated rights."
    exit 1
}

# 2. Set Execution Policy for Current Process
try {
    Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force -ErrorAction SilentlyContinue
} catch {
    Write-Warning "Could not set execution policy for process: $_"
}

# 3. Ensure PSWindowsUpdate Module is Installed and Loaded
if (-not (Get-Module -ListAvailable -Name PSWindowsUpdate)) {
    Write-Host "[*] PSWindowsUpdate module not found. Installing..." -ForegroundColor Cyan
    try {
        # Ensure NuGet provider exists
        if (-not (Get-PackageProvider -ListAvailable -Name NuGet)) {
            Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Confirm:$false | Out-Null
        }
        # Trust PSGallery to avoid prompt
        Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted -ErrorAction SilentlyContinue

        Install-Module -Name PSWindowsUpdate -Force -Confirm:$false -ErrorAction Stop
        Write-Host "[+] Successfully installed PSWindowsUpdate." -ForegroundColor Green
    } catch {
        Write-Error "Failed to install PSWindowsUpdate module: $_"
        exit 1
    }
}

Import-Module PSWindowsUpdate -ErrorAction Stop

# 4. Configure Parameters Based on Mode
$params = @{}

switch ($Mode) {
    'All' {
        Write-Host "=== Mode: ALL UPDATES (OS + Drivers + Firmware) ===" -ForegroundColor Magenta
        $params['MicrosoftUpdate'] = $true
    }
    'DriversNoFirmware' {
        Write-Host "=== Mode: OS + DRIVERS (Excluding Firmware/BIOS) ===" -ForegroundColor Magenta
        $params['MicrosoftUpdate'] = $true
        $params['NotTitle'] = @('*Firmware*', '*BIOS*')
    }
    'NoDriversOrFirmware' {
        Write-Host "=== Mode: OS/SOFTWARE ONLY (No Drivers, No Firmware) ===" -ForegroundColor Magenta
        $params['NotCategory'] = @('Drivers')
        $params['NotTitle'] = @('*Firmware*', '*BIOS*')
    }
}

# 5. Execute Action (Scan Only vs Install)
if ($ScanOnly) {
    Write-Host "[*] Scanning for pending updates..." -ForegroundColor Cyan
    $updates = Get-WindowsUpdate @params
    if (-not $updates -or $updates.Count -eq 0) {
        Write-Host "[+] No pending updates found matching criteria." -ForegroundColor Green
    } else {
        Write-Host "[+] Found $($updates.Count) update(s):" -ForegroundColor Yellow
        $updates | Format-Table -Property KB, Size, Status, Title -AutoSize
    }
} else {
    $params['AcceptAll'] = $true
    if ($AutoReboot) {
        $params['AutoReboot'] = $true
        Write-Host "[!] AutoReboot is ENABLED. System will restart if required." -ForegroundColor Yellow
    } else {
        $params['IgnoreReboot'] = $true
        Write-Host "[i] AutoReboot is DISABLED. System will NOT restart automatically." -ForegroundColor Gray
    }

    Write-Host "[*] Starting download and installation..." -ForegroundColor Cyan
    Install-WindowsUpdate @params -Verbose

    Write-Host "`n[+] Operation completed." -ForegroundColor Green
}