{"id":533548,"date":"2025-09-29T11:37:38","date_gmt":"2025-09-29T11:37:38","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=533548"},"modified":"2025-09-29T11:37:38","modified_gmt":"2025-09-29T11:37:38","slug":"installer-des-correctifs-hors-bande-avec-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/installer-des-correctifs-hors-bande-avec-powershell\/","title":{"rendered":"Comment installer des correctifs hors bande sur Windows avec PowerShell ?"},"content":{"rendered":"

Les correctifs hors bande (Out-Of-Band ou OOB), c’est-\u00e0-dire ceux qui sont publi\u00e9s en dehors du cycle r\u00e9gulier du Patch Tuesday de Microsoft, concernent souvent des vuln\u00e9rabilit\u00e9s critiques ou des probl\u00e8mes de stabilit\u00e9 qui exigent une action imm\u00e9diate. Dans les environnements rapides des fournisseurs de services g\u00e9r\u00e9s (MSP) et des op\u00e9rations informatiques, l’automatisation du d\u00e9ploiement de ces correctifs peut r\u00e9duire consid\u00e9rablement les temps de r\u00e9ponse et am\u00e9liorer la s\u00e9curit\u00e9<\/a>. Un script PowerShell robuste qui g\u00e8re les installations de correctifs locales et distantes fournit une m\u00e9thode fiable et reproductible pour g\u00e9rer ces situations.<\/p>\n

Cet article pr\u00e9sente un script PowerShell con\u00e7u pour installer des correctifs hors bande<\/strong> \u00e0 l’aide d’une URL ou d’un chemin d’acc\u00e8s \u00e0 un fichier donn\u00e9. Nous verrons comment il fonctionne, pourquoi il est utile et le comparerons aux autres strat\u00e9gies de mise \u00e0 jour.<\/p>\n

Contexte<\/h2>\n

Microsoft publie occasionnellement des mises \u00e0 jour hors bande (Out-Of-Band ou OOB) afin d’att\u00e9nuer les menaces de s\u00e9curit\u00e9 urgentes ou de r\u00e9soudre des probl\u00e8mes de stabilit\u00e9 majeurs. Ces mises \u00e0 jour sont g\u00e9n\u00e9ralement livr\u00e9es dans des fichiers .msu<\/code> (Microsoft Update Standalone). Les administrateurs doivent agir rapidement, en particulier lorsque ces correctifs comblent des vuln\u00e9rabilit\u00e9s de type \u00ab\u00a0zero-day\u00a0\u00bb ou des bugs majeurs. Cependant, le t\u00e9l\u00e9chargement et l’installation manuels des correctifs sur plusieurs syst\u00e8mes<\/a> sont inefficaces et sources d’erreurs.<\/p>\n

Ce script PowerShell comble cette lacune. Il permet aux professionnels de l’informatique d’automatiser le processus d’installation en utilisant soit une URL directe vers la mise \u00e0 jour, soit un chemin d’acc\u00e8s \u00e0 un fichier local. Il est particuli\u00e8rement utile dans les environnements g\u00e9r\u00e9s o\u00f9 la coh\u00e9rence administrative, la tra\u00e7abilit\u00e9 et la rapidit\u00e9 sont essentielles.<\/p>\n

Le script<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Installs an out-of-band patch given a URL or a local path.\r\n.DESCRIPTION\r\n    Installs an out-of-band patch given a URL or a local path.\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n.EXAMPLE\r\n    -MSU 'https:\/\/catalog.s.download.windowsupdate.com\/d\/msdownload\/update\/software\/secu\/2024\/07\/windows10.0-kb5040427-x64_750f2819b527034dcdd10be981fa82d140767f8f.msu'\r\n    \r\n    URL 'https:\/\/catalog.s.download.windowsupdate.com\/d\/msdownload\/update\/software\/secu\/2024\/07\/windows10.0-kb5040427-x64_750f2819b527034dcdd10be981fa82d140767f8f.msu' was given.\r\n    Downloading the file...\r\n    Waiting for 14 seconds.\r\n    Download Attempt 1\r\n    Installing update at C:\\Windows\\TEMP\\windowsupdate-1135150612.msu.\r\n    Exit Code: 3010\r\n    [Warn] A reboot is required for this update to take effect.\r\n\r\nPRESET PARAMETER: -MSU \"https:\/\/www.replace.me\"\r\n    Specify either a link or a file path to the patch you would like to install.\r\n\r\nPRESET PARAMETER: -ForceReboot\r\n    Reboot the computer after successfully installing the requested patch.\r\n\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Release Notes: Initial Release\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$MSU,\r\n    [Parameter()]\r\n    [Switch]$ForceReboot = [System.Convert]::ToBoolean($env:forceReboot)\r\n)\r\n\r\nbegin {\r\n    if ($env:urlOrLocalPathToMsu -and $env:urlOrLocalPathToMsu -notlike \"null\") { $MSU = $env:urlOrLocalPathToMsu }\r\n\r\n    # Check if $MSU is not provided\r\n    if (!$MSU) {\r\n        Write-Host -Object \"[Error] An MSU was not provided. Please provide either a local file path or a URL to download the MSU.\"\r\n        exit 1\r\n    }\r\n\r\n    # Remove quotations if given quotations\r\n    if ($MSU) {\r\n        if ($MSU.Trim() -match \"^'\" -or $MSU.Trim() -match \"'$\" -or $MSU.Trim() -match '^\"' -or $MSU.Trim() -match '\"$') {\r\n            $QuotationsFound = $true\r\n        }\r\n        $MSU = ($MSU.Trim() -replace \"^'\" -replace \"'$\" -replace '^\"' -replace '\"$').Trim()\r\n\r\n        if ($QuotationsFound) {\r\n            Write-Host -Object \"[Warning] Removing quotations from your path. Your new path is '$MSU'.\"\r\n        }\r\n    }\r\n\r\n    # Check if $MSU is not a local file path\r\n    if ($MSU -notmatch '^[A-Za-z]:\\\\') {\r\n        # Check if $MSU starts with 'http' but not 'http[s]?:\/\/'\r\n        if ($MSU -match '^http' -and $MSU -notmatch '^http[s]?:\/\/') {\r\n            Write-Host -Object \"[Error] URL '$MSU' is malformed.\"\r\n            exit 1\r\n        }\r\n\r\n        # Check if $MSU contains double 'http[s]?:\/\/'\r\n        if ($MSU -match '^http[s]?:\/\/http[s]?:\/\/') {\r\n            Write-Host -Object \"[Error] URL '$MSU' is malformed.\"\r\n            exit 1\r\n        }\r\n\r\n        # Add 'https:\/\/' to $MSU if it does not start with 'http'\r\n        if ($MSU -notmatch '^http') {\r\n            $MSU = \"https:\/\/$MSU\"\r\n            Write-Host -Object \"[Warn] Missing http(s) from URL, changing URL to '$MSU'.\"\r\n        }\r\n\r\n        # Check if $MSU has a top-level domain\r\n        if ($MSU -notmatch '.*\\..*') {\r\n            Write-Host -Object \"[Error] No top-level domain found in URL.\"\r\n            exit 1\r\n        }\r\n        \r\n        # Validate $MSU as a URI\r\n        try {\r\n            [System.Uri]$MSU | Out-Null\r\n        }\r\n        catch {\r\n            Write-Host -Object \"[Error] URL '$MSU' is malformed.\"\r\n            Write-Host -Object \"[Error] $($_.Exception.Message)\"\r\n            exit 1\r\n        }\r\n    }\r\n    \r\n    # Check if $MSU is a local file path\r\n    if ($MSU -match '^[A-Za-z]:\\\\') {\r\n        # Check if $MSU contains invalid characters\r\n        if ($MSU -match '[<>\"\/\\|?]' -or $MSU -match ':.*:' -or $MSU -match '::') {\r\n            Write-Host -Object \"[Error] The file path '$MSU' contains one of the following invalid characters: < > : `\" \/ \\ | ? :\"\r\n            exit 1\r\n        }\r\n\r\n        # Check if the file at $MSU exists\r\n        if (!(Test-Path -Path \"$MSU\" -ErrorAction SilentlyContinue)) {\r\n            Write-Host -Object \"[Error] File does not exist at path '$MSU'.\"\r\n            exit 1\r\n        }\r\n\r\n        # Try to get the item at $MSU path\r\n        try {\r\n            $MSUFile = Get-Item -Path $MSU -Force -ErrorAction Stop\r\n        }\r\n        catch {\r\n            Write-Host -Object \"[Error] Failed to retrieve file at path '$MSU'.\"\r\n            Write-Host -Object \"[Error] $($_.Exception.Message)\"\r\n            exit 1\r\n        }\r\n\r\n        # Check if more than one file is found at $MSU path\r\n        if ($MSUFile.Count -gt 1) {\r\n            Write-Host -Object \"[Error] Too many files were found at path '$MSU'; please be more specific.\"\r\n        }\r\n\r\n        # Check if the $MSU path is a folder\r\n        if ($MSUFile.PSIsContainer) {\r\n            Write-Host -Object \"[Error] The given path '$MSU' is a folder and not an MSU file.\"\r\n            exit 1\r\n        }\r\n    }    \r\n\r\n    # Utility function for downloading files.\r\n    function Invoke-Download {\r\n        param(\r\n            [Parameter()]\r\n            [String]$URL,\r\n            [Parameter()]\r\n            [String]$Path,\r\n            [Parameter()]\r\n            [int]$Attempts = 3,\r\n            [Parameter()]\r\n            [Switch]$SkipSleep\r\n        )\r\n        Write-Host -Object \"URL '$URL' was given.\"\r\n        Write-Host -Object \"Downloading the file...\"\r\n\r\n        $SupportedTLSversions = [enum]::GetValues('Net.SecurityProtocolType')\r\n        if ( ($SupportedTLSversions -contains 'Tls13') -and ($SupportedTLSversions -contains 'Tls12') ) {\r\n            [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol::Tls13 -bor [System.Net.SecurityProtocolType]::Tls12\r\n        }\r\n        elseif ( $SupportedTLSversions -contains 'Tls12' ) {\r\n            [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12\r\n        }\r\n        else {\r\n            Write-Warning -Message \"TLS 1.2 and or TLS 1.3 are not supported on this system. This download may fail!\"\r\n            if ($PSVersionTable.PSVersion.Major -lt 3) {\r\n                Write-Warning -Message \"PowerShell 2 \/ .NET 2.0 doesn't support TLS 1.2.\"\r\n            }\r\n        }\r\n\r\n        $i = 1\r\n        While ($i -le $Attempts) {\r\n            # Some cloud services have rate-limiting\r\n            if (-not ($SkipSleep)) {\r\n                $SleepTime = Get-Random -Minimum 3 -Maximum 15\r\n                Write-Host -Object \"Waiting for $SleepTime seconds.\"\r\n                Start-Sleep -Seconds $SleepTime\r\n            }\r\n        \r\n            if ($i -ne 1) { Write-Host \"\" }\r\n            Write-Host -Object \"Download Attempt $i\"\r\n\r\n            $PreviousProgressPreference = $ProgressPreference\r\n            $ProgressPreference = 'SilentlyContinue'\r\n            try {\r\n                # Invoke-WebRequest is preferred because it supports links that redirect, e.g., https:\/\/t.ly\r\n                if ($PSVersionTable.PSVersion.Major -lt 4) {\r\n                    # Downloads the file\r\n                    $WebClient = New-Object System.Net.WebClient\r\n                    $WebClient.DownloadFile($URL, $Path)\r\n                }\r\n                else {\r\n                    # Standard options\r\n                    $WebRequestArgs = @{\r\n                        Uri                = $URL\r\n                        OutFile            = $Path\r\n                        MaximumRedirection = 10\r\n                        UseBasicParsing    = $true\r\n                    }\r\n\r\n                    # Downloads the file\r\n                    Invoke-WebRequest @WebRequestArgs\r\n                }\r\n\r\n                $File = Test-Path -Path $Path -ErrorAction SilentlyContinue\r\n            }\r\n            catch {\r\n                Write-Warning -Message \"An error has occurred while downloading!\"\r\n                Write-Warning -Message $_.Exception.Message\r\n\r\n                if (Test-Path -Path $Path -ErrorAction SilentlyContinue) {\r\n                    Remove-Item $Path -Force -Confirm:$false -ErrorAction SilentlyContinue\r\n                }\r\n\r\n                $File = $False\r\n            }\r\n\r\n            $ProgressPreference = $PreviousProgressPreference\r\n            if ($File) {\r\n                $i = $Attempts\r\n            }\r\n            else {\r\n                Write-Warning -Message \"File failed to download.\"\r\n                Write-Host -Object \"\"\r\n            }\r\n\r\n            $i++\r\n        }\r\n\r\n        if (-not (Test-Path $Path)) {\r\n            Write-Host -Object \"[Error] Failed to download file.\"\r\n            Write-Host -Object \"Please verify the URL of '$URL'.\"\r\n            exit 1\r\n        }\r\n        else {\r\n            return $Path\r\n        }\r\n    }\r\n\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    if (!$ExitCode) {\r\n        $ExitCode = 0\r\n    }\r\n}\r\nprocess {\r\n    # Check if the script is running with elevated (Administrator) privileges\r\n    if (!(Test-IsElevated)) {\r\n        Write-Host -Object \"[Error] Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Check if $MSU is not a local file path and download it if it's a URL\r\n    if ($MSU -notmatch '^[A-Za-z]:\\\\') {\r\n        $MSU = Invoke-Download -URL $MSU -Path \"$env:TEMP\\windowsupdate-$(Get-Random).msu\"\r\n        $DownloadedUpdate = $True\r\n    }\r\n\r\n    # Set the log file location\r\n    $LogLocation = \"$env:TEMP\\update-log-$(Get-Random).evt\"\r\n\r\n    # Inform the user that the update is being installed\r\n    Write-Host -Object \"Installing update at $MSU.\"\r\n\r\n    # Prepare the arguments for the update process\r\n    $UpdateArguments = \"`\"$MSU`\"\", \"\/quiet\", \"\/norestart\", \"\/log:`\"$LogLocation`\"\"\r\n    $UpdateProcess = Start-Process -FilePath \"$env:SystemRoot\\System32\\wusa.exe\" -ArgumentList $UpdateArguments -Wait -NoNewWindow -PassThru\r\n\r\n    # Check if the log file exists and try to read it\r\n    if (Test-Path -Path $LogLocation -ErrorAction SilentlyContinue) {\r\n        $LogFile = Get-WinEvent -Path $LogLocation -Oldest -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message -ErrorAction SilentlyContinue | ForEach-Object { \"$($_.TimeCreated) $($_.Message)\" }\r\n        Remove-Item -Path $LogLocation -Force -ErrorAction SilentlyContinue\r\n    }\r\n    \r\n    # Remove the downloaded update file if it was downloaded\r\n    if ($DownloadedUpdate -and (Test-Path -Path $MSU -ErrorAction SilentlyContinue)) {\r\n        Remove-Item -Path $MSU -Force\r\n    }\r\n\r\n    # Output the exit code of the update process\r\n    Write-Host -Object \"Exit Code: $($UpdateProcess.ExitCode)\"\r\n\r\n    # Check if the exit code indicates success\r\n    $ValidExitCodes = \"0\", \"3010\"\r\n    if ($ValidExitCodes -notcontains $UpdateProcess.ExitCode) {\r\n        Write-Host -Object \"[Error] Exit code does not indicate success!\"\r\n\r\n        # Output the update log if available\r\n        if ($LogFile) {\r\n            Write-Host -Object \"`n### Update Log ###\"\r\n            Write-Host -Object $LogFile\r\n        }\r\n        exit 1\r\n    }\r\n\r\n    # Inform the user if a reboot is required\r\n    if (!$ForceReboot -and $UpdateProcess.ExitCode -eq 3010) {\r\n        Write-Host -Object \"[Warn] A reboot is required for this update to take effect.\"\r\n    }\r\n\r\n    # Schedule a reboot if requested and the update was successful\r\n    if ($ForceReboot -and $ExitCode -eq 0) {\r\n        Write-Host \"`nScheduling reboot for $((Get-Date).AddMinutes(1)) as requested.\"\r\n\r\n        Start-Process shutdown.exe -ArgumentList \"\/r \/t 60\" -Wait -NoNewWindow\r\n    }\r\n\r\n    exit $ExitCode\r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}<\/pre>\n
 <\/p>\n\n
Description d\u00e9taill\u00e9e<\/h2>\n
Le script se compose de trois phases principales : la validation et le pr\u00e9traitement<\/strong>, le t\u00e9l\u00e9chargement et l’installation<\/strong>, et la gestion post-installation<\/strong>.<\/p>\n
1. Traitement et validation des param\u00e8tres<\/h3>\n
Le script accepte deux param\u00e8tres\u00a0:<\/p>\n