TL;DR: When a Windows update breaks production, start by containing the update, checking Microsoft’s KB article and Windows release health documentation for a supported workaround or Known Issue Rollback, and testing any removal on a pilot group. For individual Windows 11 devices, you can uninstall removable updates through Settings > Windows Update > Update history > Uninstall updates. For enterprise rollbacks, use PDQ and PowerShell to identify affected devices, deploy the rollback in stages, verify recovery, and prevent the update from reinstalling until Microsoft releases a corrected update. Keep in mind that not every update can be removed, and uninstalling a security update also removes its protections.
If a Windows update breaks printing, networking, or application compatibility, you may need to roll back the update quickly. While Microsoft updates improve security, problematic patches can disrupt production environments and require immediate removal.
What should you know before rolling back a Windows 11 update?
On Windows 11, use Settings > Windows Update > Update history > Uninstall updates to remove supported updates. Control Panel may still work for some removable updates, but Microsoft treats it as a legacy path.
Not every update can be removed. Servicing stack updates and some superseded cumulative updates may be permanent, so the uninstall option may not appear.
Before you uninstall a Windows update
Rolling back an update should not be your first response in every situation, especially when the affected update contains security fixes. Removing a security update also removes its protections, potentially exposing the device to vulnerabilities that the update was designed to address.
Before uninstalling an update:
Check the update’s Microsoft KB article and Windows release health documentation for a documented workaround or Known Issue Rollback.
Confirm that the update is the likely cause of the issue.
Back up important data and verify that you have the device’s BitLocker recovery key.
Plan how you will prevent the update from reinstalling.
Determine how and when you will install a corrected update or otherwise restore the removed security protections.
For Windows 11 devices, Microsoft recommends trying the Fix problems using Windows Update repair option before uninstalling an update. This reinstalls the current version of Windows while preserving applications, files, and settings. However, the option may not be available on organizationally managed devices, including devices managed through certain Windows Update policies, Windows Autopatch, or the Windows Update deployment service.
How do you roll back Windows updates across an enterprise?
When a Windows update breaks production, the goal is not simply to uninstall the affected KB. IT teams need to contain the update, confirm that it caused the issue, test the rollback, deploy it in controlled stages, and verify that affected devices recover without immediately reinstalling the same update.
1. Check for a supported mitigation
Start by reviewing the applicable Microsoft KB article and Windows release health documentation. Microsoft may provide a workaround or a Known Issue Rollback, commonly called a KIR.
A KIR reverses a specific problematic nonsecurity change without uninstalling the entire cumulative update. KIR does not remove security fixes. Enterprise organizations can deploy an applicable KIR policy through Group Policy or Microsoft Intune ADMX policy ingestion. Affected devices must restart before the rollback takes effect.
2. Contain the update
Before removing the update broadly, stop it from reaching additional devices or reinstalling on devices you have already fixed.
For devices managed with Windows Update client policies, pause quality updates for the affected deployment ring. If your organization uses WSUS, you can decline the specific update instead.
Keep in mind that pausing quality updates affects the entire ring. It does not block only one cumulative update.
3. Identify affected devices
Use PDQ to identify computers with the affected KB installed. Organize the devices into groups such as pilot, general production, and critical systems so you can control the order of deployment.
Also identify devices that are offline, pending a restart, or running Windows versions for which the update may use a different package name or removal method.
4. Prepare the rollback package
Create or duplicate a PDQ package and add the affected KB number to the PowerShell removal script. Confirm whether the update is removable on the targeted Windows versions and decide how the deployment should handle required restarts.
Because the example script below uses the NoRestart parameter, the package should include a deliberate restart and verification plan rather than assuming the removal is complete as soon as the script finishes.
5. Test with a pilot group
Deploy the rollback to a small collection of IT or test devices first. Confirm that:
The update was successfully removed.
Any required restart completed.
The original printing, networking, application, or operating system issue is resolved.
The devices remain stable after the rollback.
The update does not immediately reinstall.
Do not expand the deployment until the pilot results confirm that the rollback addresses the original issue without creating another one.
6. Deploy in waves
Roll the package out to broader production collections in stages. Deploy to critical systems only after earlier groups complete successfully.
Monitor failed, offline, and restart-pending devices during each wave rather than treating the deployment as complete based only on the number of devices initially targeted.
7. Verify recovery
After each deployment wave, rescan the targeted computers with PDQ and confirm that the affected KB is no longer installed. Review deployment failures, offline targets, pending restarts, and devices where the original issue remains unresolved.
Keep the affected update paused or declined until Microsoft releases a corrected update or you validate another supported mitigation.
8. Restore protection after the rollback
Treat an update rollback as a temporary mitigation, not the end of the incident. If the removed update included security fixes, the affected devices may remain exposed until Microsoft releases a corrected update or you deploy another supported mitigation.
Document which devices had the update removed, monitor Microsoft’s release health information, test the corrected update in a pilot ring, and redeploy it as soon as the original issue is resolved. Verify that every rolled-back device eventually returns to a supported and fully patched state.
How to uninstall Windows updates using the Settings app
For most Windows 11 devices, this is the fastest way to roll back an update.
Click Start > Settings.
Go to Windows Update.
Click Update history.
Scroll down and select Uninstall updates.
Find the update you want to remove and click Uninstall.
Restart your device if prompted.
If the update isn’t listed here, it may not be removable ... or it may have already been replaced by a newer cumulative update.
How to uninstall Windows updates using the Control Panel
Use Control Panel when a removable update does not appear in the Windows 11 Settings workflow. Microsoft now directs Windows 11 users to Settings, but Control Panel may still expose some installed updates.
1. Click the search button and enter Control Panel into the search field.
2. Click on the Control Panel application.
3. In the Control Panel, click Uninstall a program.
4. Click View installed updates.
5. Select the update you need to remove and click Uninstall.
6. If you receive a prompt asking if you are sure you want to uninstall the update, click Yes. You may need to restart your computer after removing an update.
How to uninstall a Windows update when Windows won’t start
If an update prevents Windows from starting normally, you can try removing it through the Windows Recovery Environment, or Windows RE.
Enter the Windows Recovery Environment.
Select Troubleshoot.
Select Advanced options.
Select Uninstall Updates.
Choose Uninstall latest quality update or Uninstall latest feature update, depending on the update you need to remove.
Follow the prompts and restart the device.
You may need the device’s BitLocker recovery key to access recovery tools on an encrypted device. In an enterprise environment, verify that authorized support personnel can retrieve recovery keys before an update incident occurs.
Why won’t Windows let me uninstall this update?
Good question.
Some updates can’t be removed, including:
Servicing Stack Updates (SSUs)
Updates that have been superseded by a newer cumulative update
Feature updates outside the rollback window (typically 10 days by default)
If you're trying to roll back a major feature update (for example, Windows 11 25H2 back to 24H2), you’ll need to try:
Settings > System > Recovery > Go back
And yes, that option disappears after the rollback window expires unless you’ve extended it via policy.
How to uninstall Windows updates using PowerShell
PowerShell is the tool of choice for system administrators, and for a good reason. There’s not much that PowerShell can’t do these days. It’s particularly good at simplifying repetitive tasks. In this example, we’ll use PowerShell to remove multiple updates simultaneously.
Here’s that PowerShell script:
#Return all packages with the ReleaseType "Update"
$TotalUpdates = Get-WindowsPackage -Online | Where-Object{$_.ReleaseType -like "*Update*"}
#Set the KB number you wish to uninstall here. More KBs can be added by appending "|.*KB#######.*" (no spaces around the pipe and not including quotes) before the closing quotes
$Updates = ".*KB#######.*|.*KB#######.*|.*KB#######.*"
#Iterates through the returned updates
foreach ($Update in $TotalUpdates) {
#Gets the PackageName to expand package information, then matches the KB number from the update description, then removes the update.
Get-WindowsPackage -Online -PackageName $Update.PackageName | Where-Object {$_.Description -Match $Updates} | Remove-WindowsPackage -Online -NoRestart
} This script searches installed Windows servicing packages for the specified KB identifiers and attempts to remove each matching, removable package without immediately restarting. Availability and removal behavior vary by Windows version, build, and package type.
How to deploy the PowerShell script using PDQ Connect
To remove a Windows update across multiple devices, deploy the PowerShell script with PDQ Connect.
Run PowerShell scripts on remote devices
Execute PowerShell scripts on managed devices from anywhere with PDQ Connect.
1. Open PDQ Connect, go to Packages, then click Create Package.
2. Enter a package name in the Name field.
3. Click Add install step > Add script step.
4. Enter the script into the PowerShell window. Make sure to add the KB numbers for the updates you want to remove to the script.
5. Click Save when you are finished.
6. Check the newly created package, click Deploy.
7. Select your targets, and click Deploy again.
Whenever you need to remove a different update, simply update the package with the appropriate KB number and redeploy it. This makes it easy to respond quickly if a problematic patch slips past testing and reaches production.
How to deploy the PowerShell script using PDQ Deploy
Now, here’s how to deploy our PowerShell script across your network using PDQ Deploy.
Love PowerShell? Then you'll love PDQ Deploy & Inventory.
Deploy custom scripts in minutes. Try it for yourself for 14 days.
1. With PDQ Deploy open, click New Package.
2. Enter a package name in the Name field.
3. Click New Step > PowerShell.
4. Enter the script into the PowerShell window. Make sure to add the KB numbers for the updates you want to remove to the script.
5. Click Save when you are finished and close the package creation window.
6. Right-click on the newly created package and click Deploy Once.
Anytime you need to roll back an update, you can modify this package with the KB number you need to remove and redeploy it. Perfect for the next time your test environment doesn’t catch a buggy update before it makes it out to your production environment!
How do you stop Windows from reinstalling a rolled-back update?
Uninstalling an update doesn’t always mean you’re done.
If you don’t pause or block the update, Windows Update may simply reinstall it during the next scan cycle.
To prevent that, you may need to:
Pause updates temporarily
Decline the update in WSUS
Adjust your Intune or Windows Update client policies
Use update rings strategically
Otherwise, you might find yourself in a very frustrating uninstall → reinstall loop.
Windows update rollback FAQs
Can you roll back Windows updates on multiple computers at once?
Yes. Instead of manually uninstalling the update on every computer, IT teams can use PDQ Connect to deploy a PowerShell removal script to selected devices or groups. Test the rollback on a small pilot group first, deploy it to the remaining affected devices in stages, and then verify that the update was successfully removed.
Can you roll back Windows updates on remote devices without a VPN?
PDQ Connect can run PowerShell scripts on managed, internet-connected devices from anywhere, so endpoints do not need to be connected to the corporate network or a VPN. As long as a device is online and communicating with PDQ Connect, an admin can target it with the rollback package remotely.
How should IT teams test a Windows update rollback before deploying it broadly?
Start by identifying the devices with the problematic update and deploying the rollback to a small group of IT or test machines. Confirm that the update was removed and that the original issue is resolved before expanding the deployment to production devices in waves, leaving critical systems until the earlier groups succeed.
Do you need to restart a computer after uninstalling a Windows update?
It depends on the update. PowerShell can remove some updates without immediately restarting the computer, but Windows may still require a reboot to finish the removal or restore normal system behavior. Review the update’s requirements, control when restarts occur, and verify the device’s status afterward.
Can you roll back third-party application updates with PDQ Connect?
Yes. PDQ Connect can deploy packages and scripts that replace a problematic third-party application version with an earlier approved version. This can help IT teams recover from faulty updates to applications such as Chrome, Firefox, or Java, but the rollback should still be tested on a small device group before broad deployment.
PDQ and PowerShell have you covered
Don’t let a faulty patch ruin your day. PDQ and PowerShell can get your environment back in shape in no time. PDQ can also help you roll back third-party applications, like Chrome, Java, Firefox, and many more.
If you’re not already using PDQ, start your free trial today and take it for a spin. You’ll be deploying packages and managing your devices in no time.
