Adds the CAU clustered role that provides the self-updating functionality to the specified cluster.
Windows Server · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft ClusterAwareUpdating reference: Adds the CAU clustered role that provides the self-updating functionality to the specified cluster. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Add-CauClusterRole. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / ClusterAwareUpdating · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-AttemptSoftReboot
Indicates that the CAU clustered role attempts a Kernel Soft Reboot (KSR) for the failover cluster. KSR bypasses BIOS/firmware initialization. You can only use KSR for updates that do not require a BIOS/firmware initialization.
-CauPluginArguments
Specifies a set of name=value pairs, as arguments, for each updating plug-in to use. For instance, to specify a Domain argument for one plug-in: - @{Domain=Domain.local} You can specify multiple pairs in a set separated with semicolons. For instance: - @{name1=value1;name2=value2;name3=value3} These name=value pairs must be meaningful to the CauPluginName parameter that you specify. If you specify arguments for more than one plug-in, provide the sets of name=value pairs in the order that you pass values in CauPluginName, separated by commas. For instance: - @{name1=value1;name2=value2;name3=value3},@{name4=value4;name5=value5} For the default Microsoft.WindowsUpdatePlugin plug-in, no arguments are needed. The following arguments are optional: - 'IncludeRecommendedUpdates'='\': Boolean value to indicate that recommended updates will be applied in addition to important updates on each node. If not specified, the default value is False. - A standard Windows Update Agent query string that specifies criteria used by the Windows Update Agent to filter the updates that will be applied to each node. For a name, use QueryString and for a value, enclose the full query in quotation marks. If not specified, then the Microsoft.WindowsUpdatePlugin plug-in by default uses the following argument: - QueryString="IsInstalled=0 and Type='Software' and IsHidden=0 and IsAssigned=1" For more information about query strings for the default Microsoft.WindowsUpdatePlugin plug-in and the criteria such as IsInstalled that can be included in the query strings, see IUpdateSearcher::Search method. For the Microsoft.HotfixPlugin plug-in, the following argument is required: - HotfixRootFolderPath=\: The UNC path to a hotfix root folder in an SMB share with a structure that contains the updates to apply and that contains the hotfix configuration file. The following arguments are optional for the Micr
-CauPluginName
Specifies one or more plug-ins to use when performing scans or updates. You can specify multiple values separated with commas. The default is the Microsoft.WindowsUpdatePlugin plug-in. This plug-in coordinates the Windows Update Agent software resident on each cluster node, the same software that is used when updates are downloaded from Windows Update or Microsoft Update, or from a Windows Server Update Services (WSUS) server. For more information about how plug-ins work with CAU, see How Cluster-Aware Updating plug-ins work.
-ClusterName
Specifies the name of the cluster on which to create the CAU clustered role. This parameter is only required when this cmdlet isn't run on a failover cluster node, or this cmdlet is used to reference a failover cluster different from where the cmdlet is run.
Prerequisites
Windows with the ClusterAwareUpdating module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
Examples
Example 1: Add a CAU clustered role on the specified cluster at a specific interval
Add-CauClusterRole @parameters
This command adds the CAU clustered role, using a default name, on the cluster called CONTOSO-FC1. The CAU clustered role is configured to perform Updating Runs on Tuesdays and Saturdays on the second and fourth weeks of each month. In an Updating Run, the maximum number of failed nodes is two and the maximum number of retries per node is two. A script called verifyupdatesinstalled.ps1 runs on each node after it has been fully updated. Before an Updating Run can begin, all the nodes of that cluster must be running. If it isn't already enabled, the Remote Shutdown Windows Firewall rule group will be enabled on each cluster node. Because the command uses the Force parameter, the cmdlet runs without displaying confirmation prompts. This example uses splatting to pass parameter values from the $parameters variable to the command. Learn more about Splatting. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.
Specifies the Windows PowerShell session configuration that defines the session in which scripts, specified by the PreUpdateScript and PostUpdateScript parameters, and cmdlets are run, and can limit the cmdlets that are available to be run. If either a pre-update or post-update script is specified but a configuration name isn't specified, then the default session configuration that is built into Windows PowerShell is used.
-Confirm
Prompts you for confirmation before running the cmdlet.
-Credential
Specifies the administrative credentials for the target cluster.
-DaysOfWeek
Specifies the days of the week on which the updating task will be triggered. Multiple values can be specified either separated with commas or as a hexadecimal sum. The acceptable values for this parameter are: - Sunday: (0x01) - Monday: (0x02) - Tuesday: (0x04) - Wednesday: (0x08) - Thursday: (0x10) - Friday: (0x20) - Saturday: (0x40)
-EnableFirewallRules
Indicates that the cmdlet enables the Remote Shutdown Windows Firewall rule group on each cluster node, if it isn't already enabled. If the EnableFirewallRules parameter is specified, CAU will also automatically re-enable the Remote Shutdown rule group each time the CAU clustered role performs an Updating Run, in case the rules are disabled manually in the intervening time. Enabling this rule group permits inbound communication to each cluster node during each Updating Run that allows CAU to shut down and restart the node remotely (if the installation of an update requires a restart). If Windows Firewall is in use on the cluster nodes and the rule group isn't enabled, the Updating Run will fail. The Remote Shutdown Windows Firewall rule group isn't enabled when it will conflict with Group Policy settings that are configured for Windows Firewall.
-FailbackMode
Specifies the method used to bring drained workloads back to the node, at the end of updating the node. Drained workloads are workloads that were previously running on the node, but were moved to another node. The acceptable values for this parameter are: - NoFailback - Immediate - Policy The default value is Immediate.
-Force
Forces the command to run without asking for user confirmation.
-ForcePauseAndDrain
Indicates that the CAU cluster role forces cluster nodes to pause and drain roles. A forced drain moves the roles off of the draining node even if the group cannot move. A group might not be able to move because no other node can host the group or the group is locked.
-ForcePauseDrainAndReboot
Indicates that the CAU cluster role forces cluster nodes to pause, drain roles, and restart. A forced drain moves the roles off of the draining node even if the group cannot move. A group might not be able to move because no other node can host the group or the group is locked.
-ForcePauseNoDrain
Indicates that the CAU cluster role forces cluster nodes to pause. The nodes are not drained.
-GroupName
Specifies the NetBIOS name of the resource group for the CAU clustered role.
-IntervalWeeks
Specifies the interval between weeks when the task will be triggered. An interval of 1 produces a weekly schedule. An interval of 2 produces an every-other week schedule.
-MaxFailedNodes
Specifies the maximum number of nodes on which updating can fail. If one more than this number of nodes fails, then the Updating Run is stopped. The range is from 0 through 1, less than the number of cluster nodes. The default for most clusters is approximately one-third of the number of nodes.
-MaxRetriesPerNode
Specifies the maximum number of times that the update process attempts to run. This includes any pre-update and post-update scripts. The update process is retried per node. The maximum is 64 and the default is 3.
-NodeOrder
Specifies an array of cluster node names in the order that they should be updated.
-OsRollingUpgrade
Indicates that the CAU cluster role upgrades the operating system of the cluster nodes without stopping the Hyper-V or the Scale-Out File Server workloads.
-PostUpdateScript
Specifies the path and file name for a Windows PowerShell script to run on each node after updating finishes, and just after the node is brought out of Maintenance mode. The file name extension must be .ps1 and the total length of the path plus the file name must be no longer than 260 characters. As a best practice, the script should be located on a disk in cluster storage, or at a highly available network share, to ensure that the script is always accessible to all the cluster nodes.
-PreUpdateScript
Specifies the path and file name for a Windows PowerShell script to run on each node before updating begins, and before the node is put into Maintenance mode. The file name extension must be .ps1 and the total length of the path plus the file name must be no longer than 260 characters. As a best practice, the script should be located on a disk in cluster storage, or at a highly available network share, to ensure that the script is always accessible to all the cluster nodes. If a pre-update script fails, the node isn't updated.
-RebootMode
Specifies the type of reboot to use for each node in the cluster during the update. The available values are: - ClusProp - FullReboot - SoftReboot - PluginCustomReboot - OrchestratorDefault
-RebootTimeoutMinutes
Specifies the time in minutes that CAU allows for the restarting of a node. If the restart doesn't complete within this time, then the Updating Run on that node will be marked as failed.
-RequireAllNodesOnline
Indicates that the cmdlet enforces that all cluster nodes are online and reachable before updating begins.
-RunOnce
Specifies that the CAU run should only be performed once, rather than on a recurring schedule. This can be useful if you only need to perform a one-time update of your cluster nodes.
-RunPluginsSerially
Indicates that the cmdlet CAU scans each cluster node for applicable updates and stages the updates for each plug-in in the plug-in order when multiple plug-ins are used during an Updating Run when you use the CauPluginName parameter. By default, CAU scans and stages the applicable updates for all plug-ins in parallel. Regardless of the configuration of this parameter, CAU installs the applicable updates for each plug-in sequentially. The parameter is valid only when multiple plug-ins are specified in the CauPluginName parameter. If a single plug-in is specified, a warning appears.
-SeparateReboots
Indicates that this cmdlet shuts down CAU and restarts a cluster node after each plug-in installs updates on the node, if the installation of an update by a plug-in requires a restart. By default, during an updating run, all plug-ins complete the installation of updates on a cluster node before the node restarts one time. The parameter is valid only when multiple plug-ins are specified in the CauPluginName parameter. If a single plug-in is specified, a warning appears.
-SiteAwareUpdatingOrder
Specifies the order in which the CAU cluster role updates cluster nodes. By default, CAU selects the order of nodes to update based on the level of activity.
-SkipUpdateChecks
Indicates that the CAU cluster role skips update checks.
-StartDate
Specifies the earliest date on which the Updating Run can be triggered.
-StopAfter
Specifies the time in minutes after which the updating run is canceled if it hasn't completed. The time span can be expressed in the standard ways available in Windows PowerShell, for instance, 01:30:00 represents one hour and thirty minutes. By default, the updating run is allowed an unlimited amount of time to complete. If pre-update or post-update scripts are specified, then the entire process of running scripts and performing updates must be complete within this time limit.
-StopOnPluginFailure
Indicates that this cmdlet coordinates subsequent updates on the node when plug-ins are stopped. When multiple plug-ins are used during an updating run, by default, a failure by one plug-in doesn't affect the application of updates on a node by other plug-ins. This parameter is valid only when multiple plug-ins are specified in the CauPluginName parameter. If a single plug-in is specified, a warning appears.
-SuspendClusterNodeTimeoutMinutes
Specifies the maximum amount of time CAU should wait for the Suspend-ClusterNode cmdlet to succeed if the underlying clustered space is in degraded condition. If Suspend-ClusterNode fails with ERROR_CLUSTER_SPACE_DEGRADED error, CAU will keep retrying for SuspendClusterNodeTimeoutMinutes or suspend the call if the command succeeds. The retries for this error don't count towards the MaxRetriesPerNode parameter set by the user. The timeout value is per cluster node. So CAU could potentially spend the amount of time specified for this value for every node in the cluster in the worst case.
-SuspendRetriesPerNode
Specifies the number of times to retry suspending a node before moving on to the next node.
-VirtualComputerObjectName
Specifies the name of a pre-staged virtual computer object that is used by the CAU clustered role. For more information, see Steps for prestaging the cluster name account. If not specified, then a virtual computer object is created using a generated name. Generating a name automatically requires the cluster name object to have permissions to create the virtual computer object in Active Directory.
-WaitForStorageRepairTimeoutMinutes
Specifies the amount of time in minutes to wait for storage to be repaired on a node before continuing with an update.
-WarnAfter
Specifies the time in minutes after which a warning will be logged if the Updating Run (including any pre-update and post-update scripts) hasn't completed. By default, no warning will be logged, regardless of the time taken by the Updating Run.
-WeeksOfMonth
Specifies the weeks of the month when the Updating Run should be run. The value 5 represents the last week of the month.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.