Why do patched assets show as red (not up to date) in the Patch Tuesday report?

[ErikT]

Symptoms
Patched assets show as red (not up to date) in the Patch Tuesday report

Answer
KB updates are scanned from WMI (Windows Management Instrumentation), a management framework built into Windows operating systems. If the KB data is present in WMI class Win32_QuickFixEngineering and the quickfix item was rescanned for your PCs, the KB updates will show up on your Windows assets under the Config\Windows\Quickfix tab.

Do keep in mind that Monthly Rollups tend to be cumulative, meaning that the Monthly Rollup from March, for instance, will be overwritten by the Preview or complete Monthly Rollup of April within the WMI of your Windows assets. This is a process controlled by Microsoft and this is not something we can change, unfortunately. This does mean that any vulnerability reports or older patch Tuesday reports become outdated very quickly and as such will start to report false positives. Unfortunately, Lansweeper does not have the resources to keep the vulnerability reports up to date, so we would recommend using the latest Patch Tuesday report that is available.

Solution
We presume that you have enabled the QUICKFIX scan item under Scanning\Scanned Item Interval, but it might be worth double-checking the settings in case they were disabled at some point:

• The Enable checkbox should be checked in front of the QUICKFIX scanned item (see screenshot).
  
• The History checkbox can be checked as well but this is optional (see screenshot).
  
• The default scanning interval is set to 7 days for the QUICKFIX scan item (see screenshot), so this effectively means that the Windows update data will only be updated on your asset page if it hasn’t been updated in the last 7 days. Of course, you can manually change this interval if required.
  
• More information on what is scanned by Lansweeper and how often, can be found here
  

Once you have double-checked your settings under Scanning\Scanned Item Interval, try the following:

• Click the Rescan Asset button in the left-hand pane of the asset page for one of the affected assets, this will override scan intervals and rescans all items for the affected asset.
  
• Wait for the scanning queue to clear. Your asset is successfully rescanned when the Last Seen date has updated.
  
• Check the Windows Update information again on the Config\Windows\Quickfix tab on the asset page for one of the affected assets.
  
• If the information on the quickfix tab is incorrect or missing, you can run the command below in an elevated CMD on the local computer to cross-reference which information is stored in WMI for the affected assets. The output of the command will be stored in lansweeperwmi.txt which will be written to the folder from which the command is run in CMD.
  

wmic path Win32_QuickFixEngineering >lansweeperwmi.txt

If the output of the query doesn't list the Windows updates, there are some things you can try:

• If you're receiving a No Instance(s) available error when running the WMI query, this article may prove useful for you.
  
• If the local WMI class is empty or otherwise not up to date, you could try following this article which aids in repairing WMI corruption.
  

Do note that Lansweeper can only scan what it finds in the local WMI on the computer, if the data is incorrect in the local WMI, this incorrect data will, unfortunately, be reflected in Lansweeper.