Hi All,
I'm looking for a report that can find the last successful windows update on Windows 10. In the past I have been able to this for Windows 7 by adding a registry key in Scanning Options > File & Registry Scanning (LM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\'LastSuccessTime') and using this report I can list any items older than 90 days.
Select Top 1000000 tblAssets.AssetName,
tblAssets.AssetID,
tblAssets.Domain,
tblRegistry.AssetID As Computername1,
tblRegistry.Regkey,
tblRegistry.Lastchanged,
tblRegistry.Value,
tblRegistry.Valuename
From tblAssets
Inner Join tblRegistry On tblAssets.AssetID = tblRegistry.AssetID
Where
tblRegistry.Regkey =
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install' And tblRegistry.Value <= DateAdd(day, -90, GetDate())
Order By tblAssets.AssetName
Unfortunately Windows 10 no longer writes to this key, so I went down the path of using a QuickFix engineering report but looking at the time-stamps I found they don't correlate with the actual time-stamp found on a workstation directly, even when the object has been recently scanned.
Select Top 1000000 tsysOS.Image As icon,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.IPAddress,
tblAssets.Firstseen,
tblAssets.Lastseen,
Max(tblQuickFixEngineering.Lastchanged) As LastPatchDetected
From tblAssets
Inner Join tblQuickFixEngineering On tblAssets.AssetID =
tblQuickFixEngineering.AssetID
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Inner Join tblQuickFixEngineeringUni On tblQuickFixEngineeringUni.QFEID =
tblQuickFixEngineering.QFEID
Where tblAssetCustom.State = 1
Group By tsysOS.Image,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.IPAddress,
tblAssets.Firstseen,
tblAssets.Lastseen
Order By LastPatchDetected
I use the following powershell commands to return the date and time, the time is within 24hrs but found it odd they are not accurate.
Get-WmiObject -Class win32_reliabilityRecords -filter "sourcename = 'Microsoft-Windows-WindowsUpdateClient'" -ErrorAction SilentlyContinue |
select @{LABEL = "date";EXPRESSION = {$_.ConvertToDateTime($_.timegenerated)}},
@{LABEL = 'Update';EXPRESSION = {$_.message}} |
FT -AutoSize -Wrap
Get-HotFix
I would like to report on all windows updates(MS Office and etc), not only just the QFE which are System updates only. Has anyone experienced this? or have an alternative report that could help.
