Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 8 down vote favorite
1

Is there a way in Windows to check that say Security Bulletin MS**-*** or CVE-****-***** has been patched? e.g. something akin to RedHat's rpm -q --changelog service

Windows 2008 R2 SP1

share|improve this question

5 Answers

up vote 8 down vote accepted

Running SystemInfo against your server (systeminfo /s $SERVER) should also list installed hotfixes.

Hotfix(s): 333 Hotfix(s) Installed.
[161]: IDNMitigationAPIs - Update
[162]: NLSDownlevelMapping - Update
[163]: KB929399
[164]: KB952069_WM9
[165]: KB968816_WM9
[166]: KB973540_WM9L
[167]: KB936782_WMP11
share|improve this answer
that did it. Thanx – frogstarr78 Nov 24 '11 at 23:32
The coolness and simplicity of this cannot be understated. : ) – Mitch Nov 30 '11 at 18:13
up vote 3 down vote

I run PSinfo -h against the server to show installed hotfixes.

share|improve this answer
nice, but it doesn't list any hotfixes – frogstarr78 Nov 24 '11 at 18:40
It should look something like this, if I knew anything about formatting this stuff properly. Installed HotFix 2007-11-17 Microsoft .NET Framework 1.1 Hotfix (KB928366) 2008-10-27 Microsoft .NET Framework 1.1 Hotfix (KB947742) 2007-05-25 Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) 2004-07-17 Microsoft Data Access Components KB870669 – Mitch Nov 24 '11 at 18:44
I understand. The link you provided has a pretty good example of the output also. It just doesn't list anything for me. I don't suppose it has anything to do w/ me using SP1? – frogstarr78 Nov 24 '11 at 19:06
I'm not sure, I am seeing some feedback on the SP displaying incorrectly on R2. An alternate solution you might try is a Powershell script that will pull the hotfixes for you. – Mitch Nov 24 '11 at 19:08
Will do. Thanx Mitch – frogstarr78 Nov 24 '11 at 19:33
up vote 3 down vote

Another alternative if you can't use pstools and find yourself stuck with native Winder tools:

reg query hklm\software\microsoft\windows\currentversion\uninstall /s | findstr "KB[0-9].*" > %TEMP%\Installed.txt & notepad %TEMP%\Installed.txt
share|improve this answer
I like that better. I prefer the cli myself. Although, there still is nothing listed when I run this. – frogstarr78 Nov 24 '11 at 23:30
up vote 2 down vote

WMIC can list installed hotfixes:

C:\>wmic qfe get hotfixid, installedon
HotFixID   InstalledOn
KB2605658  11/30/2011
KB2608610  9/1/2011
KB2608612  9/26/2011
KB2614194  9/26/2011
...(more)...

It can also search for a specific hotfix. Here I show two searches - one successful, one unsuccessful:

C:\>wmic qfe where (hotfixid = 'KB2608610') get hotfixid, installedon
HotFixID   InstalledOn
KB2608610  9/1/2011

C:\>wmic qfe where (hotfixid = 'nosuch') get hotfixid, installedon
No Instance(s) Available.
share|improve this answer
up vote 1 down vote

Also for checking vulnerabilities on subsystems that you might not know about on the system, the Microsoft Baseline Security Analayzer is a fairly useful tool. It's not always the ones you know about that get you, sometimes there are oddball things installed that aren't scanned or serviced by WSUS or Microsoft Update that can remain unpatched or unmitigated for the life of the system.

share|improve this answer
I'll check it out thanx – frogstarr78 Nov 25 '11 at 20:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.