Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How do I generate a list of windows patches and the date they were installed on a windows 2000 server? This is for compliance reports for auditors.

share|improve this question

migrated from stackoverflow.com Aug 21 '09 at 0:50

This question came from our site for professional and enthusiast programmers.

4 Answers 4

up vote 8 down vote accepted

Get psinfo from http://technet.microsoft.com/en-us/sysinternals/bb897550.aspx

Run psinfo -h to get the list of hotfixes

Edit: March 2010 Recently found another method that doesn't require 3rd party software using wmic; just type: wmic qfe from the command line. The default output gives really long lines, so you might be better off redirecting to a file and viewing it in your favourite text editor.

Variations on a theme include:

  • wmic qfe list full
  • wmic qfe get HotfixID,ServicePackInEffect,InstallDate,InstalledBy,InstalledOn
  • wmic qfe where "HotfixID = 'KB973687'"
  • wmic qfe where "HotfixID = 'KB973687'" get HotfixID, InstallDate, InstalledBy, InstalledOn
  • wmic qfe where "HotfixID = 'KB973687'" list full
  • wmic /node:myserver qfe list full

Edit: Nov 2014 For completeness, from Powershell this is simply:

  • Local: get-wmiobject -class win32_quickfixengineering
  • Remote: get-wmiobject -class win32_quickfixengineering -computername mysever

Again, this can take filters, for example:

  • get-wmiobject -class win32_quickfixengineering -filter "HotfixID = 'KB979683'"

...or as it's Powershell, just pipe through where-object.

share|improve this answer

The

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP2 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3

keys contain subkeys in the registry that have the details you need.

On my box , sample dump looks thus: Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB915865 Class Name: Last Write Time: 8/17/2009 - 9:01 PM Value 0 Name: Description Type: REG_SZ Data: Hotfix for Windows XP (KB915865)

Value 1 Name: InstalledDate Type: REG_SZ Data: 8/17/2009

Value 2 Name: InstalledBy Type: REG_SZ Data: Aviral

Value 3 Name: UninstallCommand Type: REG_SZ Data: C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe

Value 4 Name: Type Type: REG_SZ Data: Update

or "WTF-y" (www.thedailywtf.com) solution:

Use the commandline program , "systeminfo". It outputs a "hotfixes" section ... when you pass it the "\FO CSV" option , it outputs data as a CSV file ... then it should be fairly easy to parse out...

share|improve this answer

Check out the "Microsoft Baseline Security Analyzer". I believe it is the tool that you are looking for. See http://www.microsoft.com/mbsa and the associated Wikipedia article.

"Microsoft Baseline Security Analyzer (MBSA) is an easy-to-use tool designed for the IT professional that helps small- and medium-sized businesses determine their security state in accordance with Microsoft security recommendations and offers specific remediation guidance. Improve your security management process by using MBSA to detect common security misconfigurations and missing security updates on your computer systems."

share|improve this answer

Quick and Dirty method: Browse the hidden folders in C:\Windows - the $NTUninstallKBxxxxxx refer to the KB Article that discusses the patch. The date on the folder is when it was installed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.