With 1000+ servers I assume you have a WSUS instance in your environment?
You can get a lot of information from that with powershell. This is a snippet I use on our WSUS server (or via remote ps):
$wsus = Get-WsusServer
$servers = @("server1","server17","pol-server3","pol-server4")
$servers | % {
$servername = $_
$server = $wsus.GetComputerTargets() | ? { $_.FullDomainName -imatch $servername }
If ($server) {
New-Object PSObject -Property @{
Server = $servername
Installed = $server.GetUpdateInstallationSummary().InstalledCount
NotInstalled = $server.GetUpdateInstallationSummary().NotInstalledCount
}
}
} | ft -auto
Results:
Server Installed NotInstalled
------ --------- ------------
server1 144 21
server17 144 21
pol-server3 149 21
pol-server4 100 37
So this checks if patches are installed or still needed, but will not advise which patches are still needed for each server. Hope this helps.