1

Patch management (WSUS) hasn't been in my court until recently so I am trying to get acclimated to its functionality. So currently we are using WSUS version 3.2 for our Windows Server patch management. Something I am finding lacking with this system, and maybe because it simply isn't a feature or I am not looking in the correct place, is being notified when patches are applied via email. The only E-Mail notifications I am finding are under Update Services>(Server name) Options and then the E-Mail Notifications settings. From here you can be notified of the synchronization of patches between your WSUS sever and Microsoft and that status report of your environment (summary of the status of your computers by computer groups).

What I want for notifications are, "This computer has just had patch X applied and it was rebooted" in my inbox. Is there a way for WSUS to do this or is this outside of the functionality of WSUS to do? I am looking to do this without purchasing any additional software, just using WSUS/Powershell/etc.

  • WSUS will tell you the overall state of updates on all machines on a daily basis. – motobói Feb 9 '12 at 13:40
3

There isn't built-in functionality to do this.

The Event Log contains information about update installation, as does the %SystemRoot%\WindowsUpdate.log file. Either of those sources would be a good candidate to "scrape" for information about update installations.

The WSUS server's database is updated when updates are installed but, unfortunately, Microsoft has not published the schema and doesn't consider it to be something you should be querying directly. It would be possible to (probably fairly elegantly) report on new update installations via the WSUS server itself if Microsoft published the schema. I won't write anything to touch the WSUS database directly because some significant fraction of my code would turn to garbage upon the next WSUS release.

  • Thanks for the fast response. Yeah just from my couple of days of having this in my lap I didn't think I saw this available. Some further searching the Internet has resulted in wish-lists with this item on them for future versions of WSUS. – Chadddada Feb 7 '12 at 20:02
2

Evan is right, there is no built in functionality to do this.

I remembered seeing this Scripting Guy post,

http://blogs.technet.com/b/heyscriptingguy/archive/2012/01/22/use-the-free-poshwsus-powershell-module-for-wsus-administrative-work.aspx,

about using the PoshWSUS module. Looking at the post and the commands on CodePlex, it seems like you could set up a script that you could run daily that would show you which computers got patches installed since last night or something along those lines.

Unfortunately, I no longer have a WSUS server to test this on.

  • Thanks for the link! I will go take a look at this. I am in the process of building a server that will run all our administrative scripts and this may come into play there. – Chadddada Feb 7 '12 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.