1

I would like to be able to check the computer's update status by querying the registry. I specifically would like some to check if the computer's update status is "fully updated".

I have looked through a lot of entries in the registry but I could not find one that has the update status of the computer.

What options do I have to check the windows update status?

  • Are you looking for a com32 API, .Net, registry, command line, PowerShell? What is your end goal? – Elliot Labs LLC Jan 8 '18 at 12:47
  • 2
    WSUS would tell you this, if you're in an enterprise environment. – Alex Berry Jan 8 '18 at 12:55
  • @ElliotLabs I wrote in the question I like to read the status by quering the registry. But I know how to do that, my problem is I do not know what key, or what combination of keys. – Max Muster Jan 8 '18 at 19:43
  • @AlexBerry thank you for the hint, I am on a random windows machine. I need a general method, that works on any windows 7 – Max Muster Jan 8 '18 at 19:44
  • @eichertc, can I ask what the application you want to write is trying to do? There may well already be something out there that does what you're trying to accomplish. – Alex Berry Jan 10 '18 at 11:52
3

The closest to the registry that I can find is the Windows Update log file. The only other way is to access it through the COM API.

I spoke with the manager at Microsoft in charge of Windows Update (Dave Roth) and he said that you should absolutely not try to get the status of Windows Update via the registry. He said that you should use the COM API to get the status by executing the search method and using the returned results for the update status of your computer.

He also gave me this tip:

As a simple FYI, for checking what updates are installed calling IUpdateSearcher::Search with IsInstalled=1 will generate an updatecollection object containing all installed updates. You can walk through it to see what is already installed.

Expanding on his tip you could potentially call that method with IsInstalled=0 to see what updates are not installed. (see the powershell example below).


Windows Update Log File

The Windows Update log file is a good way to see the current status of Windows Update. This method would be good if you could only access the file system and did not have access to APIs or other frameworks/platforms and the such.

You can find it at this path:
%windir%\Windowsupdate.log

The Windows Update log file is in this format:
Date Time PID TID Component Text

An example line with template data would be this:
[date][time] [PID][TID][Component][Text]

Here is a full example:
2005-06-0118:30:03 992810Agent * WU client version 5.8.0.2468

Here is an example where the Windows Update Agent searches for available updates and outputs the results:

2005-06-0212:09:36 9924e8Agent*************
2005-06-0212:09:36 9924e8Agent** START **  Agent: Finding updates [CallerId = WindowsUpdate]
2005-06-0212:09:36 9924e8Agent*********
2005-06-0212:09:36 9924e8Agent  * Added update {AC94DB3B-E1A8-4E92-9FD0-E86F355E6A44}.100 to search result
2005-06-0212:09:37 9924e8Agent  * Found 6 updates and 10 categories in search

On modern systems, you will need to run the PowerShell commandlet Get-WindowsUpdateLog as the log is now no longer stored in the log, the log is stored in etl files. The command will compile the WindowsUpdate.log file from all of the etl files and make it available (by default) at the Desktop folder of the current user.

Here is the description of the command:

The Get-WindowsUpdateLog cmdlet merges and converts Windows Update .etl files into a single readable WindowsUpdate.log file. Windows Update Agent uses Event Tracing for Windows (ETW) to generate diagnostic logs. Windows Update no longer directly produces a WindowsUpdate.log file. Instead, it produces .etl files that are not immediately readable as written.

This cmdlet requires access to a Microsoft symbol server.


COM API

The COM API is a good way to directly access Windows Update without having to parse logs. Applications of this API range from finding available updates on the computer to installing and uninstalling updates.

You could use the Microsoft.Update.Session class to run an update search and then count the number of updates available to see if there are any updates for the computer.

PowerShell Example:

$updateObject = New-Object -ComObject Microsoft.Update.Session
$updateObject.ClientApplicationID = "Serverfault Example Script"
$updateSearcher = $updateObject.CreateUpdateSearcher()
$searchResults = $updateSearcher.Search("IsInstalled=0")
Write-Host $searchResults.Updates.Count

If the returned result is more than 0 then there are updates for the computer that need to be installed and/or downloaded. You can easily update the powershell script to fit your application.

Just a heads up, it appears that the search function is not async so it would freeze your application while searching. In that case you will want to make it async.


Tl;Dr

If you are building a non script (compiled) type of application (with the exception of PowerShell which has access to COM APIs) then I would recommend to use the COM API. Otherwise log parsing would be your best option.


Links

How to read the log file:
https://support.microsoft.com/en-us/help/902093/how-to-read-the-windowsupdalog-file

PowerShell log compile cmdlet:
https://docs.microsoft.com/en-us/powershell/module/windowsupdate/get-windowsupdatelog?view=win10-ps

Com32 API reference:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa387099(v=vs.85).aspx

  • Thank you very much @ElliotLabs but I am afraid I can not parse the log files. It seems not reliable to me. What api could be used?. Please understand that I want to see first how this status can be determined and based on this I will choose the program language to write my application. – Max Muster Jan 8 '18 at 21:27
  • See the update for the msdn reference. I will make the answer shiny when I get to work tomorrow. – Elliot Labs LLC Jan 8 '18 at 21:35
  • Woaw, thanks, now the circle gets tighter. Its remarkable how difficult it is to determine such a simple thing. OK so it looks like the WUA API can be used to scan for updates offline and online. And then I could have a WU_E_NO_UPDATE 0x80240024 code, that could tell me the system is updated ? What is your recommendation? See you tomorrow ;-) – Max Muster Jan 8 '18 at 22:23
  • @eichertc I just updated the answer to include examples and a quote. – Elliot Labs LLC Jan 10 '18 at 11:41
1

Microsoft is now using the value UBR (Unified Build Revision) to identifiy the patch level. The value was first added in Windows 10

enter image description here

, but is now backported to Windows 7

enter image description here

and Windows 8.1 as well

enter image description here

So, query the UBR value from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion and look at the Update History page (for Windows 10 v1709 as example) for the value KB123456 (OS Build 16299.XYZ) on left side:

enter image description here

Here you can see that my 1709 is fully patched with last update.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.