If I have a Windows 10 workstation, I can use something like wmic qfe list or Get-Hotfix to show all the installed updates on that system. How can I prove, that the list of updates installed, are really all that is a available to be installed? I'm running into questions from compliance about how do I know Windows hasn't screwed up when it says there are no other available updates and how can I match a master list of available updates against a list of what's installed. Thanks for the help.
-
2It's an interesting question, but if Windows screwed this up, then many millions of people have a problem, not just you.– Michael HamptonJul 5, 2019 at 21:42
-
Yeah, but at the same time, surely I can't have the only internal audit department to ask the question. Somewhere some HIPAA, or PCI, or whatever person wanted to see this. I've been pouring through documentation for days, its' weird how hard this has been to answer.– Ben SooterJul 5, 2019 at 23:01
-
If you have a budget for this, you might investigate third-party solutions. (I know Shavlik used to make a product that did this, though I see they've now been subsumed by Ivanti and I'm not sure whether that particular product still exists. No doubt there are other vendors doing the same thing.)– Harry JohnstonJul 6, 2019 at 20:16
Add a comment
|
2 Answers
The Microsoft Security Update Guide can be used to acquire a list of security KB articles indicating security updates for a specific windows build.
Almost all security updates installed on the system are part of a Latest Cumulative Update (LCU).
By searching the KB articles found in the Security Update Guide, against the Microsoft Update Catalog a list of all cumulative update patches, that have been replaced by other cumulative update patches can be found. In this way, a specific KB article mentioned in the Microsoft Security Update Guide can be traced back to a current cumulative update.
When querying Windows 10 for hotfixes using wmic qfe list or Get-Hotfix the behavior appears to be to only list the latest cumulative update package installed.
You can refer to the offical product documentation: https://docs.microsoft.com/en-us/windows/release-information.
Unfortunately, it seems to be quite difficult to find a list of all minor updates apart from major product releases; however, there are several unofficial pages which track them, such as this one: https://pureinfotech.com/windows-10-version-release-history.
There is also the Microsof Update Catalog (https://catalog.update.microsoft.com), where you can look up all available updates for a given Windows version; but you need to pinpoint a specific Windows 10 release. F.e. if you search for "Windows 10 1903" (current version), this is what you get: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=windows%2010%201903.
Generally speaking, the latest cumulative update for a given Windows 10 release should include all previous updates; but some updates are released outside the CU line and need to be applied separately.
-
So I found the Microsoft Security Update Guide which you can plug in Windows 10, 1709 x64, as an example, and it returns all the CVEs and their related KBs. What you'll find with an up to date 1709 system though is running Get-Hotfix or something similar will give you like 2 Windows OS security updates as installed, but there appears to be like 9 more, and I can't find anything that indicates the others are rolled up or superseded by the ones installed. Jul 5, 2019 at 22:56
-
2If you are in an unmanaged environment, just have Windows check for updates; if something is missing, Windows will detect and install it. If you instead are managing updates via WSUS and/or SCCM, use your chosen tool to deploy updates and generate reports about their installation status.– MassimoJul 5, 2019 at 23:46
-
Historically, isn't hasn't always been true that Windows will always detect missing updates. In the aftermath of Meltdown/Spectre, Windows Update would refuse to detect updates containing the new mitigations (including the main monthly security updates!) if it detected signs of out-of-date anti-virus software. In our environment, that included lots of machines that used to have Symantec installed, because there were some registry settings left over. IIRC, there have also been cases where updates wouldn't detect on certain CPUs. The OP's audit department actually do have a point. Jul 6, 2019 at 20:14
-
@BenSooter If you are targeting Windows 1709, you have a problem (it's two years old).– MassimoJul 7, 2019 at 4:14
-
And yes, I know the new servicng model is quite heavy on IT departments, because it assumes you are going to deploy major updates every six months. But that's the way Microsoft wants it. There's nothing much you can do apart from sticking with old releases (which are going to become unsupported quite quickly, and anyway are a pain to manage, when a newer release includes all updates for all previous ones),– MassimoJul 7, 2019 at 4:17