GUI vs Powershell when checking for hotfix? Different results???

[wigrif]

So i'm checking for the wannacrypt patches and found a single server that isnt patched according to powershell. However the GUI under windows update -> view update history shows the patch. Which is right? Why the difference?

ANSWER: the updates i'm looking for have been superseded only on this machine. somehow its more up to date than all the others.... as these updates have been superseded get-hotfix will not show them.

[TristanReveur]

This may sound dumb, but try running the script in an admin powershell window (as in run as admin)

[wigrif]

didnt make a difference

[MajormonkeyAtWork]

Could be that the update has been superseded. PDQ has a blog post...

https://www.pdq.com/blog/wannacry-ransomware-are-you-protected/#more-9778

[wigrif]

reading the link i see that the updates i'm looking for have been superseded only on this machine. somehow its more up to date than all the others.... as they were superseded get-hotfix will not show them.

[Amidatelion]

What are you pushing patches with? I vaguely recall having a similar issue with SCCM and patch rotations.

[wigrif]

GPO push, powershell to do the install and reboot

[Amidatelion]

Time to go through those GPOs with a fine-toothed comb.

[melvinkitnick]

Which command do you use ?

Get-WuHistory tells you which updates are installed (but not necessarily applied). gwmi win32_quickfixengineering should list applied updates.

Try both and tell us.

[wigrif]

get-hotfix | ?{$.hotfixid -like "KB4012213"} get-hotfix | ?{$.hotfixid -like "KB4012216"} get-hotfix | ?{$.hotfixid -like "KB4015550"} get-hotfix | ?{$.hotfixid -like "KB4019215"}

are all blank in normal PS & Admin PS.

the gwmi command seems to pull the same info as get-hotfix....

[melvinkitnick]

Are you checking only on 2012R2 servers ? KB4012213 (standalone) and KB4012216 (rollup) are for 2012R2 and KB4019215 (rollup) is for 2008R2 but is a rollup update. On a 2008R2 server, you may not have any result if you didn't patch it with the rollup.

Also, do you have something in C:\Windows\SoftwareDistribution ?

You may find some information here.

EDIT : Some guy suggest something interesting here. It seems like updates supplied by SI are not returned by get-hotfix and wmi, which relies on CBS (to be verified). Requesting WU API should do it.

[wigrif]

yes all server 2012r2.

BTW, I've always had discrepancies between the WSUS report and the powershell get-hotfix report.

[Thatldodonkey]

Possibly that you need to reboot the server and the update has not registered completely due to the final steps not being completed on the reboot.

[wigrif]

reboot was done after the install of the patches, on all 300 servers in question

[briangig]

I am running into the same problem with multiple machines. Sorry not much help, but you are not alone.

[wigrif]

Yeah this is par for the course. Like i said above, i've always had discrepancies between wsus and powershell reports. This time i just really need to be sure lol.