Member Avatar for deoravi22

I need to know how can i get last patched date in network computers from windows script file.Any script who could scan my network and give me a complete list of installed windows security patches.

  • 2 Contributors
  • 4 Replies
  • 220 Views
  • 20 Hours Discussion Span
  • Latest Post Latest Post by deoravi22

Dani AI

Generated

Short answer: MBSA (as suggested) will find missing updates but does not give a reliable “last patched” date per host (as observed). A practical way is to script a query of each machine’s update inventory (WMI / Win32_QuickFixEngineering or the Windows Update COM API) and take the most recent InstalledOn/Date value. The following PowerShell examples run from a management host and produce a per-computer “last patch” value; they require administrative rights and working remote WMI/WinRM connectivity.

PowerShell (Win32_QuickFixEngineering / Get-CimInstance — good general approach)

$computers = Get-Content .\computers.txt
$results = foreach ($c in $computers) {
  try {
    $qfe = Get-CimInstance -ClassName Win32_QuickFixEngineering -ComputerName $c -ErrorAction Stop
    $dates = $qfe | ForEach-Object { try { [datetime]$_.InstalledOn } catch { $null } } | Where-Object { $_ }
    [PSCustomObject]@{ Computer = $c; LastPatch = ($dates | Sort-Object -Descending | Select-Object -First 1) }
  } catch {
    [PSCustomObject]@{ Computer = $c; LastPatch = 'Error/NoData' }
  }
}
$results | Export-Csv .\last-patch-dates.csv -NoTypeInformation

Alternative (Windows Update history via COM — often more accurate for modern OS)

Invoke-Command -ComputerName TARGET -ScriptBlock {
  $s = New-Object -ComObject Microsoft.Update.Session
  $sr = $s.CreateUpdateSearcher()
  $h = $sr.QueryHistory(0, $sr.GetTotalHistoryCount())
  ($h | Sort-Object Date -Descending | Select-Object -First 1).Date
}

Caveats and troubleshooting: remote WMI/WinRM must be allowed by firewall and run with sufficient privileges; InstalledOn is sometimes empty or formatted inconsistently (locale differences) so parsing may fail; Win32_QuickFixEngineering / Get-HotFix can miss feature or cumulative-update details on newer Windows builds. For authoritative, long-term tracking in larger environments, rely on WSUS / SCCM / inventory tools or collect the Windows Update history locally (Invoke-Command + Update Session) and aggregate results.

Recommended Answers

All 4 Replies

Member Avatar for JorgeM

Have you looked at microsoft's MBSA? Sounds like this may be of use. You can use the GUI or run command line scripts.

Member Avatar for deoravi22

I have checked with MBSA but result doesn't seems the correct one.

Member Avatar for JorgeM

The results of the scan do not seem to be correct? Did you validate them against "Windows Update?"

Member Avatar for deoravi22

Yes i have verified, it misses some of the security update information.
To be more specific i need last patching date for machines.MBSA doesn't provide date anywhere.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.