SERVER-030 · Script

Report Server Patch Status

Shows when each server last installed a Windows update, and flags servers that have gone too long without one.

What it does

For each target server, reads the installed update list and records: the most recent update, its KB number and install date how many updates were installed in the last -DaysThreshold days operating system, build, and last boot time A server is flagged Behind when its newest update is older than -DaysThreshold days (default 30), and Unknown when no install dates could be read. This shows patch activity; it does not ask Windows Update which updates are still missing. Targets are the servers you name, the servers in an OU, or this computer. Read-only.

Requirements

Windows PowerShell 5.1. Admin rights on the target servers (WinRM or DCOM). The ActiveDirectory module (RSAT) only when -SearchBase is used.

How to run it

• Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
• Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
• Script type: PowerShell 5.1, 64-bit
• User interaction: none; the script never prompts
• Timeout: 30 minutes for large directories or many servers

Settings

Exit codes

• 0 = All servers patched within the threshold (or AlertOn is Never)
• 1 = One or more servers behind, unknown or unreachable
• 2 = Script error (see log)

Testing steps

1. Run it on one test OU, test account or test server and check the output and log.
2. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
3. Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log