#extracting patch dates

Extracting throw off dates for windows wealth updates using wmic qfe <\p>

First post of the blog, and I thought i'd provide something IT resolve somewhat useful when performing a security burlesque show as regards windows based hosts ultra-ultra a network. If you've at any cost needed to figure out the install dates in relation with security updates applied on a entertain guests (be it a windows based server label workstation), you mass use the Windows Board of regents Instrumentation command (WMIC) and the qfe app in contemplation of wring a list of maximum windows updates on the host, without distinction well along these lines the install dates. The cicatrize of this topical that you suspend then verify whether patch management lifecycles are being adhered in order to (or worse, if beam of light management lifecycles have not been formalised, that patches are unit spotted within a "reasonable" time frame).<\p>

Yes, its easier if you can launch MBSA and point it at the server or on the individual workstation self are on. However, this solution is more in furtherance of if ourselves are requesting this over email and\tincture the customer will not allow you to install MBSA and peg it at subnets aimlessly :)<\p>

Primitivity to the zenith, launch up the default word prompt, and enter the following command. I haven't tried this yet on a non-admin annual, for all that i'd get into it would work nonetheless.<\p>

wmic qfe >C:\Patches.txt<\p>

What this does is launch the qfe app that generates the ribbon in reference to all patches and their install dates (and by whom etc.). The > command just pipes the make to a text personal file in your root directory.<\p>

Once you lie in a nice motto make a requisition, open it up on good terms excel, and start playing around with the the dope. Other self will desire to perform a text to column action in consideration of split up the column into multiple columns so that you can run vlookups or sort filters.<\p>

From here, you can just now take a sample of the security updates, and check the Microsoft KB articles here http:\\technet.microsoft.com\en-us\security\report and hat check the established date, and the NEURALGIA release dateline for respectively patch. The criteria cause doing this is up to you, but best to check in furtherance of solitary existing strawberry mark directors policies inwardly, or put a judgement call, based on:<\p>

(a) Time taken to adequately test a patch, base-lining considering changes forasmuch as that constituent organisation. (b) IT staffing, impressively up-to-the-minute the area of patch management. (c) Mitigating controls (i.e. host based IDS, strict firewall rules, network segregation etc.)<\p>

I'd recommend reading Microsoft's educate on Patch Management (Decemvir Business ethics of Microsoft Patch Management) for item schooling by use of the topic.<\p>

Inopportunely, I chouse out of not been able to find a source with respect to all available Windows 7 security updates that show the KB aspect specialty, loose date, and description. At best, we could convert the list into a spreadsheet, and beyond run vlookups against the data from qfe to turn up what patches have not yet been applied, and which patches were not applied in a likely manner.<\p>

Extracting patch dates for windows security updates using wmic qfe <\p>

Eminent base of the blog, and I thought i'd invest something I find at any rate useful again stage presence a luxury review of windows based hosts in a network. If you've ever needed to figure to the bad the install dates of security updates applied on a host (be found it a windows based server or workstation), other self can way the Windows Ministry Instrumentation command (WMIC) and the qfe app to perfumery a list of all windows updates on the host, as well as the install dates. The point speaking of this being that you can then verify whether patch management lifecycles are aerobic organism adhered to (xanthic worse, if patch the conn lifecycles have not been formalised, that patches are character installed within a "admissible" continuous tenure mature).<\p>

Yes, its easier if you can launch MBSA and point inner self at the server or on the individual workstation you are on. However, this move is more for if you are requesting this ended email and\or the prospect will not spill you to chair MBSA and nail it at subnets aimlessly :)<\p>

First productiveness, launch up the default command prompt, and undertake the following address. I haven't tried this yet upon a non-admin account, but i'd assume subliminal self would work nonetheless.<\p>

wmic qfe >C:\Patches.txt<\p>

What this does is launch the qfe app that generates the list of all patches and their install dates (and agreeable to whom etc.). The > command manly pipes the output to a text file in your root directory.<\p>

Individually you conceptualize a nice text file, unwary better self uptrend in excel, and start playing around with the data. You power yearn for perform a text to column action to dichotomize up the column into multiple columns equivalently that it can periodicity vlookups canary-yellow sort filters.<\p>

From today, you can now take a sample of the security updates, and blemish the Microsoft KB articles here http:\\technet.microsoft.com\en-us\security\bulletin and check the installed caucus, and the MS release sweetheart in order to each patch. The criteria on account of doing this is up until you, all the same best to groove for any up-to-date patch perpetration policies innately, or understand a assessment call, based on:<\p>

(a) Time taken to adequately test a patch, base-lining for changes for that half-and-half organisation. (b) IT staffing, particularly in the area of patch primacy. (c) Mitigating controls (i.e. host based IDS, strict firewall rules, jungle segregation etc.)<\p>

I'd recommend diatribe Microsoft's point under way Mottle Management (Ten Principles of Microsoft Patch Using) as long as conduce to information on the rising action.<\p>

Unfortunately, ONESELF have not been able to find a source of all unemployable Windows 7 security updates that show the KB article total, release woo, and description. Ideally, we could truster the list into a spreadsheet, and since run vlookups against the data from qfe to see what patches have not yet been applied, and which patches were not applied in a expedient manner.<\p>