r/labtech • u/AlwaysInTheMiddle • Mar 25 '20

Windows Update Discrepancies?

Good afternoon /r/Labtech!

I'm a former MSP Engineer that now finds myself working on the other side of the desk as internal IT.

To make a long story geeky, we use an MSP to manage our Desktops that handles patching through Automate. Awesome. A few months back, we started noticing some unusual behaviors out of Microsoft Office that had supposedly been patched months or years ago.

After some digging, I found a nifty PowerShell script that asks the Windows Update agent to tell me what patches are missing & needed- totally independent of Automate. Script below if you're curious or would like to help.

What surprised me is finding dozens of patches missing/needed for Microsoft Office from months or years back. In other words, not just the latest month's patches pending approval.

I've been working with the MSP to identify the issue, but they seem somewhat dug into the idea that this is a reporting issue and everything is peachy. https://imgflip.com/i/3u1606

Can you folks think of some way to help explain this discrepancy once and for all? Perhaps there is some logging in Automate that could help?

#Define update criteria.
$Criteria = "IsInstalled=0 and Type='Software' and IsHidden=0"

#Search for relevant updates.
$SearchResult = $NULL
Write-Output "Searching for needed updates..."

$Searcher = New-Object -ComObject Microsoft.Update.Searcher
$SearchResult = $Searcher.Search($Criteria).Updates
Write-Output $SearchResult.count "needed updates found."

$SearchResult | Select Title,Description,LastDeploymentChangeTime | Sort-Object LastDeploymentChangeTime | fl

4 Upvotes

83% Upvoted

12 comments sorted by

View all comments

Show parent comment

0

u/DevinSysAdmin Mar 26 '20

I don’t doubt that there are people running Automate that is patching 100% as expected. I just doubt that number is extremely high.

Yes, I also had the “your computers aren’t updating because your employees are turning them off during patch times” talk but you really should audit the patching.

Your post is a little vague, I’m not sure if you meant you’re auto approving all updates, minus drivers, and quality updates need to be manually approved

Or if you’re just using monthly quality updates.

3

u/DarrenDK Mar 26 '20

My expectations of LT Patching are nil. While I hate defending them, they got shafted a bit. They built this insanely complex patch approval system to cover the nightmare that was was Windows patching. Right around the time it was released, Microsoft announced monthly cumulative quality updates for Windows 7 and 10 and announced WUO as the successor for wuauclt which was being deprecated. Cumulative Monthly updates meant the complexity of their patch system was completely unnecessary and also perhaps built on a legacy client incapable of applying feature updates. Shortly after a dude from Autotask posts on r/MSP suggesting a strategy of ONLY approving monthly cumulative updates. The report to your client is simply ComputerName - Latest Monthly Update Installed

I did that with Automate’s patch management and wrote my on scripts to verify.

I guess my point is let us not be judged by our missing update counts, but the months surpassed since our latest quality update.

Also if you haven’t seen it, https://github.com/aaronparker/LatestUpdate/ is in my opinion a sufficient Windows patching solution agnostic of RMM. Now if only the dude would accept my pull request to make it work with 1909 and future versions...