I needed to list all the missing Windows Updates that have been deployed through Configuration manager. This means, not the ones deployed through WSUS, nor the ones that have NOT been deployed to that specific machine, just get the missing updates that the machine is suppose to have.
The information was not that straight forward to get, but I ended up finding a way to find all the missing updates using PowerShell, WMI and put all of that together into Configuration Manager Configuration Item (and Configuration Manager Baselines).
How to list missing software updates using powershell?
So how do we get the sccm 2012 software updates with powershell? This information can be found a bit anywhere on the internet, and can use thousand of different ways to achieve this goal. (Check out my other Script to retrieve a list of existing Software updates right here) While this blog post mostly explains how to create a Configuration Item that will return the missing software updates deployed on a machine using PowerShell, I though that this article would be incomplete if we didn’t added the basic of the basics: how to list the software updates using powershell and the Configuration Manager client agent.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
Function Get-CMSoftwareUpdates{
Param(
$ComputerName = $env:COMPUTERNAME
)
$NameSpace = “ROOTccmSoftwareUpdatesUpdatesStore”
$Query = “Select * FROM CCM_UpdateStatus”
$Class = “CCM_UpdateStatus”
$Results = Get-WmiObject -ComputerName $ComputerName -Namespace $NameSpace -Class $class -Query $Query
return $Results
}
|
How to get Missing software updates using Powershell?
If you have the configuration manager client deployed, you are lucky, because this method will work for you!
In order to get missing the sofware updates using powershell, we can retrieve pretty precise information on deployed updates using the CCM_UpdateStatus class. The function below illustrates that.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
Function Get-CMMissingSoftwareUpdates {
Param(
[fusion_builder_container hundred_percent=“yes” overflow=“visible”][fusion_builder_row][fusion_builder_column type=“1_1” background_position=“left top” background_color=“” border_size=“” border_color=“” border_style=“solid” spacing=“yes” background_image=“” background_repeat=“no-repeat” padding=“” margin_top=“0px” margin_bottom=“0px” class=“” id=“” animation_type=“” animation_speed=“0.3” animation_direction=“left” hide_on_mobile=“no” center_content=“no” min_height=“none”][switch]$ShowExcludeForStateReporting
)
if ($ShowExcludeForStateReporting){
$Results = Get-WmiObject -Namespace ROOTccmSoftwareUpdatesUpdatesStore -Query “Select * from CCM_UpdateStatus WHERE Status = ‘Missing'”
}else{
$Results = Get-WmiObject -Namespace ROOTccmSoftwareUpdatesUpdatesStore -Query “Select * from CCM_UpdateStatus WHERE Status = ‘Missing’ AND ExcludeForStateReporting = ‘false'”
}
return $Results
}
|
This function will get you all the updates that are currently missing. But this list might include software updates from WSUS. So we need to filter this one one more down and retrieve only the missing software updates that have been deployed.
How to get the deployed software update groups with powershell?
Now this one was the one that got me the most trouble. Again, the technical part of retrieving the information is never really the difficult part. The most difficult part is where to search for the information.
The most difficult part is not how to get the desired information, but rather more where to get find it in the first place.
To list all the software updates groups that have been deployed to a specefic machine will use the CCM_UpdateCIAssignment WMI class.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
Function Get-CMSoftwareUpdateGroupAssignement{
Param(
$ComputerName = $env:COMPUTERNAME,
$GroupName
)
$NameSpace = “ROOTccmPolicyMachineRequestedConfig”
if ($GroupName){
$Query = “Select * FROM CCM_UpdateCIAssignment WHERE AssignmentNAme = ‘$GroupName'”
}else{
$Query = “Select * FROM CCM_UpdateCIAssignment”
}
$Results = Get-WmiObject -ComputerName $ComputerName -Namespace $NameSpace -query $Query
return $Results
}
|
How to get all software updates from a software update group?
Now this was a tricky one! Now that you have all Update groups (Actually, it is the Softwate update group ‘Deployment’), you would like all the Software updates that are assigneg to your computer through that Software Update Group. For that, I have built another function, where I go this time into some XML parsing on data retrieved from the WMI repository. The final version returns an object with all the Updates that are deployed through that software update Group.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
Function Get-CMSoftwareUpdatesFromUpdateGroup{
Param(
[Parameter(Mandatory=$true)]$GroupName
)
$SofwareUpdateGroup = Get-CMSoftwareUpdateGroupAssignement -GroupName $GroupName
$AssignedCIs = $SofwareUpdateGroup.AssignedCIs
$AllFoundUpdates = @()
foreach ($Update in $AssignedCIs){
$UpdateObj=[pscustomobject]@{“Article”=“”;“Id”=“”;“ModelName”=“”;“Version”=“”;“CIVersion”=“”;“ApplicabilityCondition”=“”;“EnforcementEnabled”=“”;“DisplayName”=“”;“UpdateClassification”=“”}
[xml]$Ux = $Update
$UpdateObj.Article = $Ux.ci.DisplayName | Select-String -Pattern ‘KBd*’ -AllMatches | % { $_.Matches } | % {$_.value}
$UpdateObj.id = $ux.ci.id
$UpdateObj.ModelName = $Ux.ci.ModelName
$UpdateObj.Version = $ux.ci.version
$UpdateObj.CIVersion = $ux.ci.civersion
$UpdateObj.ApplicabilityCondition = $ux.ci.ApplicabilityCondition
$UpdateObj.EnforcementEnabled = $ux.ci.EnforcementEnabled
$UpdateObj.DisplayName = $Ux.ci.DisplayName
$UpdateObj.UpdateClassification = $ux.ci.UpdateClassification
if ($UpdateObj -ne $null){
$AllFoundUpdates += $UpdateObj
}
}#end foreach
return $AllFoundUpdates
}
|
How to get all missing software updates that have been deployed from a specific configuration manager software update group with powerShell?
Now that we have the list of missing software updates, and the list of deployed software update groups (assigned software update group), there rest is just a piece of cake!
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
Function Get-MissingUpdateFromUpdateGroup {
[cmdletBinding()]
Param(
$GroupName
)
$SoftwareUpdateGroup = Get-CMSoftwareUpdatesFromUpdateGroup -GroupName $GroupName #| select ID
if (!($SoftwareUpdateGroup)){
write-verbose “SoftwareUpdate group $($GroupName) is empty, or inexisting.”
break
}
$MissingUpdates = Get-CMMissingSoftwareUpdates
foreach ($MissingUpdate in $MissingUpdates){
#Write-Verbose “Comparing $($SoftwareUpdateGroup.id) with $($MissingUpdate.uniqueid)”
if ($SoftwareUpdateGroup.id -contains $MissingUpdate.uniqueid){
write-verbose ” The KB $($MissingUpdate.article) is missing from $($GroupName).”
$MissingUpdate
break
}
}
}
|
This PowerShell function will loop through all of the assigned software update groups deployed on a particular machine, and compare the deployed updates, with the missing ones. If one missing update is present in the group, the script break’s out of the loop and output the missing update.
Read more about missing software updates (or not) and powershell right here:
- A great article from my Pal Dexter on how to automate software updates:
- Great article from Peter van Der Woude on handeling Software update Groups with PowerShell
- David O’brien How to create a software update group using PowerShell
Leave A Comment