Security Compliance

Installed windows updates and patch manager windows agent update report explained

Why the output of windows update history/Patch Manager Agent Update history do not match with the output of get-hotfix and other similar commands.

First published date

6/24/2024 4:20 PM

Last published date

6/25/2025 5:39 PM

Overview

You are doing your day to day patching activity and wondering how do I know if my windows endpoints are fully patched and the data showing in patch manager reports and update history tab is accurate.

There are so many different commands if you do online search for how to find installed windows updates most of them give you same results / output.

Read on to understand how Patch manager can help you break down what installed updates means what.
 

Product section

Patch Manager

Resolution

Microsoft does not show Cumulative/Superceded updates installed on the machine if you check for installed updates via any of the below methods. These commands only show Security/Quality Rollup/SSU updates

  • Control Panel > Programs and Features > Installed Updatesimage.png
  • Get-Hotfix command

image.png

  • wmic qfe list

image.png

  • systeminfo.exe

image.png

Usually, Windows updates are cumulative, meaning that subsequent updates may include portions of previous updates, resulting in not all update packages appearing in the update history. This is considered normal. The problem is that only certain types of updates are picked up by Win32_QuickFixEngineering class.

Starting with Solarwinds Patch manager version 2024.1, we now show all updates both regular, security, rollup and cumulative updates etc. So, in summary the difference you see in both cases is purely how those commands pull the data from, if you want comprehensive list of updates installed on Client machines, then make sure you are have WSUS inventory task and managed computers inventory configured in your Patch manager environment and use one of the above methods

  • via Computer Explorer > Windows update history tab (if WMI providers installed on the target machine) and
  • via the Windows Update Agent History Report available under Administration and Reporting > Reporting > WSUS Reports > Windows Update
  • use Get-WUHistory Powershell Command - Retrieves update info from Windows Update Agent, the results need to be filtered to exclude failed(in case you are comparing only updates that have been successfully installed)