Get Date/Time of Last Windows Update
carlklammer08
is there a registry key or a WMI query or anything to get the date and time
the system has been updated the last time via Windows Update?
I mean the date/time that is also shown when you open the Windows Update
applet where it says "Updates were installed:" under "Most recent check for
updates:".
I appreciate every hint!
Thank you very much in advance!
Robert Aldwinckle
news:9B606EB7-C07E-4363...@microsoft.com...
Use ProcMon to see if there is a stored value which is read when those
web operations are executed?
>
> Thank you very much in advance!
Good luck
Robert Aldwinckle
---
MowGreen [MVP]
You're referring to the installation date/time of the latest update(s),
correct ?
Check the ReportingEvents.log located in %windir%\SoftwareDistribution
It records all successful automatically installed updates.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
carlklammer08
I found the key, with a GMT date and time information in it, which should
normally be easy to read out.
BUT there is something quite strange going on with this key, it seems:
I am dealing with this key right now:
> "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime"
I can SEE this key using regedit.exe, but when I try to access/read this key
with either BGinfo or via a VBS-Script (WshShell.RegRead) I always get the
error message "KEY DOES NOT EXIST".
I double checked for spelling errors, but could not find any.
This problem seems to exist with all children of the Key "WindowsUpdate", I
cannot get e.g. "SusClientId" (which is a String Value directly below the Key
WindowsUpdate either.
As this is a fresh out-of-the-box installation of Windows Server 2008 (I
also tried it on Vista - same results), there should nothing be wrong with
the permissions to this key (every user has at least "read" permissions as I
see), no permissions have been changed.
I also tried running BGinfo as an Administrator, but it did not help either.
Every other program except for regedit says this key did not exist!
Strange...
Do you or anybody got an idea what causes this?
carlklammer08
unfortunately, I cannot see from the logfile you mentioned, when the system
was last time successfully updated (e.g. by reading the last line of the
file or so), because in this file mostly status messages are stored, so I
find it hard to get this exact time stamp.
I have however found a corresponding registry key (see my answer above), the
only problem with this key is that it does not seem to be accessible...
Do you have any suggestions?
Thanks,
carl
"MowGreen [MVP]" <mowg...@nowandzen.com> schrieb im Newsbeitrag
news:OKcToHAJ...@TK2MSFTNGP06.phx.gbl...
MowGreen [MVP]
The ReportingEvents.log is quite clear:
> {3BEA61A2-F370-4358-8884-95B49A9EE94D} 2008-10-02 10:13:10:468-0700 1 183 101
> {D8FF0DD2-641E-4FE0-B5D7-32F23DF78720} 100 0 AutomaticUpdates
> Success Content Install Installation Successful: Windows successfully installed the following
> update:
> Definition Update for Windows Defender - KB915597 (Definition 1.45.124.0)
The Timestamp is right after the CLSID of the downloaded/installed
update package.
I'll check the reg key you posted when I get back from a job I'm heading
off to right now.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
Robert Aldwinckle
> Hello Robert,
>
> I found the key, with a GMT date and time information in it, which should
> normally be easy to read out.
> BUT there is something quite strange going on with this key, it seems:
> I am dealing with this key right now:
>
>> "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime"
>
> I can SEE this key using regedit.exe, but when I try to access/read this key
> with either BGinfo or via a VBS-Script (WshShell.RegRead) I always get the
> error message "KEY DOES NOT EXIST".
Let's try using PowerShell instead. I'm trying to learn PowerShell
and think that ultimately this could be the best tool for doing this.
Adapting Example 3 from the Help new-psdrive...
new-psdrive -name MyReg -psprovider Registry -root HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\
Is there a space in that AutoUpdate name or was that just an artifact of
line wrap and posting? PS didn't like it like that. Aha. There is a space
so I need to use quotes:
new-psdrive -name MyReg -psprovider Registry -root "HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\"
But now when I use
set-location MyReg:
and
dir
I get nothing?
In contrast when I back up one level to the parent key I get
<PS_Output>
Hive: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUp
\Auto Update\Results
SKC VC Name Property
--- -- ---- --------
0 2 Detect {LastSuccessTime, LastError}
0 2 Download {LastSuccessTime, LastError}
0 2 Install {LastSuccessTime, LastError}
</PS_Output>
So now the only remaining task will be figuring out how to get some details
about those "properties" (which are obviously the Value names that RegEdit
shows under those subkeys).
Good luck
Robert
---
Robert Aldwinckle
news:e7UdeONJ...@TK2MSFTNGP06.phx.gbl...
...
> So now the only remaining task will be figuring out how to get some details
> about those "properties" (which are obviously the Value names that RegEdit
> shows under those subkeys).
Solving that problem showed that I was on the wrong track by making
a "drive" out of a registry branch. ; )
Here's a complete PowerShell "one-liner" solution:
Get-ItemProperty -Path Registry::"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install" | format-list
HTH
Robert
---
ritesh kumar
(get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)
for windows 2000, you need to replace windows with winnt i.e. \\"server_name\c$\winnt\......
> On Wednesday, October 01, 2008 8:07 AM carlklammer0 wrote:
> Hello,
>
> is there a registry key or a WMI query or anything to get the date and time
> the system has been updated the last time via Windows Update?
>
> I mean the date/time that is also shown when you open the Windows Update
> applet where it says "Updates were installed:" under "Most recent check for
> updates:".
>
> I appreciate every hint!
>
> Thank you very much in advance!
>> On Wednesday, October 01, 2008 3:58 PM Robert Aldwinckle wrote:
>> Use ProcMon to see if there is a stored value which is read when those
>> web operations are executed?
>>
>>
>>
>>
>> Good luck
>>
>> Robert Aldwinckle
>> ---
>>> On Wednesday, October 01, 2008 4:11 PM MowGreen [MVP] wrote:
>>> carlklammer08 wrote:
>>>
>>>
>>> You're referring to the installation date/time of the latest update(s),
>>> correct ?
>>> Check the ReportingEvents.log located in %windir%\SoftwareDistribution
>>> It records all successful automatically installed updates.
>>>
>>>
>>> MowGreen [MVP 2003-2009]
>>> ===============
>>> *-343-* FDNY
>>> Never Forgotten
>>> ===============
>>>> On Thursday, October 02, 2008 5:33 AM carlklammer0 wrote:
>>>> Hello Robert,
>>>>
>>>> I found the key, with a GMT date and time information in it, which should
>>>> normally be easy to read out.
>>>> BUT there is something quite strange going on with this key, it seems:
>>>> I am dealing with this key right now:
>>>>
>>>>
>>>> I can SEE this key using regedit.exe, but when I try to access/read this key
>>>> with either BGinfo or via a VBS-Script (WshShell.RegRead) I always get the
>>>> error message "KEY DOES NOT EXIST".
>>>>
>>>> I double checked for spelling errors, but could not find any.
>>>> This problem seems to exist with all children of the Key "WindowsUpdate", I
>>>> cannot get e.g. "SusClientId" (which is a String Value directly below the Key
>>>> WindowsUpdate either.
>>>>
>>>> As this is a fresh out-of-the-box installation of Windows Server 2008 (I
>>>> also tried it on Vista - same results), there should nothing be wrong with
>>>> the permissions to this key (every user has at least "read" permissions as I
>>>> see), no permissions have been changed.
>>>>
>>>> I also tried running BGinfo as an Administrator, but it did not help either.
>>>> Every other program except for regedit says this key did not exist!
>>>>
>>>> Strange...
>>>>
>>>> Do you or anybody got an idea what causes this?
>>>>> On Thursday, October 02, 2008 8:18 AM carlklammer08 wrote:
>>>>> Hi,
>>>>>
>>>>> unfortunately, I cannot see from the logfile you mentioned, when the system
>>>>> was last time successfully updated (e.g. by reading the last line of the
>>>>> file or so), because in this file mostly status messages are stored, so I
>>>>> find it hard to get this exact time stamp.
>>>>>
>>>>> I have however found a corresponding registry key (see my answer above), the
>>>>> only problem with this key is that it does not seem to be accessible...
>>>>>
>>>>> Do you have any suggestions?
>>>>>
>>>>> Thanks,
>>>>> carl
>>>>>
>>>>> "MowGreen [MVP]" <mowg...@nowandzen.com> schrieb im Newsbeitrag
>>>>> news:OKcToHAJ...@TK2MSFTNGP06.phx.gbl...
>>>>>> On Thursday, October 02, 2008 2:43 PM MowGreen [MVP] wrote:
>>>>>> Carl,
>>>>>>
>>>>>> The ReportingEvents.log is quite clear:
>>>>>>
>>>>>>
>>>>>> The Timestamp is right after the CLSID of the downloaded/installed
>>>>>> update package.
>>>>>> I'll check the reg key you posted when I get back from a job I'm heading
>>>>>> off to right now.
>>>>>>
>>>>>> MowGreen [MVP 2003-2009]
>>>>>> ===============
>>>>>> *-343-* FDNY
>>>>>> Never Forgotten
>>>>>> ===============
>>>>>>
>>>>>>
>>>>>>
>>>>>> carlklammer08 wrote:
>>>>>>> On Thursday, October 02, 2008 5:12 PM Robert Aldwinckle wrote:
>>>>>>> "carlklammer08" <carlkl...@discussions.microsoft.com> wrote in message
>>>>>>> news:D4638941-FD26-4A93...@microsoft.com...
>>>>>>>
>>>>>>>
>>>>>>> So now the only remaining task will be figuring out how to get some details
>>>>>>> about those "properties" (which are obviously the Value names that RegEdit
>>>>>>> shows under those subkeys).
>>>>>>>
>>>>>>>
>>>>>>> Good luck
>>>>>>>
>>>>>>> Robert
>>>>>>> ---
>>>>>>>> On Saturday, October 04, 2008 12:18 AM Robert Aldwinckle wrote:
>>>>>>>> "Robert Aldwinckle" <rob...@techemail.com> wrote in message
>>>>>>>> news:e7UdeONJ...@TK2MSFTNGP06.phx.gbl...
>>>>>>>>
>>>>>>>> ...
>>>>>>>>
>>>>>>>>
>>>>>>>> Solving that problem showed that I was on the wrong track by making
>>>>>>>> a "drive" out of a registry branch. ; )
>>>>>>>>
>>>>>>>> Here's a complete PowerShell "one-liner" solution:
>>>>>>>>
>>>>>>>> Get-ItemProperty -Path Registry::"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
>>>>>>>> Update\Results\Install" | format-list
>>>>>>>>
>>>>>>>>
>>>>>>>> HTH
>>>>>>>>
>>>>>>>> Robert
>>>>>>>> ---
>>>>>>>> Submitted via EggHeadCafe
>>>>>>>> Fill out blank PDF form online and stream to browser with iTextSharp
>>>>>>>> http://www.eggheadcafe.com/tutorials/aspnet/a5e1109d-03bc-4e6b-a904-af4835f336cd/fill-out-blank-pdf-form-online-and-stream-to-browser-with-itextsharp.aspx
ritesh kumar
(get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)
change the path if u wanna query windows 2000
> On Wednesday, October 01, 2008 8:07 AM carlklammer0 wrote:
> Hello,
>
> is there a registry key or a WMI query or anything to get the date and time
> the system has been updated the last time via Windows Update?
>
> I mean the date/time that is also shown when you open the Windows Update
> applet where it says "Updates were installed:" under "Most recent check for
> updates:".
>
> I appreciate every hint!
>
> Thank you very much in advance!
>> On Wednesday, October 01, 2008 3:58 PM Robert Aldwinckle wrote:
>> Use ProcMon to see if there is a stored value which is read when those
>> web operations are executed?
>>
>>
>>
>>
>> Good luck
>>
>> Robert Aldwinckle
>> ---
>>> On Wednesday, October 01, 2008 4:11 PM MowGreen [MVP] wrote:
>>> carlklammer08 wrote:
>>>
>>>
>>> You're referring to the installation date/time of the latest update(s),
>>> correct ?
>>> Check the ReportingEvents.log located in %windir%\SoftwareDistribution
>>> It records all successful automatically installed updates.
>>>
>>>
>>> MowGreen [MVP 2003-2009]
>>> ===============
>>> *-343-* FDNY
>>> Never Forgotten
>>> ===============
>>>>>> MowGreen [MVP 2003-2009]
>>>>>> ===============
>>>>>> *-343-* FDNY
>>>>>> Never Forgotten
>>>>>> ===============
>>>>>>
>>>>>>
>>>>>>
>>>>>> carlklammer08 wrote:
>>>>>>>>> On Sunday, November 21, 2010 3:55 AM ritesh kumar wrote:
>>>>>>>>> Use the below powershell command to get the last patch date:
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> (get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> for windows 2000, you need to replace windows with winnt i.e. \\"server_name\c$\winnt\......
>>>>>>>>> Submitted via EggHeadCafe
>>>>>>>>> Review of Redgate ANTS Performance Profiler 6
>>>>>>>>> http://www.eggheadcafe.com/tutorials/aspnet/945b0f4a-55b9-4799-aaa3-bcbed4131446/review-of-redgate-ants-performance-profiler-6.aspx
ritesh kumar
(get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)
change the path if u wanna query windows 2000
> On Wednesday, October 01, 2008 8:07 AM carlklammer0 wrote:
> Hello,
>
> is there a registry key or a WMI query or anything to get the date and time
> the system has been updated the last time via Windows Update?
>
> I mean the date/time that is also shown when you open the Windows Update
> applet where it says "Updates were installed:" under "Most recent check for
> updates:".
>
> I appreciate every hint!
>
> Thank you very much in advance!
>> On Wednesday, October 01, 2008 3:58 PM Robert Aldwinckle wrote:
>> Use ProcMon to see if there is a stored value which is read when those
>> web operations are executed?
>>
>>
>>
>>
>> Good luck
>>
>> Robert Aldwinckle
>> ---
>>> On Wednesday, October 01, 2008 4:11 PM MowGreen [MVP] wrote:
>>> carlklammer08 wrote:
>>>
>>>
>>> You're referring to the installation date/time of the latest update(s),
>>> correct ?
>>> Check the ReportingEvents.log located in %windir%\SoftwareDistribution
>>> It records all successful automatically installed updates.
>>>
>>>
>>> MowGreen [MVP 2003-2009]
>>> ===============
>>> *-343-* FDNY
>>> Never Forgotten
>>> ===============
>>>>>> MowGreen [MVP 2003-2009]
>>>>>> ===============
>>>>>> *-343-* FDNY
>>>>>> Never Forgotten
>>>>>> ===============
>>>>>>
>>>>>>
>>>>>>
>>>>>> carlklammer08 wrote:
>>>>>>>>>> On Sunday, November 21, 2010 4:04 AM ritesh kumar wrote:
>>>>>>>>>> hope this help...
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> (get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> change the path if u wanna query windows 2000