{"id":2520,"date":"2015-05-27T06:01:27","date_gmt":"2015-05-27T02:01:27","guid":{"rendered":"https:\/\/rakhesh.com\/?p=2520"},"modified":"2015-05-27T06:01:27","modified_gmt":"2015-05-27T02:01:27","slug":"get-a-list-of-recently-installed-windows-updates-via-the-command-line","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/get-a-list-of-recently-installed-windows-updates-via-the-command-line\/","title":{"rendered":"Get a list of recently installed Windows updates via the command line"},"content":{"rendered":"

In a previous post<\/a> I gave a DISM command to get a list of installed Windows Updates:<\/p>\n

dism \/online \/Get-Packages \/Format:Table<\/pre>\n
While useful that command has no option of filtering results based on some criteria.\u00a0<\/p>\n
If you are on Windows 8 or above the Get-WindowsPackage<\/code> cmdlet can be of use:<\/p>\n
Get-WindowsPackage -Online | ?{ $_.InstallTime -gt [datetime]::now.AddDays(-15) }<\/pre>\n
This gets me all updates installed in the last 15 days.\u00a0<\/p>\n
Another alternative (on pre-Windows 8 machines) is good ol’ WMIC:<\/p>\n
wmic qfe<\/pre>\n
The above gives output similar to this:<\/p>\n
Caption                                     CSName  Description      FixComments  HotFixID                                         InstallDate  Instal\r\nledBy          InstalledOn  Name  ServicePackInEffect  Status\r\nhttp:\/\/support.microsoft.com\/kb\/2899189     GAIA    Update                        KB2899189_Microsoft-Windows-CameraCodec-Package               NT AUT\r\nHORITY\\SYSTEM  3\/22\/2014\r\nhttp:\/\/support.microsoft.com\/?kbid=2843630  GAIA    Update                        KB2843630                                                     NT AUT\r\nHORITY\\SYSTEM  3\/22\/2014\r\nhttp:\/\/support.microsoft.com\/?kbid=2868626  GAIA    Security Update               KB2868626                                                     NT AUT\r\nHORITY\\SYSTEM  3\/22\/2014\r\nhttp:\/\/support.microsoft.com\/?kbid=2883200  GAIA    Update                        KB2883200                                                     GAIA\\A\r\ndministrator   9\/30\/2013\r\nhttp:\/\/support.microsoft.com\/?kbid=2887595  GAIA    Update                        KB2887595                                                     NT AUT\r\nHORITY\\SYSTEM  3\/22\/2014\r\n...<\/pre>\n
For more details more switches can be used:<\/p>\n
wmic qfe list full<\/pre>\n
Result is:<\/p>\n
Caption=http:\/\/support.microsoft.com\/kb\/2899189\r\nCSName=GAIA\r\nDescription=Update\r\nFixComments=\r\nHotFixID=KB2899189_Microsoft-Windows-CameraCodec-Package\r\nInstallDate=\r\nInstalledBy=NT AUTHORITY\\SYSTEM\r\nInstalledOn=3\/22\/2014\r\nName=\r\nServicePackInEffect=\r\nStatus=\r\n\r\n\r\nCaption=http:\/\/support.microsoft.com\/?kbid=2843630\r\nCSName=GAIA\r\nDescription=Update\r\nFixComments=\r\nHotFixID=KB2843630\r\nInstallDate=\r\nInstalledBy=NT AUTHORITY\\SYSTEM\r\nInstalledOn=3\/22\/2014\r\nName=\r\nServicePackInEffect=\r\nStatus=\r\n\r\n\r\nCaption=http:\/\/support.microsoft.com\/?kbid=2868626\r\nCSName=GAIA\r\nDescription=Security Update\r\nFixComments=\r\nHotFixID=KB2868626\r\nInstallDate=\r\nInstalledBy=NT AUTHORITY\\SYSTEM\r\nInstalledOn=3\/22\/2014\r\nName=\r\nServicePackInEffect=\r\nStatus=\r\n\r\n...<\/pre>\n
This output also gives an idea of the criteria available.\u00a0<\/p>\n
So how can I filter this output like I did with PowerShell? Easy – use WQL<\/a> (WMIC Query Language). Inspired by a blog post<\/a> I found (which I am sure I have referred to in the past too) either of the following will do the trick:<\/p>\n
wmic qfe where \"InstalledOn like '5\/%\/2015'\"<\/pre>\n
-or-\u00a0<\/p>\n
wmic qfe where (InstalledOn like \"5\/%\/2015\")<\/pre>\n
And if you want to format the output with specific fields:<\/p>\n
wmic qfe where \"InstalledOn like '5\/%\/2015'\" get Caption,Description,HotfixID,InstalledOn<\/pre>\n
Which results in something along these lines:<\/p>\n
Caption                                     Description      HotFixID   InstalledOn\r\nhttp:\/\/support.microsoft.com\/?kbid=3013531  Update           KB3013531  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3013538  Update           KB3013538  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3015696  Update           KB3015696  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3020370  Update           KB3020370  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3021910  Update           KB3021910  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3022345  Update           KB3022345  5\/16\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3023222  Security Update  KB3023222  5\/13\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3032663  Security Update  KB3032663  5\/13\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3033446  Update           KB3033446  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3037924  Update           KB3037924  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3038002  Update           KB3038002  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3038562  Update           KB3038562  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3038701  Hotfix           KB3038701  5\/17\/2015\r\nhttp:\/\/support.microsoft.com\/?kbid=3043812  Update           KB3043812  5\/17\/2015<\/pre>\n
This includes Updates, Hotfixes, and Security Updates. If you want to filter down further, that too is possible (just mentioning these as a reference to my future self). Do a specific match:<\/p>\n
wmic qfe where \"InstalledOn like '5\/%\/2015' and Description = 'Update'\" get Caption,Description,HotfixID,InstalledOn<\/pre>\n
Or a wildcard:<\/p>\n
wmic qfe where \"InstalledOn like '5\/%\/2015' and Description like '%Update'\" get Caption,Description,HotfixID,InstalledOn<\/pre>\n
Or a negation:<\/p>\n
wmic qfe where \"InstalledOn like '5\/%\/2015' and Description != 'Hotfix'\" get Caption,Description,HotfixID,InstalledOn<\/pre>\n
These two links (WQL<\/a> and WHERE<\/a> clauses) were of use in picking up the WQL syntax. They are not very explanatory but you get an idea by trial and error. Once I had picked up the syntax I came across this about_WQL<\/a> page that’s part of the PowerShell documentation and explains WQL operators.\u00a0Linking to it here as a reference to myself and others.\u00a0<\/p>\n
Unlike PowerShell I don’t know how to make WMIC use a greater than operator and simply specify the date. I tried something like this (updates installed after 12th May 2015):<\/p>\n
wmic qfe where \"InstalledOn > '5\/12\/2015' and Description != 'Hotfix'\" get Caption,Description,HotfixID,InstalledOn<\/pre>\n
But the results include some updates from 2013 & 2014 too. Not sure what’s wrong and I am not in the mood to troubleshoot at the moment. The like<\/code> operator does the trick well for me currently.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
In a previous post I gave a DISM command to get a list of installed Windows Updates: dism \/online \/Get-Packages \/Format:Table While useful that command has no option of filtering results based on some criteria.\u00a0 If you are on Windows 8 or above the Get-WindowsPackage cmdlet can be of use: Get-WindowsPackage -Online | ?{ $_.InstallTime … Continue reading Get a list of recently installed Windows updates via the command line<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[85],"tags":[227,441,38,226,516],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2520"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=2520"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2520\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=2520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=2520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=2520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}