{"id":3538,"date":"2017-05-13T16:08:45","date_gmt":"2017-05-13T12:08:45","guid":{"rendered":"https:\/\/rakhesh.com\/?p=3538"},"modified":"2017-05-13T16:08:45","modified_gmt":"2017-05-13T12:08:45","slug":"scanning-for-ms17-010","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/powershell\/scanning-for-ms17-010\/","title":{"rendered":"Scanning for MS17-010"},"content":{"rendered":"<p>Was reading about the WannaCrypt attacks. <a href=\"https:\/\/blogs.technet.microsoft.com\/msrc\/2017\/05\/12\/customer-guidance-for-wannacrypt-attacks\/\">If you have the MS17-010 bulletin patches<\/a> installed in your estate, you are safe. I wanted to quickly scan our estate to see if the servers are patches with this. Not my job really, but I wanted to do it anyways.\u00a0<\/p>\n<p>The security <a href=\"https:\/\/technet.microsoft.com\/en-us\/library\/security\/ms17-010.aspx\">bulletin page<\/a> lists the actual patch numbers for each version of Windows. We only have Server 2008 &#8211; 2016 so that&#8217;s all I was interested in.\u00a0<\/p>\n<p>Here&#8217;s a list of the Server name, internal version, and the patch they should have.<\/p>\n<ul>\n<li>Server 2008 | 6.0.6002 | KB4012598<\/li>\n<li>Server 2008 R2 | 6.1.7600 | KB4012215 or KB4012212<\/li>\n<li>Server 2012 | 6.2.9200 | KB4012214 or KB4012217<\/li>\n<li>Server 2012 R2 | 6.3.9600 | KB4012213 or KB4012216<\/li>\n<li>Server 2016 | 10.0.14393 | KB4013429<\/li>\n<\/ul>\n<p>One thing to bear in mind is that it&#8217;s possible a server doesn&#8217;t have the exact patch installed, but is still not at any risk. That is because <a href=\"https:\/\/blogs.technet.microsoft.com\/windowsitpro\/2016\/08\/15\/further-simplifying-servicing-model-for-windows-7-and-windows-8-1\/\">since October 2016 Windows patches are cumulative<\/a>. So if you don&#8217;t have the particular March 2017 patch installed, but do have the April 2017 one, you are good to go. The numbers above are from March 2017 &#8211; so you will have to update them with patch numbers of subsequent months too to be thorough.\u00a0<\/p>\n<p>Another thing &#8211; I had one server in my entire estate where the patch above was actually installed but turned up as a false positive in my script. Not sure why. I know it isn&#8217;t a script issue. For some reason that patch wasn&#8217;t being returned as part of the &#8220;Win32_QuickFixEngineering&#8221; output. Am assuming it wasn&#8217;t installed that way on this particular server.<\/p>\n<p>Without further ado, here&#8217;s the script I wrote:<\/p>\n<pre class=\"lang:ps decode:true \">Get-ADComputer -SearchBase \"OU=Servers,DC=myDomain,DC=com\" -Filter * | \r\n  ?{ Test-Connection $_.Name -Quiet -Count 1 } | \r\n  %{\r\n    $Computer = $_.Name\r\n    $WinVer = (Get-WmiObject Win32_OperatingSystem -CN $Computer).Version\r\n    \r\n    switch ($WinVer) {\r\n      '6.0.6002' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter \"HotFixID='KB4012598'\" | Measure-Object).Count -eq 0) { \"$Computer | Server 2008 | Missing KB4012598 \"} }\r\n      '6.1.7600' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter \"HotFixID='KB4012215' or HotFixID='KB4012212'\" | Measure-Object).Count -eq 0) { \"$Computer | Server 2008 R2 | Missing KB4012212 or KB4012215 \"} }\r\n      '6.2.9200' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter \"HotFixID='KB4012214' or HotFixID='KB4012217'\" | Measure-Object).Count -eq 0) { \"$Computer | Server 2012 | Missing KB4012214 or KB4012217 \"} }\r\n      '6.3.9600' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter \"HotFixID='KB4012213' or HotFixID='KB4012216'\" | Measure-Object).Count -eq 0) { \"$Computer | Server 2012 R2 | Missing KB4012213 or KB4012216 \"} }\r\n      '10.0.14393' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter \"HotFixID='KB4013429'\" | Measure-Object).Count -eq 0) { \"$Computer | Server 2016 | Missing KB4013429 \"} }\r\n    }\r\n  }<\/pre>\n<p>That&#8217;s all. Nothing fancy.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Was reading about the WannaCrypt attacks. If you have the MS17-010 bulletin patches installed in your estate, you are safe. I wanted to quickly scan our estate to see if the servers are patches with this. Not my job really, but I wanted to do it anyways.\u00a0 The security bulletin page lists the actual patch &hellip; <a href=\"https:\/\/rakhesh.com\/powershell\/scanning-for-ms17-010\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Scanning for MS17-010<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[2,85],"tags":[227,744,38],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3538"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=3538"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3538\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=3538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=3538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=3538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}