Forum Discussion

Simeon_Hemus's avatar
Simeon_Hemus
Copper Contributor
Jun 09, 2020
Solved

Update Compliance - Query on Specific Security Updates

I'm just trialling out Update Compliance and i can't seem to find any specific queries that i can put into the Log Analytics to return what security updates are actually installed on the computers th...
  • AriaUpdated's avatar
    AriaUpdated
    Jun 25, 2020

    Hello Simeon, WaaSDeploymentStatus contains "ReleaseName" which is KB article: schema here. You should be able to query for that. 🙂

AriaUpdated's avatar
AriaUpdated
Icon for Microsoft rankMicrosoft
Jun 25, 2020

Hello Simeon, WaaSDeploymentStatus contains "ReleaseName" which is KB article: schema here. You should be able to query for that. 🙂

  • Simeon_Hemus's avatar
    Simeon_Hemus
    Copper Contributor
    Jul 17, 2020

    For anyone that wants to know what the specific query is to search all computers for a specific update to find out whether it is installed or not, here it is:

     

    WaaSDeploymentStatus
    | where ReleaseName startswith "KB4560960" and TimeGenerated > ago(30d)
    | summarize arg_max(ReleaseName, DeploymentStatus) by Computer
     
    I found this website which has got a list of queries which is quite helpful:
    https://www.configjon.com/update-compliance-log-analytics-queries/
    • Simeon_Hemus's avatar
      Simeon_Hemus
      Copper Contributor
      Aug 10, 2020

      I have another issue with Update Compliance now,

      After a month or so since i deployed the Update Compliance Script on several computers, which configures several Registry Settings of which one of them is the CommecialId of my Log Analytics Workspace in registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\CommercialId

      I am now finding that some of the computers have lost this Commercial ID Registry setting and i have to redeploy the Update Compliance Script.  Does anyone know what is going on here?

      Also after i have redeployed it, there may be some other issues because now it doesn't seem to be updating the WorkSpace with the latest information of the update status, as an example i've updated my computer and it is fully up-to-date, but in the Update Compliance Dashboard it is showing the computer as not-up-to-date.  Any Troubelshooting steps or articles that people have would be helpful.  Thanks,

  • Simeon_Hemus's avatar
    Simeon_Hemus
    Copper Contributor
    Jun 25, 2020
    Thanks Aria,
    I'll check this out.

Resources