Update Compliance - Query on Specific Security Updates

[Simeon_Hemus]

I'm just trialling out Update Compliance and i can't seem to find any specific queries that i can put into the Log Analytics to return what security updates are actually installed on the computers that are reporting to "Update Compliance".

Microsoft send us emails about all of the Critical updates we need to have installed on our desktop fleet but how do you know if these updates are actually installed if it doesn't actually tell you what KB Updates are installed or not. It appears that Update Compliance only reports on whether the computer is up-to-date according to what the update ring is configured, so this is taking into account the Service Channel & the Quality update deferral period, so if there is a new Critical Microsoft Update, it doesn't get installed until the deferral date expires on that update ring.

So am i missing something? Is there a way to actually verify whether a particular update has been installed using Update Compliance?

[#2 · Accepted solution]

Hello Simeon, WaaSDeploymentStatus contains "ReleaseName" which is KB article: schema here. You should be able to query for that. :)

[#3]

Thanks Aria,
I'll check this out.

[#4]

For anyone that wants to know what the specific query is to search all computers for a specific update to find out whether it is installed or not, here it is:

WaaSDeploymentStatus

| where ReleaseName startswith "KB4560960" and TimeGenerated > ago(30d)

| summarize arg_max(ReleaseName, DeploymentStatus) by Computer

I found this website which has got a list of queries which is quite helpful:

https://www.configjon.com/update-compliance-log-analytics-queries/

[#5]

I have another issue with Update Compliance now,

After a month or so since i deployed the Update Compliance Script on several computers, which configures several Registry Settings of which one of them is the CommecialId of my Log Analytics Workspace in registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\CommercialId

I am now finding that some of the computers have lost this Commercial ID Registry setting and i have to redeploy the Update Compliance Script.  Does anyone know what is going on here?

Also after i have redeployed it, there may be some other issues because now it doesn't seem to be updating the WorkSpace with the latest information of the update status, as an example i've updated my computer and it is fully up-to-date, but in the Update Compliance Dashboard it is showing the computer as not-up-to-date.  Any Troubelshooting steps or articles that people have would be helpful.  Thanks,