I'm trying to query accurate Windows Update information on Windows 10
Using the old "Microsoft.Update.Session" method, the data doesn't match what's in the Windows Update UI ("Settings" -> "Updates").
I get the same results with PSWindowsUpdate, i.e. it still doesn't match the UI.
As an example of this, the UI shows:
And PSWindowsUpdate shows (which matches my app):
PS C:\Windows\system32> get-wulist -IsInstalled
ComputerName Status KB Size Title
------------ ------ -- ---- -----
ALFRETON-... -DI---- KB925673 2MB MSXML 6.0 RTM Security Update (925673)
ALFRETON-... -DI---- KB4052623 5MB Update for Windows Defender Antivirus antimalware platform - KB4052623 (Version 4.18.2001.10)
ALFRETON-... -DI---- 22MB Windows Subsystem for Linux Update - 5.4.72
ALFRETON-... -DI---- KB890830 34MB Windows Malicious Software Removal Tool x64 - v5.91 (KB890830)
ALFRETON-... -DI---- KB4052623 6MB Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.2106.6)
ALFRETON-... -DI---- KB2267602 804MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.343.1110.0)
ALFRETON-... --I---- KB4023057 3MB 2021-06 Update for Windows 10 Version 21H1 for x64-based Systems (KB4023057)
ALFRETON-... -DI---- KB5004237 103GB 2021-07 Cumulative Update for Windows 10 Version 21H1 for x64-based Systems (KB5004237)
My thought was to try and use the Updates CSP in MDM, as I've had a lot of luck with MDM interfaces being better in Windows 10 than anything else.
However, when using the MDM bridge, the query endpoints return nothing:
=====================================
CLASS : MDM_DeviceUpdateCenter_Enrollment01
=====================================
=====================================
CLASS : MDM_Policy_Config01_Update02
=====================================
=====================================
CLASS : MDM_Policy_Result01_Update02
=====================================
ActiveHoursEnd : 17
ActiveHoursMaxRange : 18
ActiveHoursStart : 8
AllowAutoUpdate : 6
AllowAutoWindowsUpdateDownloadOverMeteredNetwork : 0
AllowMUUpdateService : 0
AllowNonMicrosoftSignedUpdate : 1
AllowUpdateService : 1
AutomaticMaintenanceWakeUp : 1
AutoRestartDeadlinePeriodInDays : 7
AutoRestartDeadlinePeriodInDaysForFeatureUpdates : 7
AutoRestartNotificationSchedule : 15
AutoRestartRequiredNotificationDismissal : 1
BranchReadinessLevel : 16
ConfigureDeadlineForFeatureUpdates : 7
ConfigureDeadlineForQualityUpdates : 7
ConfigureDeadlineGracePeriod : 2
ConfigureDeadlineGracePeriodForFeatureUpdates : 2
ConfigureDeadlineNoAutoReboot : 0
ConfigureFeatureUpdateUninstallPeriod : 10
DeferFeatureUpdatesPeriodInDays : 0
DeferQualityUpdatesPeriodInDays : 0
DeferUpdatePeriod : 0
DeferUpgradePeriod : 0
DetectionFrequency : 22
DisableDualScan : 0
DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection : 0
EngagedRestartDeadline : 14
EngagedRestartDeadlineForFeatureUpdates : 14
EngagedRestartSnoozeSchedule : 3
EngagedRestartSnoozeScheduleForFeatureUpdates : 3
EngagedRestartTransitionSchedule : 7
EngagedRestartTransitionScheduleForFeatureUpdates : 7
ExcludeWUDriversInQualityUpdate : 0
FillEmptyContentUrls : 0
IgnoreMOAppDownloadLimit : 0
IgnoreMOUpdateDownloadLimit : 0
InstanceID : Update
ManagePreviewBuilds : 3
ParentID : ./Vendor/MSFT/Policy/Result
PauseDeferrals : 0
PauseFeatureUpdates : 0
PauseFeatureUpdatesStartTime :
PauseQualityUpdates : 0
PauseQualityUpdatesStartTime :
PhoneUpdateRestrictions : 4
RequireDeferUpgrade : 0
RequireUpdateApproval : 0
ScheduledInstallDay : 0
ScheduledInstallEveryWeek : 1
ScheduledInstallFirstWeek : 0
ScheduledInstallFourthWeek : 0
ScheduledInstallSecondWeek : 0
ScheduledInstallThirdWeek : 0
ScheduledInstallTime : 3
ScheduleImminentRestartWarning : 15
ScheduleRestartWarning : 4
SetAutoRestartNotificationDisable : 0
SetDisablePauseUXAccess : 0
SetDisableUXWUAccess : 0
SetEDURestart : 0
SetProxyBehaviorForUpdateDetection : 0
TargetReleaseVersion :
UpdateNotificationLevel : 0
UpdateServiceUrl : CorpWSUS
UpdateServiceUrlAlternate :
=====================================
CLASS : MDM_Update
=====================================
=====================================
CLASS : MDM_Update_ApprovedUpdates01_01
=====================================
=====================================
CLASS : MDM_Update_FailedUpdates01_01
=====================================
=====================================
CLASS : MDM_Update_InstallableUpdates01_01
=====================================
=====================================
CLASS : MDM_Update_PendingRebootUpdates01_01
=====================================
=====================================
CLASS : MDM_Update_Rollback01
=====================================
Fetched using this script:
param( [string]$OutFile = "c:\temp\winupdate_debug.txt")
[string]$computer = $env:COMPUTERNAME
[string]$namespace = "ROOT\CIMV2\mdm\dmmap"
[string[]]$classnames = @("MDM_DeviceUpdateCenter_Enrollment01", "MDM_Policy_Config01_Update02", "MDM_Policy_Result01_Update02", "MDM_Update", "MDM_Update_ApprovedUpdates01_01", "MDM_Update_FailedUpdates01_01"
,"MDM_Update_InstallableUpdates01_01", "MDM_Update_PendingRebootUpdates01_01", "MDM_Update_Rollback01")
$Error.Clear()
$ErrorActionPreference = "Stop"
foreach ($classname in $classnames) {
try {
"=====================================" | Out-file $OutFile -Force -Append -Encoding ascii
"CLASS : $classname " | Out-file $OutFile -Force -Append -Encoding ascii
"=====================================" | Out-file $OutFile -Force -Append -Encoding ascii
Get-WmiObject -Class $classname -Namespace $namespace `
|Select-Object * -ExcludeProperty PSComputerName, Scope, Path, Options, ClassPath, Properties, SystemProperties, Qualifiers, Site, Container `
| Format-List -Property [a-z]* | Out-file $OutFile -Force -Append -Encoding ascii
}
catch [System.Management.ManagementException] {
# ignore - class not found because it is not populated
}
catch {
$Error[0]
$Error[0].Exception.GetType().fullname | fl * | Out-file $OutFile -Force -Append -Encoding ascii
}
}
Why are the MDM endpoints not returning any data?
Or, does anyone know why the Windows Update results don't match the UI?
