# Find unpatched servers.

**URL:** <https://forums.powershell.org/t/find-unpatched-servers/8642>\
**Category:** PowerShell Help\
**Created:** [May 17, 2017, 2:20am UTC](https://forums.powershell.org/t/find-unpatched-servers/8642 "2017-05-17T02:20:15Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![johan-hammarstrom](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@johan-hammarstrom](https://forums.powershell.org/u/johan-hammarstrom)\
**Post date:** [May 17, 2017, 2:20am UTC](https://forums.powershell.org/t/find-unpatched-servers/8642/1 "2017-05-17T02:20:15Z")

</div>

Hi Admins,

I would like to have a powershell script that scans my servers for patches and give me a list which I can work from.  
Im having trouble to understand how I can get the servername next to my patch info.  
This is what I have so far.  
Advice ?

$servers = Get-adcomputer -filter {((name -like “t-web\*”) -or (name -like “crs\*”)) } | select name -ExpandProperty name

$session = New-PSSession -ComputerName $servers  
Invoke-Command -ScriptBlock {  
$hotfixes = “KB4012212”, “KB4012212”, “KB4012213”, “KB4012213”, “KB4012214”, “KB4012215”, “KB4012215”, “KB4012216”, “KB4012216”, “KB4012217”, “KB4012219”, “KB4012220”, “KB4012598”, “KB4012598”, “KB4012598”, “KB4012598”, “KB4012598”, “KB4012606”, “KB4013198”, “KB4013429”, “KB4013429”, “KB4015217”, “KB4015438”, “KB4015549”, “KB4015550”, “KB4015550”, “KB4015551”, “KB4015553”, “KB4015554”, “KB4016635”, “KB4019215”, “KB4019215”, “KB4019216”, “KB4019264”, “KB4019264”, “KB4019472”

$hotfix = Get-HotFix | Where-Object {$hotfixes -contains $\_.HotfixID} | Select-Object -property “HotFixID”

if (Get-HotFix | Where-Object {$hotfixes -contains $\_.HotfixID}) { "Found HotFix: " + $hotfix.HotFixID }  
else { “Did not Find HotFix” }

```
           } -Session $session
           #Disconnect all sessions
           Remove-PSSession $session

```

---

<div class="post-metadata">

**Author:** ![max-kozlov](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@max-kozlov](https://forums.powershell.org/u/max-kozlov)\
**Post date:** [May 17, 2017, 5:20am UTC](https://forums.powershell.org/t/find-unpatched-servers/8642/2 "2017-05-17T05:20:29Z")

</div>

one of dozen possible variants

```
Invoke-Command -ScriptBlock {
 $hotfixes = "KB4012212", "KB4012212", "KB4012213", "KB4012213", "KB4012214", "KB4012215", "KB4012215", "KB4012216", "KB4012216", "KB4012217", "KB4012219", "KB4012220", "KB4012598", "KB4012598", "KB4012598", "KB4012598", "KB4012598", "KB4012606", "KB4013198", "KB4013429", "KB4013429", "KB4015217", "KB4015438", "KB4015549", "KB4015550", "KB4015550", "KB4015551", "KB4015553", "KB4015554", "KB4016635", "KB4019215", "KB4019215", "KB4019216", "KB4019264", "KB4019264", "KB4019472" 

$idlist = Get-HotFix | Where-Object {$hotfixes -contains $_.HotfixID} | Select-Object -expandproperty "HotFixID"
foreach ($fixid in $hotfixes) {
  if ($idlist -contains $fixid) { "$ENV:ComputerName connains $fixid " }
  else { "$ENV:ComputerName not connains $fixid " }
}
} -Session $session
```

---

<div class="post-metadata">

**Author:** ![johan-hammarstrom](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@johan-hammarstrom](https://forums.powershell.org/u/johan-hammarstrom)\
**Post date:** [May 17, 2017, 6:02am UTC](https://forums.powershell.org/t/find-unpatched-servers/8642/3 "2017-05-17T06:02:46Z")

</div>

Hi Max,

Thanks for the swift reply.  
One step forward, but with your script I get information if a server is missing any of the patches.  
If any of the patches in $hotfix is installed the server is ok.

You understand what mean? Something you could help me with?

Output from “your” script

WEB03-01 connains KB4019215  
WEB03-01 connains KB4019215  
WEB03-01 not connains KB4019216  
WEB03-01 not connains KB4019264  
WEB03-01 not connains KB4019264  
WEB03-01 not connains KB4019472

Regards  
JOhan

---

<div class="post-metadata">

**Author:** ![max-kozlov](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@max-kozlov](https://forums.powershell.org/u/max-kozlov)\
**Post date:** [May 17, 2017, 6:43am UTC](https://forums.powershell.org/t/find-unpatched-servers/8642/4 "2017-05-17T06:43:06Z")

</div>

np

```
Invoke-Command -ScriptBlock {
$hotfixes = "KB4012212", "KB4012212", "KB4012213", "KB4012213", "KB4012214", "KB4012215", "KB4012215", "KB4012216", "KB4012216",
"KB4012217", "KB4012219", "KB4012220", "KB4012598", "KB4012598", "KB4012598", "KB4012598", "KB4012598", "KB4012606", "KB4013198",
"KB4013429", "KB4013429", "KB4015217", "KB4015438", "KB4015549", "KB4015550", "KB4015550", "KB4015551", "KB4015553", "KB4015554",
"KB4016635", "KB4019215", "KB4019215", "KB4019216", "KB4019264", "KB4019264", "KB4019472"

 $idlist = Get-HotFix | Where-Object {$hotfixes -contains $_.HotfixID} | Select-Object -expandproperty "HotFixID"
 $foundfix = ''
 foreach ($fixid in $hotfixes) {
   if ($idlist -contains $fixid) { $foundfix = $fixid; break }
 }
 if ($foundfix -eq '') { "$ENV:ComputerName contains no fixes" } else { "$ENV:ComputerName contains $foundfix " }
} -Session $session
```

---

<div class="post-metadata">

**Author:** ![johan-hammarstrom](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@johan-hammarstrom](https://forums.powershell.org/u/johan-hammarstrom)\
**Post date:** [May 17, 2017, 6:52am UTC](https://forums.powershell.org/t/find-unpatched-servers/8642/5 "2017-05-17T06:52:31Z")

</div>

Works like a charm!  
Many thanks!

//Johan

---

<div class="post-metadata">

**Author:** ![johan-hammarstrom](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@johan-hammarstrom](https://forums.powershell.org/u/johan-hammarstrom)\
**Post date:** [May 17, 2017, 7:00am UTC](https://forums.powershell.org/t/find-unpatched-servers/8642/6 "2017-05-17T07:00:58Z")

</div>

Arrrrggg! your script works great but now I ran into another problem.  
According to script many of my servers don’t have any of the patches installed.

When I log into the servers and run get-hotfix I don’t see the latest hotfixes…  
But if I use the gui I can see that they are in fact installed.

Must be some kind of bug.  
Time to google.

---

<div class="post-metadata">

**Author:** ![max-kozlov](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@max-kozlov](https://forums.powershell.org/u/max-kozlov)\
**Post date:** [May 17, 2017, 7:13am UTC](https://forums.powershell.org/t/find-unpatched-servers/8642/7 "2017-05-17T07:13:58Z")

</div>

may be superceded ?  
and may be you need a WSUS ?  
there is a excelent module for wsus [GitHub - proxb/PoshWSUS: PowerShell module to manage Windows Server Update Services (WSUS)](https://github.com/proxb/PoshWSUS)

---

<div class="post-metadata">

**Author:** ![johan-hammarstrom](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@johan-hammarstrom](https://forums.powershell.org/u/johan-hammarstrom)\
**Post date:** [May 17, 2017, 7:51am UTC](https://forums.powershell.org/t/find-unpatched-servers/8642/8 "2017-05-17T07:51:42Z")

</div>

Not superseded  
Wish I could upload an image but I don’t find any option to do so?  
Seems to be many others who have the same problem, on random servers the installdate property is blank and therefor you dont see the patches when you run get-hotfix (if I understand it correctly)  
Have no idea why.

Anyway , with your script I’ve saved many hours 🙂

Regards  
JOhan

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:38pm UTC](https://forums.powershell.org/t/find-unpatched-servers/8642/9 "2024-05-16T20:38:45Z")

</div>