PowerTip: Find Windows Hotfixes Installed After a Certain Date

Summary: Use Windows PowerShell to find hotfixes installed on your laptop running Windows 8 that were installed after a certain date.

Hey, Scripting Guy! Question How can I find Windows hotfixes installed after a certain date on my Windows 8 laptop by using Windows PowerShell?

Hey, Scripting Guy! Answer Use the Get-Hotfix function to return installed hotfixes on your Windows 8 laptop, and pipe the results to the Where-Object cmdlet and filter by the installedon property. The following illustrates this technique (? is an alias for the Where-Object cmdlet).

12:35 C:\> Get-HotFix | ? installedon -gt 1/15/2013

Source        Description      HotFixID      InstalledBy          InstalledOn

------        -----------      --------      -----------          -----------

EDLT          Update           KB2803748     NT AUTHORITY\SYSTEM  1/22/2013 12:00...

Comments (12)

  1. mredwilson says:

    @Thomas yes Get-Hotfix works on anything with PowerShell 2.0 installed on. So it works by default on Windows 7, Windows Server 20008 R2 and of course Windows 8 and Windows SErver 2012.

  2. mredwilson says:

    My 1/15/2013 is EN-US date time format. You can use the date time format that is appropriate for your culture, and PowerShell will automatically convert it to a datetime object for you.

  3. thomas says:

    Does this work on other OS besides Windows 8?  Say Server 2008 R2 or Win 7 or Server 2012?

  4. marius says:

    Requires powershell 2.0 for the get-hotfix cmdlet. 🙂

  5. IL says:

    Why does it show hotfixes installed on 9/1/2013?

    PS E:> Get-HotFix | where { $_.installedon -gt "01/15/2013"}

    Source        Description      HotFixID      InstalledBy          InstalledOn

    ——        ———–      ——–      ———–          ———–

    FLAWLESS      Security Update  KB2736422     NT AUTHORITYSYSTEM  01.09.2013…

    FLAWLESS      Security Update  KB2742599     NT AUTHORITYSYSTEM  01.09.2013…

    FLAWLESS      Security Update  KB2756921     NT AUTHORITYSYSTEM  01.09.2013…

    FLAWLESS      Security Update  KB2757638     NT AUTHORITYSYSTEM  01.09.2013…

    FLAWLESS      Security Update  KB2769369     NT AUTHORITYSYSTEM  01.09.2013…

    FLAWLESS      Security Update  KB2778930     NT AUTHORITYSYSTEM  01.09.2013…

    FLAWLESS      Security Update  KB2785220     NT AUTHORITYSYSTEM  01.09.2013…

    FLAWLESS      Update           KB2786081     NT AUTHORITYSYSTEM  01.09.2013…

    Perhaps it is a date to string conversion effect. How to place the date immune to system locale? May be something like 20130115 or convert(datetime, "20130115").

  6. JV says:


    Think about what teh date you used means. -gt "01/15/2013"  is any time after midnight on 1-13.  Any installation that occurred from 00:00:00 on will be included.  YOu need to add one day or specify the time.


    look at the time field.  It will be 12:00AM

  7. IL says:

    @JV Thank you, but

    Get-HotFix | where { $_.installedon -gt [datetime]'01/15/2013'}

    does the same. What time should I specify to make it work in case I don't really need to filter by time just by date?

  8. JV says:


    01.09.2013 is a European format for September 1 2013.  This is clearly greater than 1-13-2013.

  9. IL says:

    @JV Thank you! I haven't noticed the time jump into September 2013! I was thinking about September 2012. It is very strange to have such a thing I guess. In fact the command just detected it.

  10. Cue says:


    I need your help to check if multiple KB installed on list of remote server

  11. Topaz Paul says:

    A PowerShell script to list all installed Microsoft Windows Updates.


    Why use this script?

    The PowerShell cmdlet ‘get-hotfix’ sometimes does not draw-out ‘installedon’ information. win32-Quickfixengineering class does not have that information either.

    What does this script offer?

    The above void can be filled by using the good old ‘wmic qfe list’ command. But, the output of the legacy command is mere text and cannot be easily interrogated like objects in PowerShell.

    The attached script converts the output string of ‘wmic qfe list’ command into versatile PowerShell objects, which can be used within other scripts.

  12. Dominik says:

    the cmdlet unfortunately "is bugged", meaning it does not work correctly regarding the "InstalledOn" property on Clients using any other regional setting than "en-US".

    To fix this problem, use the following command-line (example – posted by Peter Jurgens on

    PS C:> Get-HotFix | select hotfixid,@{l="InstalledOn";e={[DateTime]::Parse($_.psbase.properties["installedon"].value,$([System.Globalization.CultureInfo]::GetCultureInfo("en-US")))}}

Skip to main content