Use PowerShell to Find Hotfixes Installed in Time Range


Summary: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to find hotfixes that were installed during a certain time range.

Hey, Scripting Guy! Question Hey, Scripting Guy!

I have a problem at work. It seems there was a hotfix that was installed in the last couple of months that is causing problems with the video driver on a certain model of computer. Unfortunately, the problem has been somewhat erratic, and due to holidays, the users have been slow to report the issue. So I do not have exact information as to when the hotfix was installed. I only have a time frame, so to speak.

I know that the update occurred sometime after Halloween, and sometime before Thanksgiving. So, it is like a six week window that I need to look into. I also know that the most recent round of hotfixes have no relationship to the problem, so I can exclude them.

I need to look at my computers to see what hotfixes were installed during that time frame. I want to take the hotfixes into the lab and figure out which one is causing the problem so I can get it resolved via support.

Does this make sense? Can you help?

—PM

Hey, Scripting Guy! Answer Hello PM,

Microsoft Scripting Guy, Ed Wilson, is here. One of the reasons we enjoy living in Charlotte is that the winters are mild. It is a beautiful day this morning—cool and crisp, with deep blue skies, and not a cloud in sight. It is a nice day to sit outside on the porch and sip a cup of English Breakfast tea. I added bits of blueberry leaf, strawberry leaf, marshmallow root, lemon grass, and a cinnamon stick to the pot. The result is a nice, rich, and complex flavor that goes well with a toasted whole-grain English muffin, French butter, and homemade grape jam. I have my Surface Pro 3 with me, and am checking the email sent to scripter@microsoft.com.

Yes, PM, it is relatively easy to see what hotfixes have been installed.

Begin with Get-Hotfix

I begin by using the Get-Hotfix cmdlet to return a list of hotfixes that are installed on my system. As I look at the listing, I see that there is an InstalledOn property. This is shown here:

Image of command output

Filter on the InstalledOn property

It was easy enough to return a list of hotfixes by using the Get-HotFix cmdlet. Now, I need to filter out the date range. To do this, I need to pipe the results from the Get-HotFix cmdlet, and use the Where-Object cmdlet to filter on the InstalledOn property.

I have a beginning and an ending date, so I need to use a compound Where filter. I will also use the greater than (-gt) and the less than (-lt) operators. To have both of these operators in effect at the same time, means I need to use another operator—the AND (-and) operator.

The lucky thing for us is that Windows PowerShell does automatic type conversion, so I do not need to cast my date strings (“10/1/2014” and “12/11/2014”) to DateTime objects. So this will simplify my script a bit.

Here is the first part of the operation. I use Get-HotFix to return the hotfixes, and I pipe it to the Where-Object cmdlet so I can do my filtering. I use Where as an alias for the Where-Object because it is a bit shorter.

Get-HotFix |

Where {

Because I am using a compound Where filter, I cannot use the simplified Where-Object syntax. So I need to use the $_ symbol to represent the current object (hotfix entry) in the pipeline. I will examine each of the hotfix entries, look at the InstalledOn property, and see if it falls in my date range.

To determine the date range, I look at the greater than and the less than ranges. Here is what the filter portion looks like:

$_.InstalledOn -gt "10/1/2014" -AND $_.InstalledOn -lt "12/11/2014"

I want to sort the output so it will be easier to read. I once again use the InstalledOn property. The complete script is shown here:

Get-HotFix |

Where {

    $_.InstalledOn -gt "10/1/2014" -AND $_.InstalledOn -lt "12/11/2014" } |

    sort InstalledOn

Here is the script and the associated output:

Image of command output

PM, that is all there is to using Windows PowerShell to find hotfixes that were installed in a specific date range. Join me tomorrow when I will talk about more cool Windows PowerShell stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy 

Comments (6)

  1. GDeans says:

    @george, Sorry I forgot to include the code so here’s an example with just the start date I mentioned before:
    Get-HotFix |
    Where { $_.InstalledOn -gt (Get-Date).AddDays(-14) } |
    sort InstalledOn |
    Export-Csv -NoType "$Env:userprofileDesktopWindows Updates.csv"

  2. GDeans says:

    fwiw, I use this a lot but with a starting date only, -gt (Get-Date).AddDays(-14), since it’s easier to just pull the last few weeks. However, I was creating a COM object to "Microsoft.Update.Session" basically to get a bit more information about the updates
    and running a Select-Object to swap the 1, 2, or 3 of Operation to human readable, but my code seems to run faster than the cmdlet. Is this just because of the difference between the COM object and the underlying WMI query of Get-HotFix?
    @george, to dump the output to a csv you can simply pipe the result to Export-Csv but it will give you some extra columns you may not want from the WMI query results.

  3. OliT says:

    Would be even better if you could pipe your command to a remove command

  4. George says:

    Hi
    is it possible to export the result of this script
    example : excel file csv
    thanks for your feeback
    regards

  5. DanP says:

    I find get-hotfix to be extremely slow. Read the eventlog.

    $filterXML = @’

    ‘@
    $timespan = (get-date).adddays(-30)
    Get-WinEvent -FilterXml $filterXML | ? { $_.timecreated -gt $timespan }

  6. LEWIS says:

    Hey Scripting Guy:
    Have a challenge here, supposed to write a script in order to count the number of days Since the last hotfix.
    Also, need to ouput the result with no decimal positions.
    Could you kindly help?

Skip to main content