In a previous post I gave a DISM command to get a list of installed Windows Updates:
dism /online /Get-Packages /Format:Table
While useful that command has no option of filtering results based on some criteria.
If you are on Windows 8 or above the Get-WindowsPackage cmdlet can be of use:
Get-WindowsPackage -Online | ?{ $_.InstallTime -gt [datetime]::now.AddDays(-15) }
This gets me all updates installed in the last 15 days.
Another alternative (on pre-Windows 8 machines) is good ol’ WMIC:
wmic qfe
The above gives output similar to this:
Caption CSName Description FixComments HotFixID InstallDate Instal ledBy InstalledOn Name ServicePackInEffect Status http://support.microsoft.com/kb/2899189 GAIA Update KB2899189_Microsoft-Windows-CameraCodec-Package NT AUT HORITY\SYSTEM 3/22/2014 http://support.microsoft.com/?kbid=2843630 GAIA Update KB2843630 NT AUT HORITY\SYSTEM 3/22/2014 http://support.microsoft.com/?kbid=2868626 GAIA Security Update KB2868626 NT AUT HORITY\SYSTEM 3/22/2014 http://support.microsoft.com/?kbid=2883200 GAIA Update KB2883200 GAIA\A dministrator 9/30/2013 http://support.microsoft.com/?kbid=2887595 GAIA Update KB2887595 NT AUT HORITY\SYSTEM 3/22/2014 ...
For more details more switches can be used:
wmic qfe list full
Result is:
Caption=http://support.microsoft.com/kb/2899189 CSName=GAIA Description=Update FixComments= HotFixID=KB2899189_Microsoft-Windows-CameraCodec-Package InstallDate= InstalledBy=NT AUTHORITY\SYSTEM InstalledOn=3/22/2014 Name= ServicePackInEffect= Status= Caption=http://support.microsoft.com/?kbid=2843630 CSName=GAIA Description=Update FixComments= HotFixID=KB2843630 InstallDate= InstalledBy=NT AUTHORITY\SYSTEM InstalledOn=3/22/2014 Name= ServicePackInEffect= Status= Caption=http://support.microsoft.com/?kbid=2868626 CSName=GAIA Description=Security Update FixComments= HotFixID=KB2868626 InstallDate= InstalledBy=NT AUTHORITY\SYSTEM InstalledOn=3/22/2014 Name= ServicePackInEffect= Status= ...
This output also gives an idea of the criteria available.
So how can I filter this output like I did with PowerShell? Easy – use WQL (WMIC Query Language). Inspired by a blog post I found (which I am sure I have referred to in the past too) either of the following will do the trick:
wmic qfe where "InstalledOn like '5/%/2015'"
-or-
wmic qfe where (InstalledOn like "5/%/2015")
And if you want to format the output with specific fields:
wmic qfe where "InstalledOn like '5/%/2015'" get Caption,Description,HotfixID,InstalledOn
Which results in something along these lines:
Caption Description HotFixID InstalledOn http://support.microsoft.com/?kbid=3013531 Update KB3013531 5/17/2015 http://support.microsoft.com/?kbid=3013538 Update KB3013538 5/17/2015 http://support.microsoft.com/?kbid=3015696 Update KB3015696 5/17/2015 http://support.microsoft.com/?kbid=3020370 Update KB3020370 5/17/2015 http://support.microsoft.com/?kbid=3021910 Update KB3021910 5/17/2015 http://support.microsoft.com/?kbid=3022345 Update KB3022345 5/16/2015 http://support.microsoft.com/?kbid=3023222 Security Update KB3023222 5/13/2015 http://support.microsoft.com/?kbid=3032663 Security Update KB3032663 5/13/2015 http://support.microsoft.com/?kbid=3033446 Update KB3033446 5/17/2015 http://support.microsoft.com/?kbid=3037924 Update KB3037924 5/17/2015 http://support.microsoft.com/?kbid=3038002 Update KB3038002 5/17/2015 http://support.microsoft.com/?kbid=3038562 Update KB3038562 5/17/2015 http://support.microsoft.com/?kbid=3038701 Hotfix KB3038701 5/17/2015 http://support.microsoft.com/?kbid=3043812 Update KB3043812 5/17/2015
This includes Updates, Hotfixes, and Security Updates. If you want to filter down further, that too is possible (just mentioning these as a reference to my future self). Do a specific match:
wmic qfe where "InstalledOn like '5/%/2015' and Description = 'Update'" get Caption,Description,HotfixID,InstalledOn
Or a wildcard:
wmic qfe where "InstalledOn like '5/%/2015' and Description like '%Update'" get Caption,Description,HotfixID,InstalledOn
Or a negation:
wmic qfe where "InstalledOn like '5/%/2015' and Description != 'Hotfix'" get Caption,Description,HotfixID,InstalledOn
These two links (WQL and WHERE clauses) were of use in picking up the WQL syntax. They are not very explanatory but you get an idea by trial and error. Once I had picked up the syntax I came across this about_WQL page that’s part of the PowerShell documentation and explains WQL operators. Linking to it here as a reference to myself and others.
Unlike PowerShell I don’t know how to make WMIC use a greater than operator and simply specify the date. I tried something like this (updates installed after 12th May 2015):
wmic qfe where "InstalledOn > '5/12/2015' and Description != 'Hotfix'" get Caption,Description,HotfixID,InstalledOn
But the results include some updates from 2013 & 2014 too. Not sure what’s wrong and I am not in the mood to troubleshoot at the moment. The like operator does the trick well for me currently.