Discussion:
Get Date/Time of Last Windows Update
(too old to reply)
carlklammer08
2008-10-01 12:07:01 UTC
Permalink
Hello,

is there a registry key or a WMI query or anything to get the date and time
the system has been updated the last time via Windows Update?

I mean the date/time that is also shown when you open the Windows Update
applet where it says "Updates were installed:" under "Most recent check for
updates:".

I appreciate every hint!

Thank you very much in advance!
Robert Aldwinckle
2008-10-01 19:58:42 UTC
Permalink
Post by carlklammer08
Hello,
is there a registry key or a WMI query or anything to get the date and time
the system has been updated the last time via Windows Update?
I mean the date/time that is also shown when you open the Windows Update
applet where it says "Updates were installed:" under "Most recent check for
updates:".
I appreciate every hint!
Use ProcMon to see if there is a stored value which is read when those
web operations are executed?
Post by carlklammer08
Thank you very much in advance!
Good luck

Robert Aldwinckle
---
carlklammer08
2008-10-02 09:33:02 UTC
Permalink
Hello Robert,

I found the key, with a GMT date and time information in it, which should
normally be easy to read out.
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime"
I can SEE this key using regedit.exe, but when I try to access/read this key
with either BGinfo or via a VBS-Script (WshShell.RegRead) I always get the
error message "KEY DOES NOT EXIST".

I double checked for spelling errors, but could not find any.
This problem seems to exist with all children of the Key "WindowsUpdate", I
cannot get e.g. "SusClientId" (which is a String Value directly below the Key
WindowsUpdate either.

As this is a fresh out-of-the-box installation of Windows Server 2008 (I
also tried it on Vista - same results), there should nothing be wrong with
the permissions to this key (every user has at least "read" permissions as I
see), no permissions have been changed.

I also tried running BGinfo as an Administrator, but it did not help either.
Every other program except for regedit says this key did not exist!

Strange...

Do you or anybody got an idea what causes this?
Robert Aldwinckle
2008-10-02 21:12:39 UTC
Permalink
Post by carlklammer08
Hello Robert,
I found the key, with a GMT date and time information in it, which should
normally be easy to read out.
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime"
I can SEE this key using regedit.exe, but when I try to access/read this key
with either BGinfo or via a VBS-Script (WshShell.RegRead) I always get the
error message "KEY DOES NOT EXIST".
Let's try using PowerShell instead. I'm trying to learn PowerShell
and think that ultimately this could be the best tool for doing this.

Adapting Example 3 from the Help new-psdrive...

new-psdrive -name MyReg -psprovider Registry -root HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\

Is there a space in that AutoUpdate name or was that just an artifact of
line wrap and posting? PS didn't like it like that. Aha. There is a space
so I need to use quotes:

new-psdrive -name MyReg -psprovider Registry -root "HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\"

But now when I use

set-location MyReg:
and
dir

I get nothing?

In contrast when I back up one level to the parent key I get

<PS_Output>

Hive: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUp
\Auto Update\Results

SKC VC Name Property
--- -- ---- --------
0 2 Detect {LastSuccessTime, LastError}
0 2 Download {LastSuccessTime, LastError}
0 2 Install {LastSuccessTime, LastError}
</PS_Output>

So now the only remaining task will be figuring out how to get some details
about those "properties" (which are obviously the Value names that RegEdit
shows under those subkeys).


Good luck

Robert
---
Post by carlklammer08
I double checked for spelling errors, but could not find any.
This problem seems to exist with all children of the Key "WindowsUpdate", I
cannot get e.g. "SusClientId" (which is a String Value directly below the Key
WindowsUpdate either.
As this is a fresh out-of-the-box installation of Windows Server 2008 (I
also tried it on Vista - same results), there should nothing be wrong with
the permissions to this key (every user has at least "read" permissions as I
see), no permissions have been changed.
I also tried running BGinfo as an Administrator, but it did not help either.
Every other program except for regedit says this key did not exist!
Strange...
Do you or anybody got an idea what causes this?
Robert Aldwinckle
2008-10-04 04:18:30 UTC
Permalink
"Robert Aldwinckle" <***@techemail.com> wrote in message news:***@TK2MSFTNGP06.phx.gbl...

...
Post by Robert Aldwinckle
So now the only remaining task will be figuring out how to get some details
about those "properties" (which are obviously the Value names that RegEdit
shows under those subkeys).
Solving that problem showed that I was on the wrong track by making
a "drive" out of a registry branch. ; )

Here's a complete PowerShell "one-liner" solution:

Get-ItemProperty -Path Registry::"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install" | format-list


HTH

Robert
---
MowGreen [MVP]
2008-10-01 20:11:43 UTC
Permalink
Post by carlklammer08
Hello,
is there a registry key or a WMI query or anything to get the date and time
the system has been updated the last time via Windows Update?
I mean the date/time that is also shown when you open the Windows Update
applet where it says "Updates were installed:" under "Most recent check for
updates:".
I appreciate every hint!
Thank you very much in advance!
You're referring to the installation date/time of the latest update(s),
correct ?
Check the ReportingEvents.log located in %windir%\SoftwareDistribution
It records all successful automatically installed updates.


MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
carlklammer08
2008-10-02 12:18:42 UTC
Permalink
Hi,

unfortunately, I cannot see from the logfile you mentioned, when the system
was last time successfully updated (e.g. by reading the last line of the
file or so), because in this file mostly status messages are stored, so I
find it hard to get this exact time stamp.

I have however found a corresponding registry key (see my answer above), the
only problem with this key is that it does not seem to be accessible...

Do you have any suggestions?

Thanks,
carl
Post by MowGreen [MVP]
Post by carlklammer08
Hello,
is there a registry key or a WMI query or anything to get the date and
time the system has been updated the last time via Windows Update?
I mean the date/time that is also shown when you open the Windows Update
applet where it says "Updates were installed:" under "Most recent check
for updates:".
I appreciate every hint!
Thank you very much in advance!
You're referring to the installation date/time of the latest update(s),
correct ?
Check the ReportingEvents.log located in %windir%\SoftwareDistribution
It records all successful automatically installed updates.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
MowGreen [MVP]
2008-10-02 18:43:53 UTC
Permalink
Carl,
{3BEA61A2-F370-4358-8884-95B49A9EE94D} 2008-10-02 10:13:10:468-0700 1 183 101
{D8FF0DD2-641E-4FE0-B5D7-32F23DF78720} 100 0 AutomaticUpdates
Success Content Install Installation Successful: Windows successfully installed the following
Definition Update for Windows Defender - KB915597 (Definition 1.45.124.0)
The Timestamp is right after the CLSID of the downloaded/installed
update package.
I'll check the reg key you posted when I get back from a job I'm heading
off to right now.

MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
Hi,
unfortunately, I cannot see from the logfile you mentioned, when the
system was last time successfully updated (e.g. by reading the last line
of the file or so), because in this file mostly status messages are
stored, so I find it hard to get this exact time stamp.
I have however found a corresponding registry key (see my answer above),
the only problem with this key is that it does not seem to be accessible...
Do you have any suggestions?
Thanks,
carl
Post by MowGreen [MVP]
Post by carlklammer08
Hello,
is there a registry key or a WMI query or anything to get the date
and time the system has been updated the last time via Windows Update?
I mean the date/time that is also shown when you open the Windows
Update applet where it says "Updates were installed:" under "Most
recent check for updates:".
I appreciate every hint!
Thank you very much in advance!
You're referring to the installation date/time of the latest
update(s), correct ?
Check the ReportingEvents.log located in %windir%\SoftwareDistribution
It records all successful automatically installed updates.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
ritesh kumar
2010-11-21 08:56:09 UTC
Permalink
Use the below powershell command to get the last patch date:

(get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)

for windows 2000, you need to replace windows with winnt i.e. \\"server_name\c$\winnt\......
Post by carlklammer08
Hello,
is there a registry key or a WMI query or anything to get the date and time
the system has been updated the last time via Windows Update?
I mean the date/time that is also shown when you open the Windows Update
applet where it says "Updates were installed:" under "Most recent check for
updates:".
I appreciate every hint!
Thank you very much in advance!
Post by Robert Aldwinckle
Use ProcMon to see if there is a stored value which is read when those
web operations are executed?
Good luck
Robert Aldwinckle
---
Post by MowGreen [MVP]
You're referring to the installation date/time of the latest update(s),
correct ?
Check the ReportingEvents.log located in %windir%\SoftwareDistribution
It records all successful automatically installed updates.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
Post by carlklammer08
Hello Robert,
I found the key, with a GMT date and time information in it, which should
normally be easy to read out.
I can SEE this key using regedit.exe, but when I try to access/read this key
with either BGinfo or via a VBS-Script (WshShell.RegRead) I always get the
error message "KEY DOES NOT EXIST".
I double checked for spelling errors, but could not find any.
This problem seems to exist with all children of the Key "WindowsUpdate", I
cannot get e.g. "SusClientId" (which is a String Value directly below the Key
WindowsUpdate either.
As this is a fresh out-of-the-box installation of Windows Server 2008 (I
also tried it on Vista - same results), there should nothing be wrong with
the permissions to this key (every user has at least "read" permissions as I
see), no permissions have been changed.
I also tried running BGinfo as an Administrator, but it did not help either.
Every other program except for regedit says this key did not exist!
Strange...
Do you or anybody got an idea what causes this?
Post by carlklammer08
Hi,
unfortunately, I cannot see from the logfile you mentioned, when the system
was last time successfully updated (e.g. by reading the last line of the
file or so), because in this file mostly status messages are stored, so I
find it hard to get this exact time stamp.
I have however found a corresponding registry key (see my answer above), the
only problem with this key is that it does not seem to be accessible...
Do you have any suggestions?
Thanks,
carl
Post by MowGreen [MVP]
Carl,
The Timestamp is right after the CLSID of the downloaded/installed
update package.
I'll check the reg key you posted when I get back from a job I'm heading
off to right now.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
Post by Robert Aldwinckle
Let's try using PowerShell instead. I'm trying to learn PowerShell
and think that ultimately this could be the best tool for doing this.
Adapting Example 3 from the Help new-psdrive...
new-psdrive -name MyReg -psprovider Registry -root HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\
Is there a space in that AutoUpdate name or was that just an artifact of
line wrap and posting? PS didn't like it like that. Aha. There is a space
new-psdrive -name MyReg -psprovider Registry -root "HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\"
But now when I use
and
dir
I get nothing?
In contrast when I back up one level to the parent key I get
<PS_Output>
Hive: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUp
\Auto Update\Results
SKC VC Name Property
--- -- ---- --------
0 2 Detect {LastSuccessTime, LastError}
0 2 Download {LastSuccessTime, LastError}
0 2 Install {LastSuccessTime, LastError}
</PS_Output>
So now the only remaining task will be figuring out how to get some details
about those "properties" (which are obviously the Value names that RegEdit
shows under those subkeys).
Good luck
Robert
---
Post by Robert Aldwinckle
...
Solving that problem showed that I was on the wrong track by making
a "drive" out of a registry branch. ; )
Get-ItemProperty -Path Registry::"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install" | format-list
HTH
Robert
---
Submitted via EggHeadCafe
Fill out blank PDF form online and stream to browser with iTextSharp
http://www.eggheadcafe.com/tutorials/aspnet/a5e1109d-03bc-4e6b-a904-af4835f336cd/fill-out-blank-pdf-form-online-and-stream-to-browser-with-itextsharp.aspx
ritesh kumar
2010-11-21 09:04:38 UTC
Permalink
hope this help...

(get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)

change the path if u wanna query windows 2000
Post by carlklammer08
Hello,
is there a registry key or a WMI query or anything to get the date and time
the system has been updated the last time via Windows Update?
I mean the date/time that is also shown when you open the Windows Update
applet where it says "Updates were installed:" under "Most recent check for
updates:".
I appreciate every hint!
Thank you very much in advance!
Post by Robert Aldwinckle
Use ProcMon to see if there is a stored value which is read when those
web operations are executed?
Good luck
Robert Aldwinckle
---
Post by MowGreen [MVP]
You're referring to the installation date/time of the latest update(s),
correct ?
Check the ReportingEvents.log located in %windir%\SoftwareDistribution
It records all successful automatically installed updates.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
Post by carlklammer08
Hello Robert,
I found the key, with a GMT date and time information in it, which should
normally be easy to read out.
I can SEE this key using regedit.exe, but when I try to access/read this key
with either BGinfo or via a VBS-Script (WshShell.RegRead) I always get the
error message "KEY DOES NOT EXIST".
I double checked for spelling errors, but could not find any.
This problem seems to exist with all children of the Key "WindowsUpdate", I
cannot get e.g. "SusClientId" (which is a String Value directly below the Key
WindowsUpdate either.
As this is a fresh out-of-the-box installation of Windows Server 2008 (I
also tried it on Vista - same results), there should nothing be wrong with
the permissions to this key (every user has at least "read" permissions as I
see), no permissions have been changed.
I also tried running BGinfo as an Administrator, but it did not help either.
Every other program except for regedit says this key did not exist!
Strange...
Do you or anybody got an idea what causes this?
Post by carlklammer08
Hi,
unfortunately, I cannot see from the logfile you mentioned, when the system
was last time successfully updated (e.g. by reading the last line of the
file or so), because in this file mostly status messages are stored, so I
find it hard to get this exact time stamp.
I have however found a corresponding registry key (see my answer above), the
only problem with this key is that it does not seem to be accessible...
Do you have any suggestions?
Thanks,
carl
Post by MowGreen [MVP]
Carl,
The Timestamp is right after the CLSID of the downloaded/installed
update package.
I'll check the reg key you posted when I get back from a job I'm heading
off to right now.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
Post by Robert Aldwinckle
Let's try using PowerShell instead. I'm trying to learn PowerShell
and think that ultimately this could be the best tool for doing this.
Adapting Example 3 from the Help new-psdrive...
new-psdrive -name MyReg -psprovider Registry -root HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\
Is there a space in that AutoUpdate name or was that just an artifact of
line wrap and posting? PS didn't like it like that. Aha. There is a space
new-psdrive -name MyReg -psprovider Registry -root "HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\"
But now when I use
and
dir
I get nothing?
In contrast when I back up one level to the parent key I get
<PS_Output>
Hive: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUp
\Auto Update\Results
SKC VC Name Property
--- -- ---- --------
0 2 Detect {LastSuccessTime, LastError}
0 2 Download {LastSuccessTime, LastError}
0 2 Install {LastSuccessTime, LastError}
</PS_Output>
So now the only remaining task will be figuring out how to get some details
about those "properties" (which are obviously the Value names that RegEdit
shows under those subkeys).
Good luck
Robert
---
Post by Robert Aldwinckle
...
Solving that problem showed that I was on the wrong track by making
a "drive" out of a registry branch. ; )
Get-ItemProperty -Path Registry::"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install" | format-list
HTH
Robert
---
Post by ritesh kumar
(get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)
for windows 2000, you need to replace windows with winnt i.e. \\"server_name\c$\winnt\......
Submitted via EggHeadCafe
Review of Redgate ANTS Performance Profiler 6
http://www.eggheadcafe.com/tutorials/aspnet/945b0f4a-55b9-4799-aaa3-bcbed4131446/review-of-redgate-ants-performance-profiler-6.aspx
ritesh kumar
2010-11-21 09:05:11 UTC
Permalink
hope this help...

(get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)

change the path if u wanna query windows 2000
Post by carlklammer08
Hello,
is there a registry key or a WMI query or anything to get the date and time
the system has been updated the last time via Windows Update?
I mean the date/time that is also shown when you open the Windows Update
applet where it says "Updates were installed:" under "Most recent check for
updates:".
I appreciate every hint!
Thank you very much in advance!
Post by Robert Aldwinckle
Use ProcMon to see if there is a stored value which is read when those
web operations are executed?
Good luck
Robert Aldwinckle
---
Post by MowGreen [MVP]
You're referring to the installation date/time of the latest update(s),
correct ?
Check the ReportingEvents.log located in %windir%\SoftwareDistribution
It records all successful automatically installed updates.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
Post by carlklammer08
Hello Robert,
I found the key, with a GMT date and time information in it, which should
normally be easy to read out.
I can SEE this key using regedit.exe, but when I try to access/read this key
with either BGinfo or via a VBS-Script (WshShell.RegRead) I always get the
error message "KEY DOES NOT EXIST".
I double checked for spelling errors, but could not find any.
This problem seems to exist with all children of the Key "WindowsUpdate", I
cannot get e.g. "SusClientId" (which is a String Value directly below the Key
WindowsUpdate either.
As this is a fresh out-of-the-box installation of Windows Server 2008 (I
also tried it on Vista - same results), there should nothing be wrong with
the permissions to this key (every user has at least "read" permissions as I
see), no permissions have been changed.
I also tried running BGinfo as an Administrator, but it did not help either.
Every other program except for regedit says this key did not exist!
Strange...
Do you or anybody got an idea what causes this?
Post by carlklammer08
Hi,
unfortunately, I cannot see from the logfile you mentioned, when the system
was last time successfully updated (e.g. by reading the last line of the
file or so), because in this file mostly status messages are stored, so I
find it hard to get this exact time stamp.
I have however found a corresponding registry key (see my answer above), the
only problem with this key is that it does not seem to be accessible...
Do you have any suggestions?
Thanks,
carl
Post by MowGreen [MVP]
Carl,
The Timestamp is right after the CLSID of the downloaded/installed
update package.
I'll check the reg key you posted when I get back from a job I'm heading
off to right now.
MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
Post by Robert Aldwinckle
Let's try using PowerShell instead. I'm trying to learn PowerShell
and think that ultimately this could be the best tool for doing this.
Adapting Example 3 from the Help new-psdrive...
new-psdrive -name MyReg -psprovider Registry -root HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\
Is there a space in that AutoUpdate name or was that just an artifact of
line wrap and posting? PS didn't like it like that. Aha. There is a space
new-psdrive -name MyReg -psprovider Registry -root "HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install\"
But now when I use
and
dir
I get nothing?
In contrast when I back up one level to the parent key I get
<PS_Output>
Hive: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUp
\Auto Update\Results
SKC VC Name Property
--- -- ---- --------
0 2 Detect {LastSuccessTime, LastError}
0 2 Download {LastSuccessTime, LastError}
0 2 Install {LastSuccessTime, LastError}
</PS_Output>
So now the only remaining task will be figuring out how to get some details
about those "properties" (which are obviously the Value names that RegEdit
shows under those subkeys).
Good luck
Robert
---
Post by Robert Aldwinckle
...
Solving that problem showed that I was on the wrong track by making
a "drive" out of a registry branch. ; )
Get-ItemProperty -Path Registry::"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update\Results\Install" | format-list
HTH
Robert
---
Post by ritesh kumar
(get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)
for windows 2000, you need to replace windows with winnt i.e. \\"server_name\c$\winnt\......
Post by ritesh kumar
hope this help...
(get-content \\"server_name"\C$\windows\SoftwareDistribution\ReportingEvents.log | Select-String -Pattern "installation successful" | Select-Object -Last 1).line.substring(39,19)
change the path if u wanna query windows 2000
Submitted via EggHeadCafe
Fill out blank PDF form online and stream to browser with iTextSharp
http://www.eggheadcafe.com/tutorials/aspnet/a5e1109d-03bc-4e6b-a904-af4835f336cd/fill-out-blank-pdf-form-online-and-stream-to-browser-with-itextsharp.aspx
Loading...