Home / server / Questions / 357758
Accepted
Chadddada
Asked: 2012-02-08 11:26:17 +0800 CST

Windows Server patch management (email notification when patch applied?)

  • 772

Patch management (WSUS) hasn't been in my court until recently so I am trying to get acclimated to its functionality. So currently we are using WSUS version 3.2 for our Windows Server patch management. Something I am finding lacking with this system, and maybe because it simply isn't a feature or I am not looking in the correct place, is being notified when patches are applied via email. The only E-Mail notifications I am finding are under Update Services>(Server name) Options and then the E-Mail Notifications settings. From here you can be notified of the synchronization of patches between your WSUS sever and Microsoft and that status report of your environment (summary of the status of your computers by computer groups).

What I want for notifications are, "This computer has just had patch X applied and it was rebooted" in my inbox. Is there a way for WSUS to do this or is this outside of the functionality of WSUS to do? I am looking to do this without purchasing any additional software, just using WSUS/Powershell/etc.

powershell update wsus

2 Answers

  1. Best Answer

    There isn't built-in functionality to do this.

    The Event Log contains information about update installation, as does the %SystemRoot%\WindowsUpdate.log file. Either of those sources would be a good candidate to "scrape" for information about update installations.

    The WSUS server's database is updated when updates are installed but, unfortunately, Microsoft has not published the schema and doesn't consider it to be something you should be querying directly. It would be possible to (probably fairly elegantly) report on new update installations via the WSUS server itself if Microsoft published the schema. I won't write anything to touch the WSUS database directly because some significant fraction of my code would turn to garbage upon the next WSUS release.

    • 3

  2. Evan is right, there is no built in functionality to do this.

    I remembered seeing this Scripting Guy post,

    http://blogs.technet.com/b/heyscriptingguy/archive/2012/01/22/use-the-free-poshwsus-powershell-module-for-wsus-administrative-work.aspx,

    about using the PoshWSUS module. Looking at the post and the commands on CodePlex, it seems like you could set up a script that you could run daily that would show you which computers got patches installed since last night or something along those lines.

    Unfortunately, I no longer have a WSUS server to test this on.

    • 2