Home / server / Questions / 952933
In Process
Martin
Asked: 2019-02-09 02:11:18 +0800 CST

Determine which Windows Update KB package a specific OS file belongs to?

  • 772

I have a Windows 7 machine that has the file ucrtbase.dll of Universal C Runtime installed in the version 10.0.10586.1412.

However, the latest official MS Update I can find patching this file for Windows 7 is KB3118401, which contains this file in version 10.0.10586.9.

Given this Windows-7 machine, how can I find out which Update KB installed this specific version of ucrtbase.dll?

I would like to solve this problem generically, because we have issues with Windows system DLLs from time to time: In our development dep we have 5 different Visual Studio Versions and so it happened from time to time that one dev would have a newer version of some System32 dll and we weren't even sure where it came from.

Things I've tried:

  • Correlating the update installation list with the file creation date.
    Unfortunaltely the Hotfix history only seems to be keeping the date, and on the date this file was created on disk, I seem about a 100 KB fixes installed. (Expected bulk install of fixes at this date.)
  • Searching through %WINDIR%\WindowsUpdate.log - timestamps start after suspected install
  • Googling: No luck. I only find KB3118401 and KB999226 (an older version).
  • Looking at the WinSxS folder name of said file.
    • E.g. the WinSxSfolder for the 64 bit version is amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.1.7601.23303_none_0a7a73e149361a18 - I haven't found how this could help.
windows

1 Answers

  1. Search your .dll in windows\winsxs. You will find it in one of the packages there. By the folder's name of the package you can find what KB it belongs to.

    In your case, 6.1.7601.23303 corresponds to a specific update, which is a KB or cumulative update.

    Also, at the location:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\ComponentDetect

    you may find information on such components.

    By checking the date of the files present there, you can indirectly determine the date of the installed KB.

    The easiest method to make a good correlation is to run dism /online /get-packages . This will list the package version (as in your 6.1.7601.23303 case) and the date of the package was installed, along with the KB package name.

    • 0