Hey, Scripting Guy! How can I use a script to determine if a particular patch has been installed?

— GM

Hey, GM. You know, not too long ago this would have been a question we might have “accidentally” dropped in the wastebasket and pretended never to have seen. Why? Well, back in the old days the only way to get information about patches, hot fixes, and other updates was to use the WMI class Win32_QuickFixEngineering. That was OK, but for various reasons Win32_QuickFixEngineering would occasionally miss a patch that really was installed; even worse, on Windows 2000 machines Win32_QuickFixEngineering would sometimes hang and not return any information. (How do you fix that problem? By installing a patch, of course.) Not a pretty picture by any means.

But those days are gone. Now, thanks to the new and very-much improved Windows Update service, it’s very easy to determine which updates have and have not been installed on a computer. For example, here’s a script that tells us whether the patch Security Update for Windows XP (KB899587) has been installed on a computer:

Set objSession = CreateObject(“Microsoft.Update.Session”)
Set objSearcher = objSession.CreateUpdateSearcher
Set objResults = objSearcher.Search(“Type=’Software'”)
Set colUpdates = objResults.Updates

For i = 0 to colUpdates.Count – 1
    If colUpdates.Item(i).Title = _
        “Security Update for Windows XP (KB899587)” Then
        If colUpdates.Item(i).IsInstalled <> 0 Then
            Wscript.Echo “This update is installed.”
            Wscript.Quit
        Else
            Wscript.Echo “This update is not installed.”
            Wscript.Quit
        End If
    End If
Next
Wscript.Echo “This update is not installed.”

We won’t go through each line of code in detail; explaining the ins and outs of the Windows Update service goes a bit beyond the scope of this column. If you’d like more information about Windows Update (and, in particular, objects like Microsoft.Update.Session) please see our Tales from the Script column I’ll Get You, My Pretty…And We’ll Manage Windows Update, Too!

We will note, however, that despite the presence of the Search method we aren’t really searching for a particular update. Searching implies going out and, with pinpoint accuracy, locating just the item of interest. We can’t really do that. Instead, what we’re doing here is returning a collection of all the updates and then sifting through that entire collection, looking for an update with the title Security Update for Windows XP (KB899587). The end result is the same, but the process by which we achieve that end result is a little different.

No, that doesn’t make any difference. Just thought you’d like to know.

So what is the process we employ here? Well, we begin by using these four lines of code to retrieve the updates collection for the local computer:

Set objSession = CreateObject(“Microsoft.Update.Session”)
Set objSearcher = objSession.CreateUpdateSearcherSet 
objResults = objSearcher.Search(“Type=’Software'”)
Set colUpdates = objResults.Updates

After retrieving the collection we set up a For Next loop to walk through all the items. Inside that loop we use this line of code to determine whether the update Title is equal to Security Update for Windows XP (KB899587):

If colUpdates.Item(i).Title = _
    “Security Update for Windows XP (KB899587)” Then

Let’s suppose that the Title is equal to Security Update for Windows XP (KB899587). In that case, we next check the value of the IsInstalled property. If IsInstalled is equal to 0, then the update is not actually installed (installation might have failed, or the update might have been installed but then removed). If IsInstalled does not equal 0, then the update is installed. We check the value, and then echo the appropriate message:

If colUpdates.Item(i).IsInstalled <> 0 Then
    Wscript.Echo “This update is installed.”
    Wscript.Quit
Else
    Wscript.Echo “This update is not installed.”
    Wscript.Quit
End If

You might notice that, after echoing our message, we terminate the script. Why? Well, update titles are unique: now that we’ve found the update in question there’s no need to continue walking through the rest of the collection. Therefore, we might as well terminate the script and get on with our lives.

And what if the Title isn’t equal to Security Update for Windows XP (KB899587)? In that case we simply loop around and check the next item in the collection. If we never do find an update with the specified title we’ll eventually exit the loop, and then execute the last line of code, which simply reports that the update is not installed.