Library / Windows Server and AD

SERVER-030 · Script

Report Server Patch Status

Shows when each server last installed a Windows update, and flags servers that have gone too long without one.

Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing

What it does

For each target server, reads the installed update list and records: the most recent update, its KB number and install date how many updates were installed in the last -DaysThreshold days operating system, build, and last boot time A server is flagged Behind when its newest update is older than -DaysThreshold days (default 30), and Unknown when no install dates could be read. This shows patch activity; it does not ask Windows Update which updates are still missing. Targets are the servers you name, the servers in an OU, or this computer. Read-only.

Requirements

Windows PowerShell 5.1. Admin rights on the target servers (WinRM or DCOM). The ActiveDirectory module (RSAT) only when -SearchBase is used.

How to run it

  • Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
  • Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
  • Script type: PowerShell 5.1, 64-bit
  • User interaction: none; the script never prompts
  • Timeout: 30 minutes for large directories or many servers

Settings

NameWhat it doesOptionsDefault
ComputerNameServers to check. If empty, uses -SearchBase, or this computer.(none)
SearchBaseOU (distinguished name) whose enabled servers are checked.
DaysThresholdDays since the last update before a server is flagged. Default: 30.30
AlertOnBehind (default) exits 1 when any server is Behind, Unknown or unreachable. Never always exits 0.Behind, NeverBehind
ServerOptional domain controller used to read the OU.

Exit codes

  • 0 = All servers patched within the threshold (or AlertOn is Never)
  • 1 = One or more servers behind, unknown or unreachable
  • 2 = Script error (see log)

Testing steps

  1. Run it on one test OU, test account or test server and check the output and log.
  2. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
  3. Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log

VersionDateChanges
1.0.0November 2026First release.