You might sometimes experience that Windows Patch Date tag does not show the same value as shown on the server. This is most likely due to an error in WMI on the target computer.
In general, start off by confirming that the machine has been inventoried by the latest discoveries. Confirm this by adding the tag “Found By Detailed” and check when the machine was latest found by WMI/SSH/SCCM.
If the machine hasn’t been inventoried by vScope in a while, troubleshoot why in the discovery log in Discovery Manager.
NOTICE – Confirm that you are looking for the correct tag in vScope. There are several patch/update tags in vScope.
Wrong patch date for machines found with WMI/WinRM
Confirm that WMI is working on the target machine
The error can either manifest itself as no update information being returned at all or some instances of the Win32_QuickFixEngineering class missing the InstalledOn attribute. If this is the case, vScope cannot reliably find the latest date a system update was installed.
To see if your system is affected you can open an elevated PowerShell on the target machine and run:
- Get-WmiObject Win32_QuickFixEngineering
The result should be a table with installed patches:
| Source | Description | HotFixID | InstalledBy | InstalledOn |
|---|---|---|---|---|
| CompName | Update | KB3199986 | NT AUTHORITY\SYSTEM | 2016-11-05 00:00:00 |
| CompName | Update | KB3211320 | NT AUTHORITY\SYSTEM | 2017-01-25 00:00:00 |
| CompName | Security Update | KB3214628 | NT AUTHORITY\SYSTEM | |
| CompName | Security Update | KB3213986 | NT AUTHORITY\SYSTEM | 2017-01-11 00:00:00 |
If the table returned by the query is completely empty then you either have a completely fresh Windows installation or there is corruption in the servicing stack which is providing data to the Win32_QuickFixEngineering class.
Read more here about the causes and possible fix for the problem.
If the the InstalledOn field is blank (highlighted in red) for some entries then WMI cannot find a record of when the patch was installed. This can be caused by corruption. Also, slipstreamed updates are usually missing the InstalledOn attribute.
Wrong patch dates for machines found with SCCM
Confirm that the SCCM hardware inventory is properly set up
The SCCM needs to be set up properly for vScope to be able to view the latest patch dates. Enable the following values under ‘Hardware Inventory’ in SCCM:
- Operating System (Win32_OperatingSystem)
- Serial Number
- Quick Fix Engineering (Win32_quickfixengineering)
- Whole package (includes patch information)
These values are not enabled by default for SCCM 2016.