PowerShell Query Windows Update Catalog

Question

Hi,

I'm trying to build a PowerShell script that will return the most recent installed Cumulative Update (or Security Monthly Quality Update/Security Only Update on Server 2012 R2 and earlier). Most critically I need the "friendly" name and not the build number, KB number or generic "Security Update"

So for example I need 2021-09 Security Monthly Quality Rollup for Windows Server 2012 R2 for x64-based Systems (KB5005613)

This is way more harder than it should be.

I have some examples where using the local Update History is not suitable:

Servers that missed patch schedule and then subsequently had multiple updates installed on the same day. This can result in an older patch being selected when trying to find the most recent one by Installed Date
If installing an update manually by downloading the .msu file, local Update History does not show the friendly name

Example covering both those-

you can that September's patch was seemingly installed via the .msu file. This is the latest one installed so if I look in local Update History for "Security Monthly" or "Security Only", this patch is ignored
The 2020-12 and 2021-07 updates were both installed on the same day, and checking in PowerShell the 2020-12 updates has a more recent time so is the update returned when checking for the most recent one by installed date

I have tried about 6 different examples scripts found online and none of them overcome these problems.

So now I am considering extracting the raw KB number from the local Update History, and then looking up this KB in Windows Update Catalog to return the friendly name:

Is there an already known-way to do what I am asking?

Thanks

Answer 1

I think this one does that exactly.
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-hotfix?view=powershell-7.2

--please don't forget to upvote and Accept as answer if the reply is helpful--