Any reports in MECM to get devices not patched since last 90 days

Question

I have a requirement to check which devices are not patched since last 90 days. Is there any way I can get that. idea is to find the devices which are not getting patched month by month.

Answer 1

Hi @Devraj Mukherjee ,

Either you can check under Monitoring > Deployments node for which devices are not patched in the latest Tuesday patches or try with CMPivot following the below article:

• SCCM CMPivot Query Patches Installed in Last 90 Days | ConfigMgr

See also:

• Monitor software updates in Configuration Manager

Regards,

---

Youssef Saad | Blog: https://youssef-saad.blogspot.com
Please remember to ** “Accept answer” ** or upvote for useful answers, thank you!

Answer 2

Hi @Devraj Mukherjee ,

Agree with YoussefSaad, Configuration Manager CMPivot tool allows us to quickly assess the state of devices. When we run a query against a device collection, the CMPivot shall run a query in real-time on all currently connected (online) devices in the selected collection.

Besides, we could use SQL script to query that the date the patch was last installed on the device, and then check again for devices that have not had patches installed in the last 90 days. Here is the article we could refer to:
https://www.attosol.com/sccm-custom-sql-query-for-patch-compliance/
Note: This is non-official Microsoft article just for your reference.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

You can try this free report. https://w3.enhansoft.com/giveaway it is only available this month.

Answer 4

1. Create Configuration Item Add code below

$Days = 90
$Result = Get-WmiObject -Class win32_quickfixengineering |  Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-$Days) }
If ($Result -ne $null) {
	Write-Output "Compliant"
}
else {
	Write-Output "Non-Compliant"
}

2. Ensure the Compliance Rules is set to "Compliant" for Value
3. Check option to Report Noncompliance if this setting is not found
4. Create Configuration Baseline
5. Deploy the your collection of choice
6. Right Click on Deployment > Create New Collection > Non-compliant

All the Non-compliant devices should be devices that have not patched in the last 90 days ;)