Monitor if server deployed their security patches

Question

We would like to know which servers have not gotten patched in the last 60 days,

Can we do this with:

1) The SCCM MP?
2) Monitoring a specific Event ID
3) Monitoring a log file such as https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/log-files#BKMK_SU_NAPLog or https://info.adaptivedge.com/blog/understanding-sccm-sup-process
4) Having access to the Software Updates - Compliance report in SCCM

Thanks

Answer 1

Hi,

We can use powershell script based monitor, to achieve our goal.

 $api = New-Object -comObject "MOM.ScriptAPI"   
 $PropertyBag = $api.CreatePropertyBag()  
      
 $LastPatchDate = Get-HotFix | Sort-Object InstalledOn | Select-Object -Last 1 | Select -Expandproperty InstalledOn  
 $rv = ((Get-Date) - $LastPatchDate).TotalDays  
      
 $PropertyBag.AddValue("Days",$rv)  
 $PropertyBag  

Here's some screenshots from my lab test.

script

criteria (we may set it to 60 in our situation)

alert generated due to servers not patched more than 400 days

and I've confirmed that value "255.xxx" and "328.xxx" did not generate the alert since the criteria is set to 400 or higher (in our situation, we can set the criteria to 60).

Answer 2

I know Compliance report in SCCM should provide you this information.

Answer 3

Hi JaiVerma-7010 thanks for your reply.

But can I generate an alert from the Compliance report? Event better send it to SCOM?

Thanks

Answer 4

Hi, @George Christianis
Thank you for posting in Microsoft Q&A forum.

Here is an article that you can enable SCCM email notification on reports:
https://systemcenterdudes.com/configure-sccm-email-notifications-on-alerts-and-reports/
(Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.)

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

Thank you AllenLiu-MSFT for your response.

Ideally I would like to find a way to get these alerts into our SCOM console.
Since we would like to have all alerts in one central place.
People don't always look at their emails.

Thanks