Windows Patch Day problem after latest Windows Updates

[gregdent]

All of our Windows Patch Day plugins have stopped working now after the latest Windows Update.

When executing the script manually, I'm seeing the following error output:

Exception from HRESULT: 0x80240007 At C:\ProgramData\checkmk\agent\plugins\windows_patch_day.ps1:48 char:1 + $Searcher.QueryHistory(0, $HistoryCount) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OperationStopped: (:) [], COMException + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException

Checking into it and others seem to be having similar issues specifically with the Microsoft.Update.Session COM object. Not sure if anything needs checking/patching in the script? I might have a go myself, just got to try and work out what its doing, but thought you should know!

The error showing up on CheckMK now is Unknown Status.

The error relates specifically to this line: $Searcher.QueryHistory(0, $HistoryCount)

Which calls these 2 variables: $Searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher() $HistoryCount = $Searcher.GetTotalHistoryCount()

Edit: Code brackets in Github are broke as hell!

[gregdent]

Done some more checking and it looks like this has only affected some of our servers after the latest updates, not all.

Cant work out why though. I've tried deleting the c:\windows\softwaredistribution folder and rebooting but still getting same issue on these 2 servers.

Stumbled across this oooold Github issue with exact same issue, using exact same POSH code, but his resolution hasnt worked for us: https://github.com/bklockwood/PSWU/issues/36

[Yogibaer75]

In your case is the $HistoryCount variable 0? If yes it would be possible to check inside the script if this is 0 and then exit.

[tarcisiomiranda]

I have the same problem, I tried to verify, but I know that I have at least 2 updates installed on my 2008R2, I can see it using another command, like this:

Get-HotFix | Select-Object HotFixID,InstalledOn

but the one that would be the most complete doesn't work

$Session = New-Object -ComObject "Microsoft.Update.Session";
$Searcher = $Session.CreateUpdateSearcher(); $historyCount = $Searcher.GetTotalHistoryCount();
if ($historyCount -gt 0) { $history = $Searcher.QueryHistory(0, $historyCount) } else { $history = $null };

and if I remove this if, it returns this error below:

Exception calling "QueryHistory" with "2" argument(s): "Exception from HRESULT: 0x80240007"
At line:1 char:23
+ $Searcher.QueryHistory <<<< (0, $historyCount) | Select-Object Title, Date, @{name="Operation"; expression={switch($_
.operation){ 1 {"Installation"}; 2 {"Uninstallation"}; 3 {"Other"}}}};
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ComMethodTargetInvocation

PS Version:

PS C:\Users\Administrator> $PSversiontable

Name                           Value
----                           -----
CLRVersion                     2.0.50727.5420
BuildVersion                   6.1.7601.17514
PSVersion                      2.0
WSManStackVersion              2.0
PSCompatibleVersions           {1.0, 2.0}
SerializationVersion           1.1.0.1
PSRemotingProtocolVersion      2.1

[Yogibaer75]

As 2008 gets no updates anymore, such a check is not relevant for such a system. Also I don't know if this script will work with Powershell 2.0 as it is not supported since 3 years now.

For the original problem i only need to know if the $historyCount variable is 0 on such a system or not.

[Yogibaer75]

@gregdent can you please check if the last update for CMK 2.1 will fix the problem with the 0 counter? Windows Patch Day Plugin updated for CMK2.1 and small fix

[gregdent]

Hi Andreas,

The issue seemed to sort itself out for some reason. But we are now seeing it on our SCCM server (which deploys the patches!) and the $HistoryCount variable is coming through as "2" in this case, although running the .ps1 file doesnt display anything. All we see is this:

History count:

[Yogibaer75]

It would be interesting if you have some data with a manual $Searcher.QueryHistory(0, 2) If the output is empty then it is clear that you get no output. Another approach would be a other Powershell statement to get the installed updates. I have no knowledge about other ways to get this information.

[gregdent]

I think this is another issue with our WSUS store on these servers.

$Searcher.QueryHistory(0, 2)

this command shows some updates, so the command is working! It's only showing Defender updates, which are filtered in the cfg file, and no other updates, which indicates a broken or reset WSUS. I suspect next patch cycle will fix it.

Have you tried using Get-Hotfix to do this instead? I still need to understand what the script is doing, but this could be an easier method?

[Yogibaer75]

get-hotfix gives only hotfix updates back but no regular updates. If you compare the output from get-hotfix with my script it is a complete other world.

HotFixID  InstalledOn
--------  -----------
KB5025182 21.04.2023 00:00:00
KB5012170 08.12.2022 00:00:00
KB5026446 12.05.2023 00:00:00
KB5026549 12.05.2023 00:00:00

vs.

Title                                                                                                                     Date
-----                                                                                                                     ----
Update Stack Package - (Version 1023.508.1122.0)                                                                          18.05.2023 20:39:00
Update Stack Package - (Version 1023.421.6122.0)                                                                          13.05.2023 10:23:40
2023-05 Kumulatives Update für Windows 11 Version 22H2 für x64-basierte Systeme (KB5026446)                               12.05.2023 18:17:01
2023-04 Update für Windows 11 Version 22H2 für x64-basierte Systeme (KB4023057)                                           11.05.2023 17:44:01
2023-05 Kumulatives Update für Windows 11 Version 22H2 für x64-basierte Systeme (KB5026372)                               10.05.2023 18:34:46
Update für Windows Security platform-Antischadsoftwareplattform – KB5007651 (Version 1.0.2303.28002)                      04.05.2023 18:03:42
Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.387.2537.0)                          28.04.2023 14:55:54
2023-04 Kumulatives Update für Windows 11 Version 22H2 für x64-basierte Systeme (KB5025305)                               26.04.2023 05:19:11
9NMPJ99VJBWV-Microsoft.YourPhone                                                                                          25.04.2023 06:22:00
2023-04 Vorschau auf kumulatives Update für .NET Framework 3.5 und 4.8.1 für Windows 11, version 22H2 für x64 (KB5025182) 21.04.2023 17:24:34
Update Stack Package - (Version 1023.322.4012.0)                                                                          14.04.2023 18:24:42