Check Windows Updates using Powershell

I have the problem, that the script tell me there is 1 optional update. When I check Windows Updates there ar no updates needed.
This error is on different OS from Win Srv 2012, 2016 and 2019.
Some servers show it right, some wrong.

An other problem is, that sometimes it takes 24h until the status is shown that all is ok.
It is not a nagios problem, the wrong status is also when I run teh script local.
Has anybody an idea?

I've had a few problems to monitorized this event with nagios and grafana because script didn't show well performance data, just critical output. So I changed some lines into powershell script:

Lines 148 to 154
"if ($returnString.length -gt 976) {
$estado=$countCritical+$countOptional+$countHidden
Write-Host ($returnString.SubString(0,975) +
"|critical=$countCritical optional=$countOptional
hidden=$countHidden state=$estado")
} else {
$estado=$countCritical+$countOptional+$countHidden
Write-Host ($returnString + "|critical=$countCritical
optional=$countOptional hidden=$countHidden
state=$estado ")
}

Now it works perfect!

Thanks and regards

I've tried a few different windows update checkers and constantly had issues with timeouts and such. I set this up and worked right away, and was fairly quick. I made one small mod (im not a programer at all).

Changed: $returnStateOptionalUpdates = $returnStateOK $returnStateWarning

To: $returnStateOptionalUpdates = $returnStateOK

I don't care to be warned for the Optional updates so this works for me.

Cyber_Saiyan, If you are still having issues running it, you do need to do modifications to your server running Nagios. You simply need to add the service to the config file (mine is in what i think was a default file windows.cfg, but you can add it to which one you'd like) The line is listed in the authors notes above. You also need the command for NRPE in the commands.cfg file as well (listed in the authors notes as well).

Can anyone help get this running? I have followed the instructions and updated the INI file on the windows server, recycled the service and placed the script in the SCRIPTS folder on the windows machine. What am I missing from here? It seems that I need to add something to my Ubuntu server but I am lost.

Hi together,

I searched many days until I found this great script.

It works, of course.
But after I updated the Win2008R2 Server, the status is already warning. It shows, that 1 optional update ist outstanding.

I rebooted the server and lokked again after updates. Nothing therer. How can this be? :( Any idea?

Thanks in advance,

Timo

Check_MK ships a [VBS plugin](https://github.com/ypid-bot/check_mk/blob/master/agents/windows/plugins/windows_updates.vbs) which was quite tricky to setup and was not reliable for me so I adopted this PowerShell script to make it a drop-in replacement for [windows_updates.vbs](https://github.com/ypid-bot/check_mk/blob/master/agents/windows/plugins/windows_updates.vbs).

https://github.com/ypid-bot/check_mk/pull/7
https://github.com/ypid/check_mk/blob/feature/windows_updates.ps1/agents/windows/plugins/windows_updates.ps1

I had a similar issue running cmd /c echo on a .wsf when the example showed using Nsclient, but I was able to get it to work. I'm not so lucky with this powershell one.

Anyone know how to define the command in nrpe.cfg using winrpe?

I've tried many variations. From the local machine, I can get an output like: "Updates: 0 critical, 1 optional" but getting Unable to read plugin output from the Nagios side. :( Any help is appreciated.

Hi all,

i need some help. The NSclient version is 0.4.3.143 and im getting Unknown command. Can anyone help me to overcome this issue please?

Best regards,
Peter

The script does a good job, I'm not quite sure if this is the latest version of the script, but I noted a minor bug and some improvements that could be added.

1. Bug:
$critialTitles = "";
should read:
$criticalTitles = "";

The script works anyway despite the error.

2. Putting newlines into update string:
$criticalTitles += $update.Title + " "
Changed to:
$criticalTitles += $update.Title + " `n"

3. These 3 lines are used twice in if statements and ideally would be in a function, just for neatness and brevity.

$updateSession = new-object -com "Microsoft.Update.Session"
$updates=$updateSession.CreateupdateSearcher().Search(("IsInstalled=0 and Type='Software'")).Updates
Export-Clixml -InputObject $updates -Encoding UTF8 -Path $updateCacheFile

Otherwise script works quite nicely.

Check approves only for Windows Updates.
It's possible to check also for Office, SQL, Exchange, Sharepoint ... Updates?

This is really a great and smooth running script, only adjusted the $returnStateOptionalUpdates parameter and then deployed it by Puppet to our windows boxes.

A thought thou, obviously Microsoft decided to list updates according to "Important" and "Optional", maybe one should let this script class updates in the same manor. I for example had a machine reporting 15 critical ant 18 optional by the script, in the Windows update GUI all 33 were listed as Important... I guess there is a XML attribute there somewhere telling what is important and not, trying to look into that myself for the moment...

Plugin works well using NRPE, make sure you have your command definitions set correctly! My NRPE check wouldn't like the arguments and power-shell takes a little while to resolve so make sure you set your time-out to 30 seconds!

For those who have NSClient 0.4.1 +

1) Place check_windows_updates.ps1 in NSclient "scripts" folder

Copy these lines in nsclient.ini :

[/settings/external scripts/scripts]

check_updates = cmd /c echo scriptscheck_windows_updates.ps1; exit($LastExitCode) | powershell.exe -command -

2) In nagios put your command line like this :

command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -c check_updates

Hope this could help someone.

I've try this nagios plugin by local prompt, and it works fine, but if i implement it by nrpe.cfg it doesn't work:
I have this error:
'-' was specified with the -Command parameter: no other arguments to -Command are permitted.
Exit 0

I Don't understand why, it's declared correctly
command[check_win_upd]=cmd /c echo C:nrpelibexeccheck_windows_updates.ps1 "$ARG1$"; exit $LastExitCode | powershell.exe -command -

It's very strange

I run this on my serer from powershell and it seems to run fine but when run ./check_nrpe -H sos-srv-dev -c check_updates!
from my nagios server i get no output back

What are those instructions?

I don't quite have this working yet; I'm running into a bit of a snare. This may sound like a silly question, but I'm new to all of this so I'll ask.

I have NSClient++ installed on the server I'm testing this on and everything else I've thrown at it works. I don't have NRPE installed though because I'm trying to avoid that if possible because I don't want to have to A) Run around installing it on every server if I don't have to, B) Punch anymore holes in my firewall. I read that this works with NSClient++/NRPE, and I followed all the steps, but it's not really working. I get this error when I try to use it in Icinga:
## Error: Service check command 'check_nrpe' not defined anywhere!

Ideas?

Just created an account to thank you for this fine script!

The other review solved the original text bugs in the description, after that all worked fine!

You need Powershell 2.0 for Windows 2003 server else 'start-process' fails in execution.

Once Powershell is installed, you also need to right-click the .ps1 file, click properties, and unblock it.

24/10 - error in command path in install instructions! should read:

"check_updates=cmd /c echo scriptscheck_windows_updates.ps1; exit $LastExitCode | powershell.exe -command -"


... Oh, review: Does exactly what it says on the tin!

I changed the script to return OK for Optional Updates - just change 'warn' to 'ok' on line 110 -- you might want to do this before unblocking it to avoid permission issues afterwards!