Take the 2-minute tour ×

I have a list of applied security patches and updates, exported from Windows server 2003.

The exported list is in CSV format, but converting it is not a problem for me.

Is there any tool/site/script that will check this list and will return me the list of missing updates?

share|improve this question
As an alternative, do you know where can I find current list of security patches available for Windows Servers? I can differentiate this list with the list I have and solve the problem like this... –  Boaz Tirosh Oct 24 '12 at 11:05
Can't you just run Windows Update and see the list of hotfixes it says are applicable? –  Polynomial Oct 24 '12 at 11:14
I don't have access to Windows Server 2K3, also I need a list in some kind of a text format, so I can differentiate the lists automatically... If you mean I should do so from the server, I don't have access to it anymore. –  Boaz Tirosh Oct 24 '12 at 11:28
I'm not sure why this is useful. If you're going to the effort of extracting a CSV of applied patches from the server, why not just run Windows Update on the server instead? Even if you don't have access to that box, someone must have in order to get the list in the first place. This all seems rather redundant... –  Polynomial Oct 24 '12 at 11:42
@Polynomial To a certain degree, this might make sense if the target system is isolated from the main network. In those cases however, the best answer is to set up a portable updating solution like WSUS on a USB HDD or GFI LanGuard on a laptop. –  Iszi Oct 24 '12 at 13:02

5 Answers 5

up vote 1 down vote accepted

I would recommend Iszi's answers above, but since you do not have access anymore these may not be feasible. I am not aware of any complete list out there listing all patches for a given platform, since the missing patches would also depend upon some other things installed that are not necessarily required (drivers, .NET, etc.). If you do not have access you are not the one who could implement the changes anyway. However, that said... you could install another fresh windows install, apply all patches, export the list, then diff them.

I just found this list of patches released for 2003: http://support.microsoft.com/kb/914962 . It might be a good start for you.

share|improve this answer

It seems like you're really trying to go the long way around, here. What you need is an offline updating solution, and there are some options available.

WSUS Offline Update allows you to download Windows Update patches to a USB drive, and install them on another computer that doesn't have an Internet connection. You can download all available updates, and let the remote computer then figure out the ones it doesn't need.

Vulnerability scanners like Nexpose, Nessus, McAfee Vulnerability Manager and GFI LanGuard can be installed on portable platforms (e.g.: laptops). These will evaluate the installed software and configuration of your system over a network connection (you will, of course, have to plug the laptop into the same network as the target system or connect directly via crossover cable) and provide a comprehensive list of missing patches and configuration flaws. This will include not only necessary Windows updates, but also updates for many other programs. Some scanners even include a patch management system, which can be used to automatically push needed updates to the system after a scan - even without actually installing client software on the target.

share|improve this answer
I did this test as part of a more general audit, I am not the server administrator and not allowed to make changes to the server. Also I don't have access to the server anymore. –  Boaz Tirosh Oct 24 '12 at 14:08

You may be able to reverse engineer a list of patches by looking at Microsoft's archive of security bulletins. Be a hell of a job though.

Better would be if you can get the server admins to re-run the analysis for you, but this time use the proper tool for the job, Microsoft Baseline Security Analyser, since that will tell you what's missing, rather than what's installed.

Failing both of those, you can try building a 2003 server and running MBSA on it without applying any patches, to see what it thinks you should install. That might not be 100% exact, but might be enough to tell you if their patching process is working.

share|improve this answer

I'm guessing what you've got is the output of the win32_quickfixengineering WMI class or the get-hotfix powershell command.

I've not seen a great way of definitively generating a missing patch list under those circumstances, however two things which could be of use.

  1. Check the installedOn date for the patch, if the system is showing that for most of the patches you can guess that they're likely running windows update up to that date (this is only useful for rough and ready approximation)
  2. Create a Virtual Machine of the same OS type, install all available patches and run the get-hotfix powershell command and diff the results with the information you've got.
share|improve this answer

if you have a wsus server in your network for managing the updates, ask your WSUS server administrator to give you the list of not-applied updates.

share|improve this answer

Your Answer


