API / WMI request for a complete list of patches and updates installed on the system?

Question

Previously, a request for a list of patches installed on a Windows system was discussed, and the use of WMI and the Win32_QuickFixEngineering class was proposed as providing information. However, MSDN indicates that from Vista onwards this particular class returns only patches, not updates installed by other means.

An older question discusses the use of this class to obtain installed updates, indicating that the author is also not satisfied with using this due to the limitation described above. Unfortunately, as a comment on the accepted answer indicates, an alternative solution to using the Windows Update Agent API still indicates that the patch was installed even after it was uninstalled (it asks for the installation history and not the currently installed updates).

Does anyone know how to get in C # (through WMI or some other API) a complete list of updates and patches installed on the system, which does not exclude some ways in which updates can be installed and updates will not be returned, which were subsequently deleted? In fact, I get the same data set that is available in the "Programs and Features" in the "View installed updates."

Sorry if this discussion were to be carried out on one of the related questions that had previously considered this question, however, with my current reputation, the only way to contribute to any question is to submit a new answer, and this will definitely not be the right way to ask another a question.

Thanks!

Answer 1

In the absence of a reliable and complete software way to do this, I ended up using the wmic qfe command.

Answer 2

As far as I know, everything that is installed and can be removed must be registered in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall . It appears that the KB999999 subclan names are reserved for system updates (patches or service packs). Something that is an update will have a REG_SZ value in this subkey called ParentKeyName, which refers to the updated registry entry.

For example, I have SQL Server 2008 Service Pack 1, so I have the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB968369 registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB968369 . It has a REG_SZ value with the name HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB968369\ParentKeyName with the value "Microsoft SQL Server 10 Release". Since I have SQL Server 2008 installed (since KB968369 is the SP for it), I also have HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft SQL Server 10 Release , which is the ParentKeyName link.

You can specify which type is updated from the REG_SZ ReleaseType value. For example, installing KB968369 has the value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB968369\ReleaseType "ServicePack"

I assume that only updates that can be removed are registered under the Uninstall key. There is also a registry key HKEY_LOCAL_MACHINE\Software\Classes\Installer\Patches (mentioned in various places, for example here: http://support.microsoft.com/kb/971187 ), which seems to describe in detail various system updates.

there is also a Microsoft Update object that you can create and query. An example of this is described in detail here: http://msmvps.com/blogs/athif/archive/2005/11/20/76035.aspx

I am not sure if this gives you everything you want; but these are some different things that I have learned over the years ...