Sofware Update Scans of 32bit 2008 Windows Server

Aug 25, 2016 at 5:38 PM
For some reason this server (Windows 2008 Server Standard SP2) has these below dates (Installed On) after being scanned by any version that I have tested about 3.0. The "Installed Updates" section of the Control Panel on the server show dates correctly formated. Do you know if there is some reason it shows this? And can there be a fix posted for it?

Update ID Installed On Description
KB2296011 01cd94f0e95bc292 Security Update
KB2679255 01cd94f0e96a0ad8 Hotfix
KB971513 01cd94f0e92c26fe Update
Coordinator
Aug 26, 2016 at 8:53 AM
Hi jperrygodfrey,

The list of updates is the resultant of 4 sources. Namely, Windows Update Agent, Microsoft Installer, Windows Management Information and the System Registry. These are then merged to form a single list. It sounds like one of the sources has unexpected data. The WinAudit programme can dump out raw data. On the menu, View -> Software Information. A new tab will get the focus, then do Edit->Find to search for the an update ID, e.g. KB2296011. Which data source(s) have the Update ID and which one(s) have the correctly formatted date vs. the wrong hex string.

oldbury
Aug 29, 2016 at 6:37 PM
Edited Aug 29, 2016 at 6:37 PM

Everyone of the Update IDs that have just KBXXXXXX as an ID show in this hex string. Here is a few below:

Updates - Windows(R) Management Instrumentation

Update ID : KB971513
Installed On : 01cd94f0e92c26fe
Description : Update

Update ID : KB971512
Installed On : 01cd94f0e930e9c0
Description : Update

Update ID : KB960362
Installed On : 01cd94f0e93cd0a5
Description : Update

Update ID : KB2761494
Installed On : 01cdd853b1ed90ee
Description : Update

Update ID : KB2117917
Installed On : 01cd94f0e95bc292
Description : Update

Update ID : KB2296011
Installed On : 01cd94f0e95bc292
Description : Security Update

Update ID : KB2305420
Installed On : 01cd94f0e95e23f3
Description : Security Update

Update ID : KB2345886
Installed On : 01cd94f217eacb56
Description : Update
Coordinator
Aug 30, 2016 at 4:03 PM
Hi jperrygodfrey

Typically these date values are of the format d[d]/m[m]/yyyy. WMI ultimately gets these from the registry. They are stored as string type (REG_SZ) so any value could be there. In this case there is nothing to fix as WinAudit is faithfully reporting the state of the computer. While it's straightforward to suppress unexpected data that wouldn't be desirable. Doing so may mean the report does not reflect the computer's state or hide useful information needed by an administrator to fix a problem. See the InstalledOn member of Win32_QuickFixEngineering (https://msdn.microsoft.com/en-us/library/aa394391(v=vs.85).aspx), unfortunately the datetime member is not often there so it not useful as a fallback. As the doc say, missing date information does not imply the update is not installed.

oldbury