Title
#general
AoS

AoS

07/10/2019, 6:42 AM
A question about the
Patches
table for windows: the description is
Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update
- which kind of implies it shows almost none of the patches installed
Mike Myers

Mike Myers

07/10/2019, 9:12 PM
the documentation could be more clear. This table in osquery is a proxy for the
Win32_QuickFixEngineering
WMI class, which lists "quick-fix engineering (QFE) updates" to the operating system. Starting with Windows Vista, this class returns only the updates supplied by Component Based Servicing (CBS).https://github.com/osquery/osquery/blob/e6fe15eb49660725e65dba1549932ed96e0a8c6e/osquery/tables/system/windows/patches.cpp#L19