Difference between WUA IUpdateSearcher and wmic qfe

user_16041391 0
Viewed 157

I am trying to figure out what are the differences between WUA (Windows Update Agent API) IupdateSearcher and wmic qfe list.

When I use WUA IupdateSearcher I get these updates:

(New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher().Search('IsInstalled=1').Updates | Format-Table -AutoSize

enter image description here

And when using wmic qfe list:

wmic qfe list brief

enter image description here

The latter includes updates that the former doesn't and vice versa. Why is that?

For example, KB5007273 appears on wmic but doesn't appear on WUA and vice versa, for example, KB4023057 appears on WUA but doesn't appear on wmic

wuapi wmic windows-update powershell windows
1 Answers

This post (Windows Update Agents Vs WMIC QFE GET) from @RRUZ should get you started:

WMIC QFE GET command is equivalent to execute a query with the Win32_QuickFixEngineering WMI class, since with Windows Vista, this class returns only the updates supplied by Component Based Servicing, in olders windows versions uses the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates registry keys to enumerate the updates.

The IUpdateSearcher interface which is part of the Windows Update Agent API (WUA), can be used to enumerate all the fixes including the installed via the CBS, Updates supplied by Microsoft Windows Installer (MSI) or the Windows update site, and so on.

And to get a deeper dive, check this article search for installed windows updates using Delphi, WMI and WUA shown in this post Windows API equivalent to "WMIC QFE Get" by @RRUZ:

WMI (Windows Management Instrumentation) using the Win32_QuickFixEngineering class, you can retrieve a small system-wide update, commonly referred to as a quick-fix engineering (QFE) update.

Starting with Windows Vista, the Win32_QuickFixEngineering class returns only the updates supplied by Component Based Servicing (CBS), so some updates are not listed.

WUA (Windows Update Agent) using the Windows Update Agent API is a best option to retrieve the list of updates, you can access the interfaces and objects from this API from delphi importing the wuapi.dll file or creating a late-binding com object using the Microsoft.Update.Session GUID. the next samples uses the late-binding way.

Additionally for people searching for the way to get all installed updates in the system, which would work for a very wide range of Windows Server Versions (WS 2003 to WS2022 - PS 1.0 or higher) you will need to query both QFE and WUA updates. This might get you duplicate updates so you just got to parse those out.

user_97471370
Related