Monitor - Windows Update

Import-Module $env:SyncroModule -WarningAction SilentlyContinue

# Check Windows 10/11 version age
$OSname = Get-CimInstance Win32_OperatingSystem | Select-Object -ExpandProperty Caption
if ((Get-CimInstance Win32_OperatingSystem).version -like '10*' -and $OSname -notlike '*Server*') {
    if ($OSname -match 'Windows 10') {
        $MaxAge = "18" # Maximum age in months of builds you want to allow
        $CurrentDate = (Get-Date).AddMonths(-$MaxAge).ToString("yyMM")
        # Grab version and convert to numerical format, 19041 and older do not have DispalyVersion so we grab ReleaseID
        if ((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion) {
            $Version = ((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion).replace('H1','05').replace('H2','11')
        }
        else {
            $Version = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").ReleaseId
        }
    }
    if ($OSname -match 'Windows 11') {
        $MaxAge = "24" # Maximum age of builds you want to support in months
        $CurrentDate = (Get-Date).AddMonths(-$MaxAge).ToString("yyMM")
        # Grab version and convert to numerical format
        $Version = ((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion).replace('H1','05').replace('H2','11')
    }
    $Diff = $Version - $CurrentDate
    if ($Diff -lt '0') {
        Write-Host "$OSname $Version is over $MaxAge months old, needs upgrading"`n
        Rmm-Alert -Category 'Monitor - Windows Update' -Body "$OSname $Version is over $MaxAge months old, needs upgrading"
        exit 1
    }
}

# Check for disabled services
$disabled = Get-Service wuauserv, BITS, CryptSvc, RpcSs, EventLog | Where-Object -Property StartType -eq Disabled
if ($disabled) {
    "Disabled Services:"
    $disabled
    Rmm-Alert -Category 'Monitor - Windows Update' -Body 'Service(s) are disabled'
    exit 1
}
else {
    Close-Rmm-Alert -Category "Monitor - Windows Update"
}

# Check if recent updates are installed
$WindowsUpdateObject = New-Object -ComObject Microsoft.Update.AutoUpdate
$SearchSuccessDate = $WindowsUpdateObject.Results |Select-Object LastSearchSuccessDate
$SSDLastDate = [datetime]$SearchSuccessDate.LastSearchSuccessDate
$SSDLastDate = (Get-Date $SSDlastDate).AddHours(-5)
$SSDStartDate = Get-Date
$SSDDays = (NEW-TIMESPAN -Start $SSDLastDate -End $SSDStartDate |Select-Object days).days
Write-Host 'Last Search Success:' $SSDLastDate "($SSDDays days ago)"`n
$InstallSuccessDate = $windowsUpdateObject.Results |Select-Object LastInstallationSuccessDate
$ISDLastDate = [datetime]$InstallSuccessDate.LastInstallationSuccessDate
$ISDLastDate = (Get-Date $ISDlastDate).AddHours(-5)
$ISDStartDate = Get-Date
$ISDDays = (New-Timespan -Start $ISDLastDate -End $ISDStartDate |Select-Object days).days
Write-Host 'Last Installation Success:' $ISDLastDate "($ISDDays days ago)"`n
$LastMonth = (Get-Date).addmonths(-1).ToString("yyyy-MM")
$ThisMonth = (Get-Date).ToString("yyyy-MM")
$Session = New-Object -ComObject 'Microsoft.Update.Session'
$Searcher = $Session.CreateUpdateSearcher()
$HistoryCount = $Searcher.GetTotalHistoryCount()
if ($HistoryCount -gt 0) {
    $xx = $($Searcher.QueryHistory(0, $HistoryCount)|Select-Object Title, Date, Operation, Resultcode|Where-Object {$_.Operation -like 1 -and $_.Resultcode -match '[123]'}| Select-object Title)
}
else {
    $xx = $(Get-Hotfix|Where-object {$_.hotfixid -match 'KB\d{6,7}'}| Select-object Hotfixid)
}
if (!$xx) {
    Write-Output 'WARNING - No updates returned'
    Rmm-Alert -Category 'Monitor - Windows Update' -Body 'WARNING - No updates returned'
}
else {
    $xx = $xx|Where-Object {$_ -match "($LastMonth|$ThisMonth) (Security Monthly Quality Rollup|Cumulative Update)" -or $_ -match "Feature update" }
    if (!$xx) {
        Write-Output 'WARNING - No recent rollup/cumulative/feature update detected'
        Write-Output 'Last updates:'
        $xx | Select-Object -ExpandProperty Title -First 1
        # If last install succes was recent, let's not fail out
        if ($ISDDays -lt 50 -or $ISDDays -gt 153000) {
             Close-Rmm-Alert -Category "Monitor - Windows Update"
             exit
        }
        Rmm-Alert -Category 'Monitor - Windows Update' -Body 'WARNING - No recent rollup/cumulative/feature update detected'
        exit 1
    }
    else {
        Write-Output 'Recent rollup or cumulative update detected:'
        $xx | Select-Object -ExpandProperty Title -First 1
        Close-Rmm-Alert -Category "Monitor - Windows Update"
    }
}