Monitor - Windows Update

Import-Module $env:SyncroModule -DisableNameChecking
# Todo: implement different maximums for Enterprise/Edu/IoT Enterprise/LTSB/LTSC

# Maximum age of builds you want to support in months
$Win10MaxAge = "18" # Standard EOL for Home/Pro is 18 months
$Win11MaxAge = "24" # Standard EOL for Home/Pro is 24 months

# Number of days to consider an update recent
$Recent = '50'

# UTC Time Offset: check yours @ https://www.timeanddate.com/time/difference/timezone/utc
$Offset = '-6'

# Check Windows 10/11 version age
$OSname = Get-CimInstance Win32_OperatingSystem | Select-Object -ExpandProperty Caption
if ((Get-CimInstance Win32_OperatingSystem).Version -like '10*' -and $OSname -notlike '*Server*') {
    if ($OSname -match 'Windows 10') {
        $MaxAge = $Win10MaxAge
        $CurrentDate = (Get-Date).AddMonths(-$MaxAge).ToString("yyMM")
        # Grab version and convert to numerical format, 19041 and older do not have DisplayVersion so we grab ReleaseID
        if ((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion) {
            $Version = ((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion).replace('H1', '05').replace('H2', '11')
        } else {
            $Version = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").ReleaseId
        }
    }
    if ($OSname -match 'Windows 11') {
        # Adjustment for last version of Windows 10
        if ($Version -eq '22H2') {
            $MaxAge = 36
        } else { $MaxAge = $Win10MaxAge }
        $CurrentDate = (Get-Date).AddMonths(-$MaxAge).ToString("yyMM")
        # Grab version and convert to numerical format
        $Version = ((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion).replace('H1', '05').replace('H2', '11')
    }
    $Diff = $Version - $CurrentDate
    if ($Diff -lt '0') {
        Write-Host "$OSname $Version is over $MaxAge months old, needs upgrading"`n
        Rmm-Alert -Category "Monitor - Windows Update" -Body "$OSname $Version is over $MaxAge months old, needs upgrading"
        exit 1
    } else {
        Close-Rmm-Alert -Category "Monitor - Windows Update"
    }
} else {
    Write-Host "This script only supports Windows 10/11, exiting..."
}

# Check for disabled services
$DisabledServices = Get-Service WUAUServ, BITS, CryptSvc, RPCSS, EventLog | Where-Object -Property 'StartType' -eq 'Disabled'
if ($DisabledServices) {
    "Disabled Services:"
    $DisabledServices
    Rmm-Alert -Category "Monitor - Windows Update" -Body "Disabled Services: $DisabledService"
    exit 1
} else {
    Close-Rmm-Alert -Category "Monitor - Windows Update"
}

# Check if recent updates are installed
$WindowsUpdateObject = New-Object -ComObject Microsoft.Update.AutoUpdate

$SearchSuccessDate = $WindowsUpdateObject.Results | Select-Object LastSearchSuccessDate
$SSDLastDate = ([datetime]$SearchSuccessDate.LastSearchSuccessDate).AddHours($Offset)
$SSDDays = (New-TimeSpan -Start $SSDLastDate -End (Get-Date) | Select-Object Days).Days
Write-Host 'Last Search Success:' $SSDLastDate "($SSDDays days ago)"`n

$InstallSuccessDate = $windowsUpdateObject.Results | Select-Object LastInstallationSuccessDate
$ISDLastDate = ([datetime]$InstallSuccessDate.LastInstallationSuccessDate).AddHours($Offset)
$ISDDays = (New-TimeSpan -Start $ISDLastDate -End (Get-Date) | Select-Object Days).Days
Write-Host 'Last Installation Success:' $ISDLastDate "($ISDDays days ago)"`n

$Searcher = (New-Object -ComObject 'Microsoft.Update.Session').CreateUpdateSearcher()
$HistoryCount = $Searcher.GetTotalHistoryCount()

if ($HistoryCount -gt 0) {
    $xx = $Searcher.QueryHistory(0, $HistoryCount) | Where-Object { $_.Operation -like 1 -and $_.ResultCode -match '[123]' } | Select-Object Title
}

if (!$xx) {
    Write-Output 'WARNING - No updates returned'
    Rmm-Alert -Category "Monitor - Windows Update" -Body "WARNING - No updates returned"
} else {
    $LastMonth = (Get-Date).AddMonths(-1).ToString("yyyy-MM")
    $ThisMonth = (Get-Date).ToString("yyyy-MM")
    $xx = $xx | Where-Object { $_ -match "($LastMonth|$ThisMonth) (Security Monthly Quality Rollup for Windows|Cumulative Update for Windows)" -or $_ -match "Feature update" }
    if (!$xx -and $ISDDays -gt $Recent) {
        Write-Output "WARNING - No recent rollup/cumulative/feature update detected"
        Write-Output "Last updates:"
        $xx | Select-Object -ExpandProperty Title -First 1
        Rmm-Alert -Category "Monitor - Windows Update" -Body "WARNING - No recent rollup/cumulative/feature update detected"
        exit 1
    } else {
        Write-Output "Recent rollup or cumulative update detected:"
        $xx | Select-Object -ExpandProperty Title -First 1
        Close-Rmm-Alert -Category "Monitor - Windows Update"
    }
}