Video Screencast Help

Create a SCSP alert when windows updates are installed

Created: 07 Aug 2013 • Updated: 07 Aug 2013 | 4 comments

I am looking for assistance in creating an alert that will email several of my colleagues when windows updates are being installed. I am using SCSP 5.2.9 670.

I need to do this for windows servers 2003 & 2008 R2.

Operating Systems:

Comments 4 CommentsJump to latest comment

Chuck Edson's picture

If they are relying on the Windows Update Service (WUS), you can use a prevention policy to "allow but log" access to the executables that make up the WUS.  I know of wuapp.exe, but there may be more.  

It will take some profiling to see what executables are used, and when they are used (ie, will you get an alert that the executable ran when it is just checking to see if there are updates out there waiting to be downloaded?)

If you are using a non-windows patch management solution, you will have to profile that application.  

You could also potentially do this using a detection policy, if you can get Windows to log the start of the WUS process in the Windows Event Log.  Once you know what Windows events you are looking for, use a Windows Template Detection policy to monitor the event logs for the specific data and trigger an alert.  I have not done this, and after a quick test in my lab, in 2k3 it appears that WUS activity is not logged by Windows by default.

If a post helps you, please mark it as the solution to your issue.

Chuck Edson's picture

Actually, after further Windows log review, I do see events in the System log AFTER the update has completed, but apparantly not when it starts.

On Win2k3, look for Event ID's 19, 4377, and 21. 

If a post helps you, please mark it as the solution to your issue.

vmtech2013's picture

What about 2k8 ? are the event ID's different? also can i add multiple event id's to one alert rule?

 NT event ID > contains> 19, 21, 4377?

RCMZZ's picture

If you have all three in the alert then the event will have to contain all three to create the alert. The rules in an alert are not “or” then they are “and”. For instance if you put event contains win ID 19,21,4377 the event must contain all three to be triggered.

Event ID’s can differ from build to build of windows a quick Google search will let you know.