Security Patch/KB Install Date
How to determine installation time of a specific security patch/update/KB package based on registry key values.
There may be times when you need to determine when a security update was installed. This is obviously a lot easier if you had access to a live machine to run live queries (see here for PowerShell queries) however that's not always possible. You may only have a limited logical collection, triage collection (collected by CyLR/UAC etc), or are working from a limited backup.
Installed security packages are located at the following location;
Each key references a specific package
Keys may contain the following values;
SelfUpdate (0 for manual updates, 1 for automatic updates)
InstallTimeHigh
InstallTimeLow
InstallUser (SID of the user who installed the package)
Even though the key "Package_8_for_KB4033393~..." contains a corresponding 'last write timestamp' of 2022-07-14 01:47:25 (UTC), I wanted to validate this against the values within the key itself based on the InstallTimeHigh and InstallTimeLow timestamps.
I found a BigFix article which referenced the following formula used to calculate the corresponding timestamp.
Timestamp = InstallTimeHigh * 2^32 + InstallTimeLow
2 ^ 32 is 4294967296
In the above example, our formula would look like this;
Timestamp = (30971683 * 4294967296) + 2864280153
Timestamp = (133022365587079168) + 2864280153
Timestamp = 133022368451359321
Converter: https://www.epochconverter.com/ldap
❗Note: if you mount the SOFTWARE hive on another machine and export the key/value as a text file, the corresponding date/timestamp will be adjusted for the host machine's local time.❗
Last updated
