Powershell Script To Report MS Updates Compliance Status on SCCM Client

I have recently been working on writing a Server Build Audit in Powershell. One of the difficult things to validate was whether or not a server had applied all of the required Microsoft Security Updates. We use SCCM 2007 for our Microsoft Patch deployment, and I have created SQL reports that put all of this information together from the database. I knew that most of the database structure and content also resides in the Site Systems WMI repository (root\sms\site_[sitecode]). After digging around, I eventually found this information and decided to post it here.

-----------------------------------------------------
param ($siteSystem, $siteCode)
#Get the Client Name
$system = Get-WmiObject Win32_ComputerSystem
$systemName = $system.Name

#Query the Site Systems WMI for the Clients ResourceID
$sccmSystem = Get-WmiObject -computerName "$siteSystem" -namespace "root\sms\site_$siteCode" -class "SMS_R_System" -Filter "NetbiosName = '$systemName'"
$sccmID = $sccmSystem.ResourceID

#Query for the compliance status of the Client
$CIs = Get-WmiObject -computerName "$siteSystem" -namespace "root\sms\site_$siteCode" -class "SMS_UpdateComplianceStatus" -Filter "MachineID = '$sccmID'"

#Match the various Updates the client has reported to the details of the update
Foreach ($CI in $CIs) { $currCI = $CI.CI_ID
$update = Get-WmiObject -computerName "$siteSystem" -namespace "root\sms\site_$siteCode" -class "SMS_SoftwareUpdate" -Filter "CI_ID = '$currCI'"

#I have filtered for only security updates, hence the -like MS*
if ($update.BulletinID -like 'MS*')
{ if ($CI.Status -eq '3') { $tf = "Installed" }
else { $tf = "Applicable" }

$msNum = $update.BulletinID
$item = $update.LocalizedDisplayName

write-host $msNum
write-host $item
write-host $tf
write-host "-*-*-*-*-*-*-*-*-*-*-*-*-*-*-"
}
}

-----------------------------------------------------

To use this script, simply copy the text between the "------", paste it in to a text file (Notepad), and save it as "msUpdates.ps1". To run the script,
Open PowerShell

1. Make sure that you have set the execution policy to at least remoteSigned
2. cd to the directory where you've saved msUpdates.ps1
3. Run the following: ./msUpdates "[SCCM Site System]" "[SCCM Site Code]"
   

I have provided variables so that you can output the results however you wish. Here, I have simply printed the output to the console.