Analysis for 2020-05 Monthly Cumulative Patch - Need Help

I have created this analysis which checks the registry for the Monthly Cumulative patch for each of the various OS (Server 2008 - Server 2019) and confirms Install Status. The resulting data is correct but analysis is slow enough that for some reporting servers it times out and you have to send a refresh to get a result. Can someone help me improve the performance of this analysis?

(if (exists keys whose ((value “InstallName” of it as string contains “KB4556860”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) OR (exists keys whose ((value “InstallName” of it as string contains “KB4556854”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) OR (exists keys whose ((value “InstallName” of it as string contains “KB4556836”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) OR (exists keys whose ((value “InstallName” of it as string contains “KB4556843”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) OR (exists keys whose ((value “InstallName” of it as string contains “KB4556840”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) OR (exists keys whose ((value “InstallName” of it as string contains “KB4556852”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) OR (exists keys whose ((value “InstallName” of it as string contains “KB4556846”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) OR (exists keys whose ((value “InstallName” of it as string contains “KB4556853”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) OR (exists keys whose ((value “InstallName” of it as string contains “KB4556813”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) OR (exists keys whose ((value “InstallName” of it as string contains “KB4551853”) AND (value “CurrentState” of it as string contains “112”)) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries)) then “Installed” else “Not Installed” )

I think one issue is that for each OR, you are rescanning every key of Component Based Servicing\Packages again, and there may be many keys there. It may perform better to scan all the keys once, and check for the conditions inside a single whose() instead. Here’s an example I think would work for the first two packages (but I’m typing in a phone and can’t test)

if (exists keys whose (value “CurrentState” of it as integer  = 112 AND  (value “InstallName” of it as string contains “KB4556860” OR value “InstallName” of it as string contains “KB4556854”)  ) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages” of (x64 registries; x32 registries) ) then "Installed" else "Not Installed"
1 Like

That makes sense. I will update and report back.

Much better. Thank you!

1 Like