Get local date from Last Write Time

Content Authoring
1

I’m using this code to get the “Last Patched Date”:

(month of it as two digits & "/" & day_of_month of it as two digits & "/" & year of it as string) of (preceding texts of last " " of preceding texts of last " " of (it as string) of (maximum of last write times of keys whose (name of it contains ".KB" or name of it contains "_KB" or name of it starts with "KB") of keys( "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall";"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages";"HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Hotfix") of (registry; native registry)) as date)

The result is a date in MM/DD/YYYY format (which is what I want) however it’s not taking the time zone offset into account. How can I best manipulate this date to use the time zone offset to get the correct date?

2

As it’s retrieved now, it should show the date based on the client’s time zone. You can convert that to universal time before pulling the date if you like

q: ((maximum of last write times of keys whose (name of it contains ".KB" or name of it contains "_KB" or name of it starts with "KB") of keys( "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall";"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages";"HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Hotfix") of (registry; native registry)))
A: Wed, 15 Aug 2018 21:40:34 -0500
T: 61.010 ms
I: singular time

q: time (universal time zone) of ((maximum of last write times of keys whose (name of it contains ".KB" or name of it contains "_KB" or name of it starts with "KB") of keys( "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall";"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages";"HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Hotfix") of (registry; native registry)))
A: 02:40:34 +0000
T: 59.223 ms
I: singular time of day with time zone

q: date (universal time zone) of ((maximum of last write times of keys whose (name of it contains ".KB" or name of it contains "_KB" or name of it starts with "KB") of keys( "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall";"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages";"HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Hotfix") of (registry; native registry)))
A: Thu, 16 Aug 2018
T: 67.092 ms
I: singular date

I’d point out though that using ‘last write time’ would also get updated on a patch uninstall.

3

Is there a better way to find the last time a device was patched other than using this “last write time” method?

4

This topic may give you some ideas on alternate approaches: How to list last patch

5

Thanks. That thread has samples using WMI and I was trying to avoid doing that. Is WMI really the only way to get this information?