How to prove Windows patch is relevant

Usage and Config Patch
1

Hi All,

I am looking for some suggestions on how to work though patches that are reporting relevant but other sources are saying they are not needed.

We are trying to use BigFix as a double check to SCCM to validate patches are installed. Since the SCCM people are sure of their product, I need to make sure I am confident in what BigFix is reporting. This used to be pretty easy as the relevance was small and I could work through it, but now with these rollup patches, it is very difficult, if not impossible to work this.

Note: I set the “_BESClient_WindowsOS_EnableSupersededEval” setting so that I can evaluate superseded content.

I am especially concerned with the following patches showing as relevant on all my Win7 64 bit systems
MS17-NOV: Security Monthly Quality Rollup - Monthly Rollup - Windows 7 SP1 - KB4048957 (x64) (Superseded)
MS17-DEC: Security Monthly Quality Rollup - Monthly Rollup - Windows 7 SP1 - KB4054518 (x64) (Superseded)
MS18-JAN: Security Monthly Quality Rollup - Monthly Rollup - Windows 7 SP1 - KB4056894 (x64) (Superseded)

But the patch
MS18-MAR: Security Monthly Quality Rollup - Monthly Rollup - Windows 7 SP1 - KB4088875 (x64) (Superseded)

Is not showing relevant. My understanding is that if the March 2018 patch is installed, it should make the older ones no longer relevant.

It could be that this is something that is specific to these rollups as these seem to be the ones showing up.

Thanks

2

With those monthly rollups, it seems that when I run them manually, they are reporting that they are not needed. So maybe in the case of these rollups the relevance does not work as I expected.

3

We have had a similar issue with Nessus scans claiming that a patch is needed when it was superseded a while ago - usually if you scroll to the bottom where Nessus shows WHY it thinks the patch is missing there is a single file that is the wrong version, or a missing registry entry - we have been able to remediate several cases where manually installing the patch failed as not applicable - but making the registry entry corrected it to where Nessus no longer alerts on it.