WSL (Windows Subsystem for Linux)

Just curious if you know if your users are leveraging WSL.

If so do you mind sharing how you are handling patch of the WSL kernel version:

  • you are allowing WindowsUpdate to update the WSL kernel
  • packaging the updates yourself (submitted idea for HCL content as https://bigfix-ideas.hcltechsw.com/ideas/BFPTCH-I-237 if you care to upvote)
  • are not patching (probably won’t get many publically saying this :wink:).

Its been a while since I looked at this but a couple of things I discovered a when looking at WSL on Win10 builds from 2 years or so ago was it is possible to detect if the feature is active via relevance.

Q: exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Notifications\OptionalFeatures\Microsoft-Windows-Subsystem-Linux" whose (exists value "Selection" whose (it = 1) of it) of native registry
A: True
T: 77.615 ms
I: singular boolean

I was also able to find what appeared to be a way of detecting if subsystems were installed by inspecting the app manifests, which then gets acces to Displayname and Version of each installed subsystem.

Q: unique values of (((select "/Package/Properties/DisplayName" of it as text) & " " & (node value of attribute "Version" of select "/Package/Identity" of it)) of xml documents of files "AppxManifest.xml" of folders whose (name of it contains "SUSE" or name of it contains "Ubuntu" or name of it contains "Kali" or name of it contains "Debian" or name of it contains "Linux") of folder "C:\Program Files\WindowsApps")
A: Debian 1.12.2.0
A: Kali Linux 1.12.0.0
A: SUSE Linux Enterprise Server 12 1.1.0.0
A: SUSE Linux Enterprise Server 15 SP1 1.1.0.0
A: Ubuntu 16.04 LTS 1604.2020.824.0
A: Ubuntu 18.04.5 on Windows 1804.2020.826.0
A: Ubuntu 18.04.5 on Windows 1804.2020.827.0
A: openSUSE Leap 42 1.1.0.0
T: 77.411 ms
I: plural string with multiplicity

Beyond that, I haven’t looked any further but hopefully this may help you in some way with discovery