How to List All Installed Windows Updates (Hotfixes) in Batch Script

Auditing a system's patch level is a fundamental task for maintaining security and stability. For system administrators and developers, being able to quickly generate a list of all installed "Hotfixes" (Windows Updates) is essential for compliance checks and troubleshooting software conflicts. While the Windows Settings menu provides a visual list, a Batch script can export this data to a text file, CSV, or a network share for centralized analysis.

This guide explores the most effective ways to extract a complete list of installed updates using the wmic, systeminfo, and PowerShell commands.

Why Use a Batch Script to List Updates?

• Automation: Easily gather data from hundreds of machines across a network.
• Reporting: Export the list to a readable format (.txt, .csv) for inclusion in documentation or audits.
• Speed: Query the update database directly without opening the heavy "Settings" application.
• Offline Access: Save the list of updates before performing an offline system repair.

Method 1: Using WMIC (Best for Formatting)

The Windows Management Instrumentation Command-line (wmic) allows you to select exactly which pieces of information you want (like the KB ID and the installation date) and can output directly to CSV format.

Basic List to Console

@echo off
echo [PROCESS] Retrieving installed updates...
wmic qfe get HotFixID,InstalledOn,Description
pause

Exporting to a CSV File

For analysis in Excel, you can use the /format:csv switch:

@echo off
setlocal

set "OUT_FILE=%userprofile%\Desktop\UpdateList.csv"

echo [PROCESS] Exporting updates to CSV...
wmic qfe get HotFixID,Description,InstalledOn /format:csv > "%OUT_FILE%"

rem Remove the blank first line that wmic /format:csv produces
findstr /v /r "^$" "%OUT_FILE%" > "%OUT_FILE%.tmp"
move /y "%OUT_FILE%.tmp" "%OUT_FILE%" >nul

echo [SUCCESS] File saved to: %OUT_FILE%
endlocal
pause

Method 2: Using the systeminfo Utility

If you need a more human-readable list without dealing with the complexities of WMI, the systeminfo command is a classic alternative. It provides the KB numbers along with general system details.

@echo off
echo [PROCESS] Gathering hotfix information...
systeminfo | findstr /i /c:"Hotfix(s)" /c:"KB"
pause

Method 3: Using PowerShell (Recommended)

PowerShell's Get-HotFix cmdlet is the modern replacement for wmic qfe and works reliably on all current Windows versions:

@echo off
echo [PROCESS] Retrieving installed updates via PowerShell...
powershell -noprofile -command "Get-HotFix | Format-Table -AutoSize HotFixID, Description, InstalledOn"
pause

Exporting to CSV via PowerShell

@echo off
setlocal

set "OUT_FILE=%userprofile%\Desktop\UpdateList.csv"

echo [PROCESS] Exporting updates to CSV...
powershell -noprofile -command "Get-HotFix | Select-Object HotFixID, Description, InstalledOn | Export-Csv -Path '%OUT_FILE%' -NoTypeInformation"

echo [SUCCESS] File saved to: %OUT_FILE%
endlocal
pause

Creating a Robust Audit Script

The following script generates a professional-looking report of all installed updates, including the machine name and the date of the audit. It tries wmic first and falls back to PowerShell if unavailable.

@echo off
setlocal enabledelayedexpansion

rem Define the output file
set "OUT_FILE=%userprofile%\Desktop\UpdateAudit_%COMPUTERNAME%.txt"

echo ============================================================
echo   Windows Update Audit Tool
echo ============================================================

rem 1. Write header information
(
    echo Audit Date: %date% %time%
    echo Computer Name: %COMPUTERNAME%
    echo User: %USERNAME%
    echo ------------------------------------------------------------
) > "%OUT_FILE%"

rem 2. Attempt to query installed hotfixes
echo [PROCESS] Querying Windows for installed hotfixes...

where wmic >nul 2>&1
if !errorlevel! equ 0 (
    echo [INFO] Using wmic...
    wmic qfe get HotFixID,Description,InstalledOn /format:table >> "%OUT_FILE%" 2>&1
) else (
    echo [INFO] wmic not available, using PowerShell...
    powershell -noprofile -command "Get-HotFix | Format-Table -AutoSize HotFixID, Description, InstalledOn | Out-String" >> "%OUT_FILE%" 2>&1
)

rem 3. Verify output file has content beyond the header
for %%A in ("%OUT_FILE%") do set "fileSize=%%~zA"
if !fileSize! lss 300 (
    echo [WARNING] Report may be incomplete. Check WMI service status.
) else (
    echo [SUCCESS] Report generated: %OUT_FILE%
)

echo ============================================================
endlocal
pause

Common Pitfalls and How to Avoid Them

Unexpected Date Formats

In older versions of Windows 10, the "InstalledOn" property might return a hex-style date or a different format than your local system.

Wrong Way:

:: Assuming the date is always MM/DD/YYYY
for /f "tokens=2" %%d in ('wmic qfe get InstalledOn') do ...
:: This will break if the WMI output format changes.

Correct Way: Always treat the InstalledOn field as a string and don't try to perform mathematical operations on it within a pure Batch environment without careful parsing.

Silent Failures

If the "WMI" service is disabled on the machine, the wmic command will fail silently or return an empty list.

Advanced: Sorting and Filtering

You might only want to see "Security Updates" or updates matching a specific description. You can filter the WMI query directly:

:: List only Security Updates
wmic qfe where "Description='Security Update'" get HotFixID,InstalledOn

Or with PowerShell:

powershell -noprofile -command "Get-HotFix | Where-Object { $_.Description -eq 'Security Update' } | Format-Table -AutoSize"

Conclusion

Listing all installed Windows updates via Batch script is a critical capability for system auditing and troubleshooting. By utilizing wmic for legacy compatibility, systeminfo for quick checks, and PowerShell's Get-HotFix as the modern standard, you can maintain a clear view of your system's patch history. Whether you are generating a CSV for a compliance officer or checking for a specific patch to fix a bug, these commands provide a reliable and efficient way to interact with the Windows update database. Always remember to export your results to a file for better long-term tracking and easier cross-reference across your infrastructure.