MS17-10 Audit

MS17-10 Audit script will check Windows Vista on up for the MS17-10 patch which re-mediates a vulnerability that is being used by ransomware. Writes to agent procedure log using $MS17$ and $OOD$ tags.
Limited testing has been done, please test in your environment
5-14-17 – Updated script to remove duplicate KB check.
5-15-17 – Updated to add all April/May roll-ups which contain the patch by default. This will eliminate false negatives.
5-22-17 – Updated to add missing KB4015550 check. (thanks Sal!)
<?xml version="1.0" encoding="utf-8"?>
<ScExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
  <Procedure name="MS17-10 check" treePres="3" id="800833215" folderId="63991881772349112817528314" treeFullPath="_VA Scripts.Patch Deployment">
    <Body description="">
      <Statement name="GetURL" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="URL" value="http://files.mymsp.com/downloads/microsoft/PatchCheck.txt" />
        <Parameter xsi:type="StringParameter" name="ResponseFileName" value="#vAgentconfiguration.AgentTempDir#\PatchCheck.ps1" />
        <Parameter xsi:type="BooleanParameter" name="WaitComplete" value="True" />
      </Statement>
      <If description="">
        <Condition name="Windows 32 or 64 Bit Check">
          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
        </Condition>
        <Then>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="powershell.exe -nologo -executionpolicy bypass -noprofile -file &quot;#vAgentconfiguration.AgentTempDir#\PatchCheck.ps1&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="True" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\" />
            <Parameter xsi:type="StringParameter" name="Value" value="" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="0" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
        <Else>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="powershell.exe -nologo -executionpolicy bypass -noprofile -file &quot;#vAgentconfiguration.AgentTempDir#\PatchCheck.ps1&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\" />
            <Parameter xsi:type="StringParameter" name="Value" value="" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="0" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Else>
      </If>
      <Statement name="GetVariable" continueOnFail="false">
        <Parameter xsi:type="EnumParameter" name="VariableType" value="FileContent" />
        <Parameter xsi:type="StringParameter" name="SourceContent" value="c:\temp\patchlog.txt" />
        <Parameter xsi:type="StringParameter" name="VariableName" value="patchlist" />
      </Statement>
      <If description="Windows Vista / 2008 Server (also Core)">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4012598" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows Vista / 2008 Server - KB4012598 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 7 / Server 2008 R2 =  March Security Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4012212" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 7 / Server 2008 R2 =  March Security Roll-up - KB4012212 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 7 / Server 2008 R2 -  Quality Rollup patch">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4012215" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 7 / Server 2008 R2 Quality Rollup - KB4012215 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 8.1 / Server 2012  R2  -  Security patch">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4012213" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 8.1 / Server 2012  R2 - KB4012213 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 8.1 / RT / Server 2012  R2  -  Security patch">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4012216" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 8.1 / RT / Server 2012  R2 - KB4012216 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Server 2012 (also Core)  -  March Security patch">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4012214" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Server 2012 (also Core)  March Security Rollup - KB4012214 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Server 2012 (also Core)  -  March Quality Rollup Patch">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4012217" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Server 2012 (also Core) March Quality Rollup Patch - KB4012217 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 - March Quality Rollup">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4012606" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 March Quality Rollup - KB4012606 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (ver 1511) - March Quality Rollup">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4013198" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (v1511) March Quality Rollup - KB4013198 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (ver 1607) / Server 2016 (also Core) - March Quality Rollup">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4013429" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (ver 1607) / Server 2016 (also Core) March Quality Rollup - KB4013429 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (ver 1607) / Server 2016 (also Core) - April Rollup">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015217" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (ver 1607) / Server 2016 (also Core)  - KB4015217 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (ver 1511) - April Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015219" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (ver 1511) - April Roll-up - KB4015219 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (ver 1511) - May Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4019473" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (ver 1511) - May Roll-up - KB4019473 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (ver 1507) - April Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015221" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (ver 1507) - April Roll-up - KB4015221 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (ver 1507) - May Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4019474" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (ver 1507) - May Roll-up - KB4019474 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (ver 1607) / Server 2016 (also Core) - May Rollup">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4019472" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (ver 1607) / Server 2016 (also Core) - May Rollup - KB4019472 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (1703) - May Quality Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015583" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (1703) - Quality Roll-up - KB4015583 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 10 (1703) - May Security Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4016871" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 10 (1703) - Security Roll-up - KB4016871 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 7 / Server 2008 R2 - April Security Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015546" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 7 / Server 2008 R2 - April Security Roll-up - KB4015546 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 7 / Server 2008 R2 - April Quality Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015549" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 7 / Server 2008 R2 - April Quality Roll-up - KB4015549 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 7 / Server 2008 R2 - May Quality Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4019264" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 7 / Server 2008 R2 - May Quality Roll-up - KB4019264 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 7 / Server 2008 R2 - May Security Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4019263" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 7 / Server 2008 R2 - May Security Roll-up - KB4019263 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 8.1 / RT / Server 2012  R2  - April Security Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015547" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 8.1 / RT / Server 2012  R2  - April  Roll-up - KB4015547 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 8.1 / RT / Server 2012  R2  - April Security Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015550" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 8.1 / RT / Server 2012  R2  - April  Roll-up - KB4015550 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 7 / Server 2008 R2 - May Quality Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4019215" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 7 / Server 2008 R2 - May Quality Roll-up - KB4019215 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Windows 8.1 / RT / Server 2012  R2  - May Security Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4019213" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 8.1 / RT / Server 2012  R2  - May Security  Roll-up - KB4019213 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Server 2012 (also Core)  -  May Security Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4019214" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 8.1 / RT / Server 2012  R2  - May Security  Roll-up - KB4019214 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Server 2012 (also Core)  -  May Quality Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4019216" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Windows 8.1 / RT / Server 2012  R2  - May Quality Roll-up - KB4019216 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Server 2012 (also Core)  -  April Quality Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015551" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Server 2012 (also Core)  - April Quality Roll-up - KB4015551 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Server 2012 (also Core)  -  April Security Roll-up">
        <Condition name="CheckVariable">
          <Parameter xsi:type="StringParameter" name="VariableName" value="#patchlist#" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
          <Parameter xsi:type="StringParameter" name="Value" value="KB4015548" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Server 2012 (also Core)  - April Securiyt Roll-up - KB4015548 Installed $MS17$" />
          </Statement>
          <Statement name="SetRegistryValue64" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
          <Statement name="SetRegistryValue" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
            <Parameter xsi:type="StringParameter" name="Value" value="1" />
            <Parameter xsi:type="EnumParameter" name="DataType" value="String" />
          </Statement>
        </Then>
      </If>
      <If description="Check for found Patch Flag">
        <Condition name="CheckRegistryValue64">
          <Parameter xsi:type="StringParameter" name="RegistryPath" value="HKEY_LOCAL_MACHINE\SOFTWARE\Kaseya\PatchFlag" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Equals" />
          <Parameter xsi:type="StringParameter" name="Value" value="0" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="MS017-10 NOT Installed $MS17$ $OOD$" />
          </Statement>
        </Then>
      </If>
      <Statement name="DeleteFile" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="Path" value="#vAgentconfiguration.AgentTempDir#\PatchCheck.ps1" />
      </Statement>
      <Statement name="DeleteFile" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="Path" value="c:\temp\patchlog.txt" />
      </Statement>
    </Body>
  </Procedure>
</ScExport>
MS17-10 Audit

How to Download Scripts

Login Here

Search

Get In Touch!

Additional Resources

About Us
