Never Fail a Patch Audit Again — Automate Your Windows Update Reports

C:\Scripts\PatchComplianceReport.ps1

# Windows Patch Compliance Reporter
# Automate & Operate — automateandoperate.com

# Settings — update these
$from = "[email protected]"
$to = "[email protected]"
$smtpServer = "smtp.gmail.com"
$smtpPort = 587
$username = "[email protected]"
$password = ConvertTo-SecureString "yourpassword" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($username, $password)
$logFile = "C:\Logs\PatchCompliance.log"
$reportFile = "C:\Logs\PatchComplianceReport.csv"

# Days threshold — flag servers not patched within this many days
$patchThresholdDays = 30

# List your servers here
$servers = @(
    "localhost",
    "SERVER01",
    "SERVER02"
)

# Create log folder if missing
if (-not (Test-Path "C:\Logs")) {
    New-Item -ItemType Directory -Path "C:\Logs"
}

$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$report = @()
$alertServers = @()

foreach ($server in $servers) {
    try {
        $hotfixes = Get-HotFix -ComputerName $server -ErrorAction Stop |
            Sort-Object InstalledOn -Descending |
            Select-Object -First 1

        $lastPatchDate = $hotfixes.InstalledOn
        $daysSinceLastPatch = (New-TimeSpan -Start $lastPatchDate -End (Get-Date)).Days
        $status = if ($daysSinceLastPatch -gt $patchThresholdDays) { "OVERDUE" } else { "OK" }

        $report += [PSCustomObject]@{
            Server            = $server
            LastPatchDate     = $lastPatchDate
            DaysSinceLastPatch = $daysSinceLastPatch
            LastHotfix        = $hotfixes.HotFixID
            Status            = $status
        }

        if ($status -eq "OVERDUE") {
            $alertServers += $server
        }

        Add-Content -Path $logFile -Value "$timestamp — $server — Last patched: $lastPatchDate ($daysSinceLastPatch days ago) — $status"

    } catch {
        $report += [PSCustomObject]@{
            Server            = $server
            LastPatchDate     = "UNREACHABLE"
            DaysSinceLastPatch = "N/A"
            LastHotfix        = "N/A"
            Status            = "ERROR"
        }
        Add-Content -Path $logFile -Value "$timestamp — $server — ERROR: $_"
    }
}

# Export CSV report
$report | Export-Csv -Path $reportFile -NoTypeInformation

# Build email body
$emailBody = "Windows Patch Compliance Report — $timestamp`n"
$emailBody += "Generated on: $env:COMPUTERNAME`n"
$emailBody += "Threshold: Servers not patched in $patchThresholdDays days flagged as OVERDUE`n`n"
$emailBody += "SERVER SUMMARY:`n"
$emailBody += "=" * 60 + "`n"

foreach ($entry in $report) {
    $emailBody += "Server: $($entry.Server)`n"
    $emailBody += "Last Patch: $($entry.LastPatchDate)`n"
    $emailBody += "Days Since Patch: $($entry.DaysSinceLastPatch)`n"
    $emailBody += "Status: $($entry.Status)`n"
    $emailBody += "-" * 40 + "`n"
}

if ($alertServers.Count -gt 0) {
    $emailBody += "`nACTION REQUIRED — Overdue servers:`n"
    $alertServers | ForEach-Object { $emailBody += "  - $_`n" }
}

$emailBody += "`nFull CSV report saved to: $reportFile`n"
$emailBody += "`nAutomate & Operate — automateandoperate.com"

# Send report
$subject = if ($alertServers.Count -gt 0) {
    "PATCH ALERT: $($alertServers.Count) overdue server(s) detected"
} else {
    "Patch Compliance Report — All servers up to date"
}

Send-MailMessage `
    -From $from -To $to `
    -Subject $subject `
    -Body $emailBody `
    -SmtpServer $smtpServer -Port $smtpPort `
    -UseSsl -Credential $credential

-ExecutionPolicy Bypass -File "C:\Scripts\PatchComplianceReport.ps1"

powershell.exe -ExecutionPolicy Bypass -File "C:\Scripts\PatchComplianceReport.ps1"