banshee/windows-collection/windows/ssh/updates

Updates of a Windows, by SSH

Returns the updates waiting to be installed on a Windows, the critical ones among them, whether an installed update asks for a restart, and how old the last successful search for updates is. Four watches are proposed, each one set on the probe.

Versions

Windows Server 2012 and later, Windows 8 and later: Windows PowerShell 3.0, which the collector needs, ships with each of them; the OpenSSH server is built in from Windows Server 2019 and Windows 10 1809, installed from Win32-OpenSSH before. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real Windows.

How it works

The collector runs one PowerShell command that reads the Windows Update agent, through its COM objects Microsoft.Update.Session, Microsoft.Update.SystemInfo and Microsoft.Update.AutoUpdate:

powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference = 'Stop'; $searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher(); $searcher.Online = $false; $updates = @($searcher.Search('IsInstalled=0 and IsHidden=0').Updates); ConvertTo-Json -Compress -InputObject @{pending = $updates.Count; critical = @($updates | Where-Object MsrcSeverity -eq 'Critical').Count; reboot = (New-Object -ComObject Microsoft.Update.SystemInfo).RebootRequired; hours = [long]((Get-Date).ToUniversalTime() - (New-Object -ComObject Microsoft.Update.AutoUpdate).Results.LastSearchSuccessDate).TotalHours}"

The search is made offline: Windows answers from the result of its own last search, without asking Windows Update or the WSUS server. Nothing is downloaded and nothing is installed; the run stays short.
That result may be old: the age of the last successful search, in days, says how much the count is worth, and has its own watch.
The updates waiting are those not installed and not hidden; the critical ones are those Microsoft rates Critical (MsrcSeverity), a rating that is the same whatever the language of Windows.
The restart is yes when an installed update waits for it, no otherwise.
A failed search stops the command with no answer, and the collector as misconfigured, rather than return zero updates.
Nothing is skipped at the first run.

Nothing is written to the Windows: the command only reads.

Prerequisites

The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).
Windows searching for updates by itself, from Windows Update or a WSUS server: the collector only reads the result.

Outputs

Name	Label	Unit	Per instance
`pending`	Updates waiting	—	no
`critical`	Critical updates waiting	—	no
`reboot`	Restart required	—	no
`search-age`	Last successful search	d	no

Watches

Name	Title	Kind	Defaults	Checked by default
`critical-pending`	Critical updates waiting	above a threshold, on `critical`	warning above 0; no critical	yes
`pending`	Updates waiting	above a threshold, on `pending`	no threshold: to set on the probe	no
`reboot-required`	Restart required	state to avoid, on `reboot`	warning on `yes`; no critical	yes
`search-old`	No search for updates	above a threshold, on `search-age`	warning above 7 days, critical above 30 days	yes

Limits

The count is that of the last search Windows made: an update published since is not counted until Windows searches again.
A Windows that never searched, or whose updates are managed by another tool than the Windows Update agent, has no result to read: the collector stops as misconfigured, or "No search for updates" raises.
Not yet checked on a real Windows: the offline search and the reading of LastSearchSuccessDate by an account without administrator rights, and that LastSearchSuccessDate is given in UTC.