DFIRHub

Windows registry artifactMicrosoft Exchange Patch Status

Displays the date the patch was installed on this host

  • Microsoft Exchange
  • 4 keys
  • SOFTWARE

Registry keys

4 keys that RECmd reads for this artifact

  • SOFTWAREInstalledDate
    Microsoft\Updates\Exchange*\KB*

    Displays the date the patch was installed on this host

  • SOFTWAREPackageName
    Microsoft\Updates\Exchange*\KB*

    Displays the name of the patch installed on this host

  • SOFTWAREInstalledDate
    Microsoft\Updates\Exchange*\SP*\KB*

    Displays the date the patch was installed on this host

  • SOFTWAREPackageName
    Microsoft\Updates\Exchange*\SP*\KB*

    Displays the name of the patch installed on this host

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)