| Description | This article describes that Security or Critical Updates Scan fails although there are no updates from Windows Update service in the GUI of the host. |
| Scope | FortiNAC , FNAC-F. |
| Solution | The FortiNAC agent is not responsible for checking for specific updates it instead leverages the host's update service and configurations set by the policies The WindowsUpdateAgent is queried using an ISearcher to search for updates that are:
Not all updates are visible in the GUI of the host. Recent issues stem from this update.
This simplified command will work on all Windows versions.
(New-Object -ComObject Microsoft.Update.Session).CreateupdateSearcher().Search("IsInstalled=0").Updates | Select-Object Title
This will return ALL results of not-installed patches or updates.
Because there is at least one Security update this host will fail.
If the WindowsUpdateAgent is unable to reach its server it will throw an error but this is not visible to the FortiNAC Agent. An error will return no results meaning the host will PASS. Alternatively, the scan may just hang altogether, see the KB article here for further troubleshooting if the WindowsUpdateAgent is unable to reach its configured server. C:\ProgramData\BradfordNetworks\general.txt
2024-02-27 18:41:07 UTC :: Info: andTask/andTask/2024-01 Security Update for Windows 10 Version 22H2 for x64-based Systems (KB5034441);
If it is not possible to remove the availability of the patch, the host will continue to fail. Recommendations are to use Audit-Only until the patch can be installed or use Delayed Remediation to allow the host additional time to install the patch.
For instructions on adding or modifying a scan: |
