Collect hotfix history
Documentation: Microsoft Learn
Get-HotFix wraps the Win32_QuickFixEngineering class and returns one row per servicing update.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 25 HotFixID,InstalledOn,Description- Stage 1Get-HotFix
Positional values or no named parameters - Stage 2Sort-Object
-Descending - Stage 3Select-Object
-First
How it works
Get-HotFix wraps the Win32_QuickFixEngineering class and returns one row per servicing update. Sort-Object orders by InstalledOn newest first, and -First 25 keeps the recent history rather than everything applied since the image was built.
Adapting it
For a yes-or-no question about one update, drop the sort and trim entirely and use Where-Object HotFixID -eq 'KB5034129' instead.
If the result is unexpected
A KB the vendor insists is installed does not appear, or InstalledOn is blank for several rows so the sort places them in an arbitrary order.
This class reports only what the servicing stack recorded as quick-fix engineering entries, which excludes driver updates, Store updates, and anything delivered as a feature upgrade. The InstalledOn value comes from a field some packages never populate, and sorting on a null puts those rows wherever the comparer happens to land them.
- Cross-check the Setup event log, which records what was installed and when it happened.
- Query update history through the Microsoft.Update.Session COM object for a fuller picture.
- Compare the OS build and revision against the level the KB is documented to produce.
- Drop rows where InstalledOn is null before sorting so the order becomes meaningful.
- Check whether the update was superseded, since a superseded KB legitimately vanishes from this view.
Validate the result
The build and revision on the machine match the level the KB is documented to produce, which settles the question whatever this listing shows.
Keep the check reliable
Report patch state from the OS build revision rather than a KB list, because a build number cannot be missing the way an inventory entry can.
