How to Check Windows Patches on Server 2019

AvatarByEric Dawson Computers & Software

Windows Server 2019 gives you several reliable ways to check installed patches: the Settings app, Control Panel, PowerShell’s Get-HotFix cmdlet, and the wmic qfe list command. Settings shows updates delivered through the Windows Update Agent, reached at Settings, then Update & Security, then Windows Update, then View update history. Get-HotFix and wmic both read the Component-Based Servicing store instead, so they also catch patches installed by hand as .msu files, something Settings misses on its own. Control Panel, systeminfo.exe, SConfig on Server Core, and the optional PSWindowsUpdate module round out the full list, each suited to a different situation, from a five-second GUI glance to a scripted audit across dozens of remote servers.

Check Patches with the Settings App

The Settings app lists installed patches at Settings, then Update & Security, then Windows Update, then View update history, where entries appear grouped as Quality Updates, Driver Updates, and Definition Updates. Each entry shows the update name, the date it installed, and its current status. Selecting Check for updates, or Check online for updates from Microsoft Update, shows what is available before you install anything. Only updates that went through the Windows Update Agent client show up here, so a patch installed manually will not appear in this list at all.

  1. Open Settings: click Start, then click Settings.
  2. Update & Security: select Update & Security.
  3. Windows Update: select the Windows Update tab on the left side of the window.
  4. View update history: click View update history to see every installed entry grouped by Quality, Driver, and Definition updates.

Check Patches with Control Panel

Control Panel gives a more complete view through Programs, then Programs and Features, then View installed updates. That path reads from the Component-Based Servicing store rather than the Windows Update Agent logs, so it also lists security updates applied manually as .msu files with wusa.exe, updates that Settings never shows. Sorting is available by name, installation date, or KB number, which makes it easier to scan a long patch history. For a complete inventory on Server 2019, check both Settings and Control Panel, since neither one alone tells the full story. Sorting by KB number makes it quick to confirm whether one specific patch, cited in a security bulletin or a vendor advisory, has actually reached the server.

  1. Open Control Panel: type Control Panel into the Start menu search box and open it.
  2. Programs: click Programs.
  3. Programs and Features: click Programs and Features.
  4. View installed updates: click View installed updates in the left pane for the full, sortable list.

Check Windows Patches on Server 2019 with PowerShell Get-HotFix

PowerShell’s Get-HotFix cmdlet returns every hotfix recorded in the Component-Based Servicing store on the local machine, simply by running Get-HotFix from a PowerShell window. Behind the scenes it queries the Win32_QuickFixEngineering WMI class, and the results include the Source, Description, HotFixID, InstalledBy, and InstalledOn properties for every entry. The -ComputerName parameter points the same cmdlet at a remote machine without requiring PowerShell remoting to be set up first, and -Credential supplies alternate credentials when the account running the query needs different rights on that remote server.

  1. Open PowerShell: click Start, type PowerShell, then choose Run as administrator.
  2. List every hotfix: type Get-HotFix and press Enter.
  3. Filter by KB number: type Get-HotFix -Id KB957095 to check a single patch.
  4. Query a remote server: type Get-HotFix -ComputerName SERVERNAME to check another machine from the same window.

Filter Get-HotFix Results

Get-HotFix accepts a HotFixID directly, so Get-HotFix -Id KB957095 returns just that single patch instead of the entire list. Wildcards work with the -Description parameter too, and Get-HotFix -Description "Security*" narrows the output to hotfixes whose description starts with Security. Piping the results through Sort-Object finds the single most recent patch: (Get-HotFix | Sort-Object -Property InstalledOn)[-1] returns the last entry once everything is sorted by installation date. Saving that output is one more step: Get-HotFix | Export-Csv patches.csv writes the whole list to a spreadsheet-ready file for an audit trail.

Check Patches from the Command Prompt with WMIC

WMIC lists installed updates when you run wmic qfe list from a Command Prompt window, showing the HotFixID, Description, and InstalledOn columns along with a few extra fields. Adding more detail is as simple as running wmic qfe list full instead. Redirecting that output to a text file, for example with wmic qfe list full > patches.txt, creates a record you can keep for compliance or attach to a support ticket. WMIC also checks individual file versions with a command such as wmic datafile where name="C:\Windows\System32\ntoskrnl.exe" get version, which is useful when you need to confirm a specific patched file rather than a KB number.

  1. Open Command Prompt: click Start, type cmd, and open Command Prompt (choose Run as administrator to see every field).
  2. List patches: type wmic qfe list and press Enter.
  3. Full detail: type wmic qfe list full for extra fields.
  4. Save a copy: type wmic qfe list full > patches.txt to write the list to a text file.

Check Patches with Systeminfo

Systeminfo.exe, run from an administrative Command Prompt, gives a baseline patch status alongside general system details. Its output covers far less than Get-HotFix or wmic qfe list, and it lists hotfixes without the same depth of installation dates or descriptions. Still, it works as a fast sanity check when you only need to confirm that a machine has been patched at all, without digging into individual KB numbers. Pair it with Get-HotFix or wmic qfe list whenever the task calls for the actual KB numbers behind that baseline status rather than a general summary.

Check Patches on Server Core with SConfig

SConfig gives Server Core installations a menu-driven way to review updates, reached by opening PowerShell and typing sconfig. Reviewing updates this way, before committing to install them, matters most on production servers where an unplanned reboot carries a real cost.

  1. Open SConfig: open PowerShell on the Server Core machine and type sconfig.
  2. Windows Update menu: enter 6 at the sconfig menu to open the Windows Updates option.
  3. View all updates: type a to list every available update without installing anything.
  4. View recommended updates: type r to narrow that list to only the recommended ones.

See Pending Updates First with the PSWindowsUpdate Module

PSWindowsUpdate is an optional PowerShell module that adds the Get-WindowsUpdate command for reviewing what is available before anything downloads. Installing the module comes first, after which Get-WindowsUpdate lists pending updates without triggering the automatic downloads that the Settings app can start on its own. That makes it useful on a production server where visibility into what is coming matters more than installing it right away.

  1. Open PowerShell: run it as administrator, since the module needs elevated rights to install.
  2. Install the module: add PSWindowsUpdate from an administrative session before the Get-WindowsUpdate command becomes available.
  3. List pending updates: run Get-WindowsUpdate to see what Microsoft has for the server without installing any of it.

Compare the Patch-Checking Methods

Seven methods cover checking patches on Server 2019, and they differ mainly in whether they catch manually installed updates, whether they reach a remote machine, and whether administrator rights are required. The table below lines up all seven against those same points.

Method Access Point Shows Manual Updates Shows Settings Updates Remote Access Requires Admin Best For
Settings Settings app UI No Yes No Not required Quick GUI review of WUA updates
Control Panel Graphical interface Yes Yes No Not required Comprehensive patch inventory
PowerShell Get-HotFix Command line Yes Yes Yes (via -ComputerName) Yes Scripting and remote queries
WMIC Command prompt Yes Yes No Yes Legacy systems, file export
Systeminfo Command prompt Limited Limited No Yes Quick baseline check
SConfig Server Core menu Yes Yes No No Server Core installations
PSWindowsUpdate PowerShell module Yes Yes Possible (with Invoke-Command) Yes Pre-installation review

Command-line methods, specifically Get-HotFix and WMIC, are the only two that reach a remote computer without extra setup, which matters once you manage more than a handful of servers. GUI methods stay faster for a single quick look on the machine you are already logged into, and SConfig remains the only realistic option once a Server Core installation has no desktop shell to open. A team responsible for dozens of servers usually settles on Get-HotFix for routine audits and keeps the Settings app for the occasional one-off check on a single box.

I would trust Control Panel more than Settings when the question is whether a server has every relevant installed patch. Settings is convenient for a quick look at updates delivered through the normal update process, but it leaves out manually installed .msu security updates. Control Panel is the safer first check because it includes both paths. For several servers, I would then use Get-HotFix to make the same review practical from one administrative workstation.

Why Settings and Control Panel Show Different Results

Settings and Control Panel read from two separate tracking systems, which is why the same server can show a different update history in each place. One pulls its list from Windows Update Agent client logs; the other reads directly from the Component-Based Servicing store, and the two do not always match. Security updates installed as standalone .msu files through wusa.exe show the gap clearly: those appear in Control Panel but never in the Settings app’s update history. A discrepancy here does not mean anything is broken, only that one view is incomplete. Get-HotFix and wmic qfe list both read the Component-Based Servicing store as well, so they tend to agree with Control Panel rather than Settings.

Getting a Complete Patch List

Combining two sources closes the gap for good. Check Settings for Windows Update Agent history, then check Control Panel, Get-HotFix, or wmic qfe list for anything installed outside that agent, such as a manually applied .msu file. Together those views account for every patch on the server, whichever route delivered it. A compliance audit or change record that only cites the Settings history risks missing exactly the manual patches an auditor is most likely to ask about, so lean on Get-HotFix or wmic qfe list as the source of record when a report needs to hold up under review.

Frequently Asked Questions

How Do I Check Which Updates Are Missing on Server 2019?

Compare what Windows Update reports as available under Settings, then Windows Update, then Check for updates, against what Get-HotFix or wmic qfe list already shows as installed. Anything listed as available but not in either installed list is missing. Running Get-WindowsUpdate from the PSWindowsUpdate module gives the same available-updates view from PowerShell, without starting an automatic install the way Settings does. Cross-checking against Control Panel catches anything installed manually that neither Windows Update view ever tracked in the first place.

Does Get-HotFix Show Every Installed Patch?

Not quite. Get-HotFix reads the Component-Based Servicing store, so updates delivered through Microsoft Installer packages or a direct Windows Update site install can fall outside what it reports. For the most complete picture, pair Get-HotFix with Control Panel’s Programs and Features, which draws on the same Component-Based Servicing data but sometimes surfaces items Get-HotFix leaves out. Treat a single command as one data point rather than the final word on what a server has installed.

Can I Check Patches on a Remote Server 2019 Machine?

Yes, with Get-HotFix. Add -ComputerName followed by the target server’s name, and Get-HotFix queries that machine directly without requiring PowerShell remoting to be enabled first. Alternate credentials work too, through the -Credential parameter, which helps when the account running the script lacks rights on the remote server. Scripting the same command against a list of server names turns a single query into a fleet-wide patch report in one pass.

Why Does Server 2019 Show No Update History?

An empty or incomplete update history in Settings does not necessarily mean the server has no patches installed. Microsoft’s own Q&A forum addresses this exact scenario as a detection problem inside the Settings app rather than a sign of a genuinely unpatched server. Checking Get-HotFix or wmic qfe list instead confirms what is actually installed, since both read the Component-Based Servicing store directly instead of depending on the Windows Update Agent’s own history log. Control Panel’s View installed updates offers the same second opinion without opening PowerShell or a command line at all.

How Do I Export a List of Installed Patches?

Redirecting wmic qfe list full to a text file, with a command such as wmic qfe list full > patches.txt, produces a plain-text record in seconds. PowerShell offers the same result in a more structured format: Get-HotFix | Export-Csv patches.csv builds a spreadsheet-ready file that is easier to filter or share with an audit team.

Settings and PowerShell cover most situations on Server 2019, and wmic remains useful wherever a command line is the only option available. Pick Get-HotFix for anything scripted or remote, keep Control Panel in mind for updates that Settings alone will not show, and use the comparison table above to match the right tool to the job in front of you. A five-minute check today with two different methods beats discovering a gap in the patch record during an actual security review.

What This Page Does Not Publish

  • I do not explain KB numbering or the difference between Update and Security Update labels here.
  • I focus on finding installed and pending patches, not deciding which updates your server should install.
  • This page does not give personalised advice for your server, maintenance window, or restart plan.

References

Author Profile

Eric Dawson
Eric Dawson
I'm Eric Dawson, the writer behind The Money Watch. I live in the Columbus, Ohio area and I write about the ordinary questions that turn out to be complicated: computers, shopping, food, travel, parking, small businesses, fees, rules and products. Every article starts with the official page, the maker or the agency, then the sources that check it, and I say plainly where they disagree and what I would do. More about how I work is on the About page.