Wannacry Ransomeware - Quick summary

Hi Folks,

Quick summary post on how to verify the below updates installed status for Wannacrypt Ransomware

4019474, 4019473, 4019472, 4016871, 4019472, 4019264, 4019265, 4019215, 4019217, 4019216, 4019218, 4012598

WannaCrypt Ransomware updates.

OS	Bulletin	KB Number	Release Date	Supersede Info	Latest Bulletin ID	Latest KB	Latest Patch IDs	Released Date
Windows XP	MS17-010	4012598	2017-03-14		--	--	--	--
Windows Server 2003	MS17-010	4012598	2017-03-14		--	--	--	--
Windows Vista	MS17-010	4012598	2017-03-14		--	--	--	--
Windows Server 2008	MS17-010	4012598	2017-03-14		--	--	--	--
Windows 7	MS17-010	4012212	2017-03-14	Internally	MS17-MAY6, MSWU-2465	4019264, 4019265	22491,22492,22493, 104409,104412,104411	May 9, 2017 May 15, 2017
Windows Server 2008 R2	MS17-010	4012212	2017-03-14	Internally	MS17-MAY6, MSWU-2465	4019264, 4019265		May 9, 2017 May 15, 2017
Windows 8	MS17-010	4012598	2017-03-14		--	--	--	--
Windows 8.1	MS17-010	4012213	2017-03-14	Internally	MS17-MAY6, MSWU-2463	4019215, 4019217	22494, 22495, 22496, 104399, 104400, 104401	May 9, 2017 May 15, 2017
Windows Server 2012 R2	MS17-010	4012214	2017-03-14	Internally	MS17-MAY6, MSWU-2464	4019216, 4019218	22505, 104408	May 9, 2017 May 15, 2017
Windows 10 Base Version	MS17-007	4012606	2017-03-14	Official	MS17-MAY2	4019474	22343, 22344	2017-05-09
Windows 10 1511	MS17-007	4013198	2017-03-14	Official	MS17-MAY2	4019473	22345, 22346	2017-05-09
Windows 10 1607	MS17-007	4013429	2017-03-14	Official	MS17-MAY2	4019472	22507, 22508	2017-05-09
Windows 10 1703	--	--	--		MS17-MAY2	4016871	22349, 22350	2017-05-09
Windows Server 2016	MS17-007	4013429	2017-03-14	Official	MS17-MAY2	4019472	22509	2017-05-09

* Supersede : Internally - If installed latest updates no need to install old updates. Everything is fixed and available in latest updates.

Please note DesktopCentral does not scan and report the Superseded patches (MS17-007 - in All Patches View).

If you need to know the Install Status of Superseded patches. Use below given query in Custom Query Report.

select SupercededInstallPatchStatus.Patch_id ,ManagedComputer.full_name ,DC_TRANSLATE(ConfigStatusDefn.LABEL),LONG_TO_DATE(SupercededInstallPatchStatus.INSTALLED_TIME),SupercededInstallPatchStatus.REMARKS from SupercededInstallPatchStatus inner join Patch on SupercededInstallPatchStatus.patch_id = Patch.patchid inner join ConfigStatusDefn on SupercededInstallPatchStatus.DEPLOY_STATUS_ID = ConfigStatusDefn.STATUS_ID INNER JOIN ManagedComputer on ManagedComputer.resource_id = SupercededInstallPatchStatus. resource_id where Patch.bulletinid = 'MS17-007' and ManagedComputer.MANAGED_STATUS=61

If result still shown as " No data available" means that you have not deployed the patches ( MS17-007) which were released on Mar 2017. Please Sync the Patch DB -> Rescan the computers -> Deploy the latest patches ( MS17-MAY2).

Here is a query for the MSP customers who wants to know the installed patches status of all customer for Wannacrypt updates.

SELECT CustomerInfo.customer_name AS CustomerName, Resource.NAME AS "Resource.NAME",PatchMgmtOSInfo.OS_NAME AS "PatchMgmtOSInfo.OS_NAME", Patch.PATCHID AS "Patch.PATCHID", Patch.BULLETINID AS "Patch.BULLETINID",PatchDetails.DESCRIPTION AS "PatchDetails.DESCRIPTION",

LONG_TO_DATE(InstallPatchStatus.INSTALLED_TIME),DC_TRANSLATE(InstallStatusDefn.LABEL),DC_TRANSLATE(InstallPatchStatus.REMARKS)

FROM Patch INNER JOIN MSPatch ON Patch.PATCHID=MSPatch.PATCHID LEFT JOIN PatchDetails ON Patch.PATCHID=PatchDetails.PATCHID

INNER JOIN PMPatchLocation ON Patch.PATCHID=PMPatchLocation.PATCHID INNER JOIN PMPatchType ON Patch.PATCHID=PMPatchType.PATCHID

INNER JOIN UpdateDefinition ON PMPatchType.TYPE=UpdateDefinition.UPDATEID INNER JOIN PMSeverity ON Patch.SEVERITYID=PMSeverity.SEVERITYID

INNER JOIN AffectedPatchStatus ON Patch.PATCHID=AffectedPatchStatus.PATCH_ID INNER JOIN ConfigStatusDefn AffectedPatchStatusDefn ON AffectedPatchStatus.STATUS_ID=AffectedPatchStatusDefn.STATUS_ID

LEFT JOIN InstallPatchStatus ON AffectedPatchStatus.RESOURCE_ID=InstallPatchStatus.RESOURCE_ID AND AffectedPatchStatus.PATCH_ID=InstallPatchStatus.PATCH_ID

LEFT JOIN ConfigStatusDefn InstallStatusDefn ON InstallPatchStatus.DEPLOY_STATUS_ID=InstallStatusDefn.STATUS_ID

INNER JOIN Resource ON AffectedPatchStatus.RESOURCE_ID=Resource.RESOURCE_ID INNER JOIN ManagedComputer ON Resource.RESOURCE_ID=ManagedComputer.RESOURCE_ID

INNER JOIN CustomerInfo on Resource.CUSTOMER_ID=CustomerInfo.CUSTOMER_ID

INNER JOIN PatchMgmtOSInfo ON ManagedComputer.RESOURCE_ID=PatchMgmtOSInfo.RESOURCE_ID INNER JOIN OSLanguage ON PatchMgmtOSInfo.LANGUAGEID=OSLanguage.LANGUAGEID

LEFT JOIN BranchMemberResourceRel ON ManagedComputer.RESOURCE_ID=BranchMemberResourceRel.RESOURCE_ID

LEFT JOIN BranchOfficeDetails ON BranchMemberResourceRel.BRANCH_OFFICE_ID=BranchOfficeDetails.BRANCH_OFFICE_ID WHERE (((((((PMPatchLocation.TYPE = 0))

AND (Patch.ISSUPERCEDED = 0)) AND (PMPatchType.STATUS = 0)) AND (AffectedPatchStatus.STATUS_ID IN (201,202)))

AND (PMPatchLocation.LANGUAGEID IN (0,1))) AND (ManagedComputer.MANAGED_STATUS = 61) and MSPatch.SQNUMBER in ('4019474','4019473','4019472','4016871','4019472','4019264','4019265','4019215','4019217','4019216','4019218','4012598'))