RE: Checking if Windows was restarted after update

This is a multipart message in MIME format.

--===============1349247630==
Content-class: urn:content-classes:message
Content-Type: multipart/signed;
	boundary="----=_NextPart_000_17E7_01C97232.42E2F070";
	protocol="application/x-pkcs7-signature"; micalg=SHA1

This is a multipart message in MIME format.

------=_NextPart_000_17E7_01C97232.42E2F070
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

> -----Original Message-----
> From: [email protected] [mailto:nessus-
> [email protected]] On Behalf Of Bazy
> Sent: Friday, January 09, 2009 6:10 AM
> To: [email protected]
> Subject: Checking if Windows was restarted after update
> 
> Hello!
> 
> We use WSUS in our company for updates, but not everyone restart's his
> workstation for days. So in some cases the computer is still vulnerable
> if not restarted. How would be the best practice to check this? I'm
> using Nessus for about 3 months, read the book but have little
> experience.

It depends on how the plugin for the specific vulnerability works. For
example, if it only checked WMI it would show the patch as being installed
whereas if it actually checks it should identify the system as vulnerable.
Nessus plugins are good for actually checking.

What we do to handle the "but I don't reboot" issue is to have the updates
set with a "forced reboot by." I handle nessus, not windows patching, so I
don't know the technical details but it does deal with those situations.

Tim Doty

------=_NextPart_000_17E7_01C97232.42E2F070
Content-Type: application/x-pkcs7-signature;
	name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWTzCCBZsw
ggUEoAMCAQICChfxH1sAAAAAAIowDQYJKoZIhvcNAQEFBQAwcDETMBEGCgmSJomT8ixkARkWA2Vk
dTETMBEGCgmSJomT8ixkARkWA21zdDFEMEIGA1UEAxM7TWlzc291cmkgVW5pdmVyc2l0eSBvZiBT
Y2llbmNlIGFuZCBUZWNobm9sb2d5IEVudGVycHJpc2UgQ0EwHhcNMDgwNzIyMTgyNzQ2WhcNMDkw
NzIyMTgyNzQ2WjCBjjETMBEGCgmSJomT8ixkARkWA2VkdTETMBEGCgmSJomT8ixkARkWA21zdDER
MA8GA1UECxMIQWNjb3VudHMxFjAUBgNVBAsTDVN0YWZmLUZhY3VsdHkxGTAXBgNVBAMTEERvdHks
IFRpbW90aHkgVC4xHDAaBgkqhkiG9w0BCQEWDXRkb3R5QG1zdC5lZHUwgZ8wDQYJKoZIhvcNAQEB
BQADgY0AMIGJAoGBAJ8AF+iaMH8wiuYgyltAS3RJYiQXmt297sX0fSMXxkqZ0coQbjkN5xoxgveo
CCXskp48D34T8HwH2gR77FE154g7T1v2dkFRp58kVxzAkHZ4ka9BMwjhG0vbaDFk+5XpT3aX5ciF
mCZ8TKWNqeyXUaYTbRhEWINI4mL+vq5uqXKNAgMBAAGjggMbMIIDFzALBgNVHQ8EBAMCBaAwRAYJ
KoZIhvcNAQkPBDcwNTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcNAwQCAgCAMAcGBSsOAwIHMAoG
CCqGSIb3DQMHMB0GA1UdDgQWBBSp9bzYfRxa/VnI6147JMb6lV+LpTAXBgkrBgEEAYI3FAIECh4I
AFUAcwBlAHIwHwYDVR0jBBgwFoAUuiX3GekZ1b9PekOmmk3on4TEzTgwewYDVR0fBHQwcjBwoG6g
bIZqaHR0cDovL2NhLm1zdC5lZHUvQ2VydEVucm9sbC9NaXNzb3VyaSUyMFVuaXZlcnNpdHklMjBv
ZiUyMFNjaWVuY2UlMjBhbmQlMjBUZWNobm9sb2d5JTIwRW50ZXJwcmlzZSUyMENBLmNybDCCAYYG
CCsGAQUFBwEBBIIBeDCCAXQwge0GCCsGAQUFBzAChoHgbGRhcDovLy9DTj1NaXNzb3VyaSUyMFVu
aXZlcnNpdHklMjBvZiUyMFNjaWVuY2UlMjBhbmQlMjBUZWNobm9sb2d5JTIwRW50ZXItMjc5Njcs
Q049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3Vy
YXRpb24sREM9dW1hZCxEQz11bXN5c3RlbSxEQz1lZHU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVj
dENsYXNzPWNlcnRpZmljYXRpb25BdXRob3JpdHkwgYEGCCsGAQUFBzAChnVodHRwOi8vY2EubXN0
LmVkdS9DZXJ0RW5yb2xsL2NhLm1zdC5lZHVfTWlzc291cmklMjBVbml2ZXJzaXR5JTIwb2YlMjBT
Y2llbmNlJTIwYW5kJTIwVGVjaG5vbG9neSUyMEVudGVycHJpc2UlMjBDQS5jcnQwKQYDVR0lBCIw
IAYKKwYBBAGCNwoDBAYIKwYBBQUHAwQGCCsGAQUFBwMCMDcGA1UdEQQwMC6gHQYKKwYBBAGCNxQC
A6APDA10ZG90eUBtc3QuZWR1gQ10ZG90eUBtc3QuZWR1MA0GCSqGSIb3DQEBBQUAA4GBAFwDifRN
p8TnzLXPu/IU8wupkpEyCynCtD11Bqy5+nF8blh+2GcSxAz7LjR4Z+h4N2Gs3SulfTb2pDWT4hMV
w46zXstnFTmcvSOeJdxR75iHc9maxbTezjuOgKU7XaM/fEmXuUk/eUeSy4qloEQwvj7ul79uLBJV
P699jJzHjU22MIIHJzCCBQ+gAwIBAgIQKiaNNwwOIoRD5xgkixWtvjANBgkqhkiG9w0BAQQFADCB
xTEeMBwGCSqGSIb3DQEJARYPY2FAdW1zeXN0ZW0uZWR1MQswCQYDVQQGEwJVUzERMA8GA1UECBMI
TWlzc291cmkxETAPBgNVBAcTCENvbHVtYmlhMR8wHQYDVQQKExZVbml2ZXJzaXR5IG9mIE1pc3Nv
dXJpMR8wHQYDVQQLExZJbmZvcm1hdGlvbiBUZWNobm9sb2d5MS4wLAYDVQQDEyVVbml2ZXJzaXR5
IG9mIE1pc3NvdXJpIFJvb3QgQXV0aG9yaXR5MB4XDTAxMDEwODE0NDUzN1oXDTI0MTIzMTE0NDUz
N1owgcUxHjAcBgkqhkiG9w0BCQEWD2NhQHVtc3lzdGVtLmVkdTELMAkGA1UEBhMCVVMxETAPBgNV
BAgTCE1pc3NvdXJpMREwDwYDVQQHEwhDb2x1bWJpYTEfMB0GA1UEChMWVW5pdmVyc2l0eSBvZiBN
aXNzb3VyaTEfMB0GA1UECxMWSW5mb3JtYXRpb24gVGVjaG5vbG9neTEuMCwGA1UEAxMlVW5pdmVy
c2l0eSBvZiBNaXNzb3VyaSBSb290IEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
AgoCggIBAMwb2MmvDfxVSDzZKHnMQtO6JIH3jCAe4K+K04nIPmZQJh6HVLggW1y6hJTVfjFakTHc
QLrNFXeyFOu6hDsx2tO9BooZTvxBvtbucUnZLUEFpYMQFiO69gCoiB5m5sTLg+PO8FQg2WpS1Mq0
IZEy02SGYBCLwS/rG2fg4epjwmEeu7Sd1fyCVcnOhcw1lbvuZBfD7shvFo19hWbE/QL8x8cNrZVi
bEwT0uXUi35yweX7427xreRSmA0ZqihyRXILvMZM7xVBW23ZYyYHqYFdGqoZs0YGWea1vvEf7Aya
k+VXtl9m07GkW6wB5jM6QrfmXbzBqaEATjBFKgRu+EGU2S5roy9tGSDqxFp1pLWOm7aDBAlPxGJh
CUBCd48OjYP/dn1+g/nY6nkUqyfjmTZml8dVDf3FLJChnxquMh/G9XHmvhUQjLVqPe8neXfobses
ry+0N1BUE8b0qfNTydFKoFUOA9rXc/M9lh+R/j98QbBuPlvMpfGmNkMP1mmgyPRSAfZpZiPiVHv6
fQVAUoseB8zktZRFKT8jIHNd9yoy3ciEVO/QazphUCtt1DaPHk1OIHWVvntVHvvPyOFaikZIJTKG
9liwQ/pRzdhb8faGRvWl5Xbm9Y/VAdX+akAiXavo8r9bQYWZhO1CnIJ/Vox80QBUbvVAt8tbAMvV
IzgMWKLpAgMBAAGjggEPMIIBCzALBgNVHQ8EBAMCAcYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
FgQUwO70GpEuVvSDWVVeeBk+/hgTRcMwgbkGA1UdHwSBsTCBrjBUoFKgUIZOaHR0cDovL3VtLXJv
b3QtY2EvQ2VydEVucm9sbC9Vbml2ZXJzaXR5JTIwb2YlMjBNaXNzb3VyaSUyMFJvb3QlMjBBdXRo
b3JpdHkuY3JsMFagVKBShlBmaWxlOi8vXFxVTS1ST09ULUNBXENlcnRFbnJvbGxcVW5pdmVyc2l0
eSUyMG9mJTIwTWlzc291cmklMjBSb290JTIwQXV0aG9yaXR5LmNybDAQBgkrBgEEAYI3FQEEAwIB
ADANBgkqhkiG9w0BAQQFAAOCAgEAt18ql0b8BeUk6vbzyfmqhh8uiBo/U+Icd/ZKMPh/PZFO2rtl
poSk9I4T6A8IxNLuTtp1NNejU5JhiksKfpjaTY2L7PfuPVVBieBLmOSG0owF+akb7v5oLsWmGySq
3AvMJfOCnCukJAXfoB6QIz3wElvVJ6vFmnv3PP7mCqVhsYPN4FTXNEcAU4TFgBUSxGxRJ8IsKNzA
dTF4uaY26asQBCdqR1pmviY7ga6was14K6Ki19zOWv+Gc1cWwyaJRPu40lDE+sHwi37K/Gs3s+Sa
WjRDEX9ageYe3JzQGjr8XzpNZZByU+am6hgoyl0D9u6feifkYWA4jbOjbXwQyny0+27PIVkeCJ9g
ASpOfPrqMjwX8WeMxMf1GX5EdIore21Rd6jSLr8CUCJnyq5sv0WgoqJ7/SU8v052kUJQvo/ltWi0
0uq/KkMoGa2yudDiReaOUAPVJ1DJ4Oqn79dz3zN9s7LcpHANqjW2We2oxxnm/dCIpHZ+unjIPDlD
ofrpRjxUkzdNRv1thJDvrz9hOEkYbxyRJRjGrJqVj1xUTVyA1ViwtEe5Cfn40Uwnob7cqQpXp7EI
4qTB1LS9STXTRhzgRPEWc/1EReLPNszlFj3wkAGFN1dQJvKpQqHIwzjHodt1l5GX2o7Lc28ksfWl
Wn7bXb/0smoL31K8WVMH7mVh6HYwggmBMIIHaaADAgECAgpyDOnxAAAAAAAdMA0GCSqGSIb3DQEB
BAUAMIHFMR4wHAYJKoZIhvcNAQkBFg9jYUB1bXN5c3RlbS5lZHUxCzAJBgNVBAYTAlVTMREwDwYD
VQQIEwhNaXNzb3VyaTERMA8GA1UEBxMIQ29sdW1iaWExHzAdBgNVBAoTFlVuaXZlcnNpdHkgb2Yg
TWlzc291cmkxHzAdBgNVBAsTFkluZm9ybWF0aW9uIFRlY2hub2xvZ3kxLjAsBgNVBAMTJVVuaXZl
cnNpdHkgb2YgTWlzc291cmkgUm9vdCBBdXRob3JpdHkwHhcNMDcxMjE4MTQxMjI5WhcNMTcxMjE4
MTQyMjI5WjBwMRMwEQYKCZImiZPyLGQBGRYDZWR1MRMwEQYKCZImiZPyLGQBGRYDbXN0MUQwQgYD
VQQDEztNaXNzb3VyaSBVbml2ZXJzaXR5IG9mIFNjaWVuY2UgYW5kIFRlY2hub2xvZ3kgRW50ZXJw
cmlzZSBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwb2MbvGC7G9rQNCovT2NSiGjUWSY
l2DyaMOESwvlzqMVCxvOwbMttGH0Ls1DMFiRiuYpKFC3Rf08h3+72CqDn+7ixfSGATaGPG2GzAmA
oUSskmU+woxvJszUnvChPdGcYwmu1NDfNe7lis9Y2I3y7bocoK9Gl/yqX6X8WvmwHY8CAwEAAaOC
BUkwggVFMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLol9xnpGdW/T3pDpppN6J+ExM04MAsG
A1UdDwQEAwIBhjAQBgkrBgEEAYI3FQEEAwIBADAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAf
BgNVHSMEGDAWgBTA7vQakS5W9INZVV54GT7+GBNFwzCCAlwGA1UdHwSCAlMwggJPMIICS6CCAkeg
ggJDhoHgbGRhcDovLy9DTj1Vbml2ZXJzaXR5JTIwb2YlMjBNaXNzb3VyaSUyMFJvb3QlMjBBdXRo
b3JpdHksQ049VU0tUk9PVC1DQSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049
U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz11bWFkLERDPXVtc3lzdGVtLERDPWVkdT9jZXJ0
aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9p
bnSGgfxsZGFwOi8vL3VtYWQtZGMwMS51bWFkLnVtc3lzdGVtLmVkdS9DTj1Vbml2ZXJzaXR5JTIw
b2YlMjBNaXNzb3VyaSUyMFJvb3QlMjBBdXRob3JpdHksQ049VU0tUk9PVC1DQSxDTj1DRFAsQ049
UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz11
bWFkLERDPXVtc3lzdGVtLERDPWVkdT9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2Jq
ZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnSGX2h0dHA6Ly91bWFkLWRjMDEudW1hZC51bXN5
c3RlbS5lZHUvQ2VydEVucm9sbC9Vbml2ZXJzaXR5JTIwb2YlMjBNaXNzb3VyaSUyMFJvb3QlMjBB
dXRob3JpdHkuY3JsMIICVgYIKwYBBQUHAQEEggJIMIICRDCB1QYIKwYBBQUHMAKGgchsZGFwOi8v
L0NOPVVuaXZlcnNpdHklMjBvZiUyME1pc3NvdXJpJTIwUm9vdCUyMEF1dGhvcml0eSxDTj1BSUEs
Q049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixE
Qz11bWFkLERDPXVtc3lzdGVtLERDPWVkdT9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9
Y2VydGlmaWNhdGlvbkF1dGhvcml0eTCB8QYIKwYBBQUHMAKGgeRsZGFwOi8vL3VtYWQtZGMwMS51
bWFkLnVtc3lzdGVtLmVkdS9DTj1Vbml2ZXJzaXR5JTIwb2YlMjBNaXNzb3VyaSUyMFJvb3QlMjBB
dXRob3JpdHksQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
PUNvbmZpZ3VyYXRpb24sREM9dW1hZCxEQz11bXN5c3RlbSxEQz1lZHU/Y0FDZXJ0aWZpY2F0ZT9i
YXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRob3JpdHkwdgYIKwYBBQUHMAKGamh0dHA6
Ly91bWFkLWRjMDEudW1hZC51bXN5c3RlbS5lZHUvQ2VydEVucm9sbC91bS1yb290LWNhX1VuaXZl
cnNpdHklMjBvZiUyME1pc3NvdXJpJTIwUm9vdCUyMEF1dGhvcml0eS5jcnQwDQYJKoZIhvcNAQEE
BQADggIBALrVVecwFPWwOCiS+XzucOPATLB1IexTiVGblh29BLBELvJ2eVRmeDqthB5Jt3cXEmQK
OwxSKcK1A0Bv4EmEpmtfRK/ZTh45XrNknc16lLzeVxTLryTe3b8NLSOaitOK/raLDdsQha03rDnL
oI885fxEnQcXTfAX319vL6crK1mcym4wErmvP2fzfluN2MXp0qoEHZL4sm69dxpHkv+20TFA31sY
08/HQSK+yzUReGM9mgRKAN2DO0POZsNbwFV8R3txv9I1+jGGM5Onx82yoiTm7PuUHveiXKzCdTLc
hhvvjoPd4w2faODBrnXhiLNFPbaZRycGC5qFOaP36HOiDmCi70SQgwRzdYqmTQSHzCc+z48mobCY
FGe0sLYjrIMM6MtkecMPPGUHiUuMiqjQ3KwLs6RIcnMxsh9BG0nrFwmNyYrEx+4uUIQBlGJk6d9L
SI/Hhk8sUB5ARJIRq9/bIua/m6Klv+G9LPfsxQY52OtQg8HHMtYtvdKU8JjFaIVtJk8bbLhyxcY7
aTLe+xqUp2pxN/pacRWFWo476sitTcRRtqzXOz2i80w+9VW/JVzlXalIOpEGQHR+S7cfonSE8/nq
7GkO5P3EXKl9T5qXnssoAKLmY/KWjNrbVp0DwYlX7nlJ7MQuFIWV99vBXdsonUhW15sS4uq7PeJQ
yPiA827VMYIDEjCCAw4CAQEwfjBwMRMwEQYKCZImiZPyLGQBGRYDZWR1MRMwEQYKCZImiZPyLGQB
GRYDbXN0MUQwQgYDVQQDEztNaXNzb3VyaSBVbml2ZXJzaXR5IG9mIFNjaWVuY2UgYW5kIFRlY2hu
b2xvZ3kgRW50ZXJwcmlzZSBDQQIKF/EfWwAAAAAAijAJBgUrDgMCGgUAoIIB6jAYBgkqhkiG9w0B
CQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wOTAxMDkxNDE0MTVaMCMGCSqGSIb3DQEJ
BDEWBBQoQFDe7ig7quFkvHN39ILd+HaoDzBnBgkqhkiG9w0BCQ8xWjBYMAoGCCqGSIb3DQMHMA4G
CCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDAHBgUr
DgMCGjAKBggqhkiG9w0CBTCBjgYJKwYBBAGCNxAEMYGAMH4wcDETMBEGCgmSJomT8ixkARkWA2Vk
dTETMBEGCgmSJomT8ixkARkWA21zdDFEMEIGA1UEAxM7TWlzc291cmkgVW5pdmVyc2l0eSBvZiBT
Y2llbmNlIGFuZCBUZWNobm9sb2d5IEVudGVycHJpc2UgQ0ECChfxH1sAAAAAAIowgZAGCyqGSIb3
DQEJEAILMYGAoH4wcDETMBEGCgmSJomT8ixkARkWA2VkdTETMBEGCgmSJomT8ixkARkWA21zdDFE
MEIGA1UEAxM7TWlzc291cmkgVW5pdmVyc2l0eSBvZiBTY2llbmNlIGFuZCBUZWNobm9sb2d5IEVu
dGVycHJpc2UgQ0ECChfxH1sAAAAAAIowDQYJKoZIhvcNAQEBBQAEgYBV5e8a6w73a64Cbi3heqDB
Pj9CKytlcjkjBUVs7LU5rQ3vHjeTlptIZU91ZqW1gXB7kTUBrgMYznnmNrbDoY5XlNdPqrXgMkea
00VAZZoJHblZRSe04qMeQq9eOImzS3H21TFhNWkSK9lzYS1tO50cjsLbPRh9yAUK8WB7jCkHwQAA
AAAAAA==

------=_NextPart_000_17E7_01C97232.42E2F070--

--===============1349247630==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
--===============1349247630==--