check_windows_updates_with_report_from_wsus.yml

- name: check Windows Updates
  hosts: '*windows_target'
  vars:
    wsus_server: 192.168.1.36
    win_update_category_names:
      - CriticalUpdates
      - DefinitionUpdates
      - SecurityUpdates
      - UpdateRollups
      - Updates

  roles:
    - configure-update

  tasks:
    - name: find computer sus update id (1/2)
      win_reg_stat:
        path: HKLM:\SOFTWARE\Microsoft\Windows\Currentversion\WindowsUpdate
        name: SusClientId
      register: reg_sus_client_id

    - name: register with WSUS server
      win_shell: 'wuauclt.exe /resetauthorization /detectnow'
      when: reg_sus_client_id.value is undefined

    - name: restart update service
      win_service:
        name: wuauserv
        state: restarted

    - name: check for available updates
      win_updates:
        category_names: "{{ win_update_category_names }}"
        state: searched

    - name: find computer sus update id (2/2)
      win_reg_stat:
        path: HKLM:\SOFTWARE\Microsoft\Windows\Currentversion\WindowsUpdate
        name: SusClientId
      register: reg_sus_client_id
      until: reg_sus_client_id.value is defined
      delay: 5
      retries: 60

    - name: set sus client id
      set_fact:
        sus_client_id: "{{ reg_sus_client_id.value }}"

    - debug:
        msg: "{{ sus_client_id }}"

    - name: missing updates from wsus
      win_shell: |
        [reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | Out-Null
        $wsus = $wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer("{{ wsus_server }}",$False,8530)
        $updateScope = New-Object Microsoft.UpdateServices.Administration.UpdateScope
        $updateScope.IncludedInstallationStates = 'Downloaded','NotInstalled'
        $Comp = $wsus.GetComputerTarget("{{ sus_client_id }}")
        $updates = $Comp
        $availableUpdatesReport = @()
        $availableUpdatesReport += $Comp.GetUpdateInstallationInfoPerUpdate($updateScope) | ForEach {
            $update = $_.GetUpdate()
            [pscustomobject]@{
                title = $update.Title
                UpdateInstallationStatus = $update.UpdateInstallationState
                IsApproved = $update.IsApproved
                PatchReleaseDate = $update.CreationDate
                kb = "KB"+($update.KnowledgebaseArticles)
                Severity = $update.MsrcSeverity
            }
        }
        ConvertTo-Json @($availableUpdatesReport)
      register: available_updates_report
      delegate_to: "{{ wsus_server }}"

    - name: show available updates report
      debug:
        msg: "{{ available_updates_report.stdout }}"

    - name: set available_updates variable
      set_fact:
        available_updates:
          found_update_count: '{{ (available_updates_report.stdout | from_json | list if available_updates_report.stdout | length > 0 else []) | length | int }}'
          updates: '{{ available_updates_report.stdout | from_json | list if available_updates_report.stdout | length > 0 else [] }}'

    - name: show available_updates
      debug:
        msg: "{{ available_updates }}"

    - name: installed updates from wsus
      win_shell: |
        [reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | Out-Null
        $wsus = $wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer("{{ wsus_server }}",$False,8530)
        $updateScope = New-Object Microsoft.UpdateServices.Administration.UpdateScope
        $updateScope.IncludedInstallationStates = 'Installed'
        $Comp = $wsus.GetComputerTarget("{{ sus_client_id }}")
        $updates = $Comp
        $installedUpdatesReport = @()
        $installedUpdatesReport += $Comp.GetUpdateInstallationInfoPerUpdate($updateScope) | ForEach {
            $update = $_.GetUpdate()
            [pscustomobject]@{
                title = $update.Title
                UpdateInstallationStatus = $update.UpdateInstallationState
                IsApproved = $update.IsApproved
                PatchReleaseDate = $update.CreationDate
                kb = "KB"+($update.KnowledgebaseArticles)
                Severity = $update.MsrcSeverity
            }
        }
        ConvertTo-Json @($installedUpdatesReport)
      register: installed_updates_report
      delegate_to: "{{ wsus_server }}"

    - name: show installed updates report
      debug:
        msg: "{{ installed_updates_report }}"

    - name: set installed_updates variable
      set_fact:
        installed_updates:
          found_update_count: '{{ (installed_updates_report.stdout | from_json | list if installed_updates_report.stdout | length > 0 else []) | length | int }}'
          updates: '{{ installed_updates_report.stdout | from_json | list if installed_updates_report.stdout | length > 0 else [] }}'

    - name: show installed_updates
      debug:
        msg: "{{ installed_updates }}"

- name: generate report
  hosts: '*windows_target'
  gather_facts: no

  tasks:
    - name: generate html report
      include_role:
        name: generate-update-report-from-wsus
      run_once: yes