Hello.
I'm currently writing a batch script to handle patching of Windows servers.
I'm using a batch script to run vulscan because I want to leave some evidence / logging on the local server to show what have been done.
As a part of my logging, I'd like to log if the server is pending a reboot after installing patches. On Windows 2003 Server, the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations allows me to detect that and that is working fine. However, that key doesn't seem to be used consistently on Windows Server 2008 R2!?
Accoding to http://support.microsoft.com/kb/832475 some newer updates can write sort of the same status to registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\UpdateExeVolatile but I haven't had much luck with finding any updates that make use of this (have tested with the latest MS updates from this week). Still, if I install patches via vulscan that requires a reboot and then running the same vulscan again without rebooting, the patch installation will fail because a reboot is pending (as shown on the attached screenshot).
Are there other ways of detecting a pending reboot? I seem to recall something about vulscan also being able to set a pending reboot flag, but I can't find any information about it.
Thanks in advance
/Michael