Windows Update remediation v2

[ForumBot]

Windows Update remediation v2

[ForumBot]

Its a great script! Only it seems that the detection script is only checking "last installed HotFix" but it doesn’t differentiate between .NET updates and Windows cumulative updates. I noticed that the .NET patch could mark the detection to pass without remediation, even if the latest Windows CU isn’t installed.
I added a small adjustment below so it will specificly filter on CU updates.

# --- Minimum required builds ---
$MinWin10Build = 19045  # Windows 10 22H2
$MinWin11Build = 26100  # Windows 11 24H2

# --- Get OS version ---
$OSversion = [Version](Get-ComputerInfo -Property OsVersion).OsVersion
Write-Output "Detected OS version: $OSversion"

# --- Initialize compliance flags ---
$OSCompliant = $false
$CUCompliant = $false
$Reasons = @()

# --- Check OS compliance ---
if ($OSversion.Build -lt 22000) {   # Windows 10
    if ($OSversion.Build -ge $MinWin10Build) {
        $OSCompliant = $true
    } else {
        $Reasons += "OS version below minimum required ($OSversion)"
    }
} else {  # Windows 11
    if ($OSversion.Build -ge $MinWin11Build) {
        $OSCompliant = $true
    } else {
        $Reasons += "OS version below minimum required ($OSversion)"
    }
}

# --- Determine last Monthly (B) CU ---
$daysCU = $null
$timeout = [DateTime]::Now.AddMinutes(5)

do {
    try {
        $lastupdate = Get-HotFix |
                      Where-Object {
                          $_.HotFixID -match '^KB5\d{6,}$' -and
                          $_.Description -match 'Security Update'
                      } |
                      Sort-Object -Property InstalledOn |
                      Select-Object -Last 1 -ExpandProperty InstalledOn

        if ($lastupdate) {
            $daysCU = (New-TimeSpan -Start $lastupdate -End (Get-Date)).Days
        }
    }
    catch {
        $Reason

*(Réponse tronquée)*