[GH-ISSUE #2433] [Bug / Feature Request] Windows agents report Patches superseded and Patches Pending mark while really uptodate and no patches available #3431

New issue

Open

opened 2026-03-14 07:19:28 +03:00 by kerem · 1 comment

kerem commented

2026-03-14 07:19:28 +03:00

Owner

Originally created by @rabsym on GitHub (Mar 9, 2026).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2433

Server Info:

OS: Debian GNU Linux 13 - Trixie
Browser: any
RMM Version: v1.4.0

Installation Method:

Standard

Agent Info:

Agent version: v2.10.0
Agent OS: Win 10 / Win 11

Describe the bug

Not sure if a bug or by design but when RMM server updates agent's patch list to check for what to update and what's installed using API (https://docs.microsoft.com/en-us/windows/win32/api/_wua/) it don't take into account that updates could be superseded by newer patch versions/revisions and it shows superseded as missing resulting in client being also marked as "Patches Pending" as showed in the following capture.

The used windows API have the ability to decide whether to include or not superseded updates, ideally offering user the choice of enabling/disabling.

These are the API functions for doing it:

get_IncludePotentiallySupersededUpdates Gets and sets a Boolean value that indicates whether the search results include updates that are superseded by other updates in the search results. (Put)

put_IncludePotentiallySupersededUpdates Gets and sets a Boolean value that indicates whether the search results include updates that are superseded by other updates in the search results. (Get)

To Reproduce
Steps to reproduce the behavior:

Using a W10/11 client/agent with Microsoft Windows Defender Antivirus
If for any reason client not updates daily definitions for a couple of days, the third day you have 2 missing updates that never dissapears and showed as missing till end of times, and in some circunstances client/agent marked also as Patches Pending.

Workaround

Looks like IncludePotentiallySupersededUpdates = True when using updateSearcher so when polling for updates they get included.

So maybe something like this could do the job:

Set updateSearcher = updateSession.CreateUpdateSearcher()
updateSearcher.IncludePotentiallySupersededUpdates = False

Maybe even using a parameter for enabling/disabling this but anyway not understand why default to show superseded.

Originally created by @rabsym on GitHub (Mar 9, 2026). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2433 **Server Info:** - OS: Debian GNU Linux 13 - Trixie - Browser: any - RMM Version: v1.4.0 **Installation Method:** - [X] Standard **Agent Info:** - Agent version: v2.10.0 - Agent OS: Win 10 / Win 11 **Describe the bug** Not sure if a bug or by design but when RMM server updates agent's patch list to check for what to update and what's installed using API (https://docs.microsoft.com/en-us/windows/win32/api/_wua/) it don't take into account that updates could be superseded by newer patch versions/revisions and it shows superseded as missing resulting in client being also marked as "Patches Pending" as showed in the following capture. <img width="1704" height="508" alt="Image" src="https://github.com/user-attachments/assets/13639974-9382-4fbc-8526-2e7f56ad035a" /> The used windows API have the ability to decide whether to include or not superseded updates, ideally offering user the choice of enabling/disabling. These are the API functions for doing it: [get_IncludePotentiallySupersededUpdates](https://learn.microsoft.com/en-us/windows/win32/api/wuapi/nf-wuapi-iupdatesearcher-get_includepotentiallysupersededupdates) Gets and sets a Boolean value that indicates whether the search results include updates that are superseded by other updates in the search results. (Put) [put_IncludePotentiallySupersededUpdates](https://learn.microsoft.com/en-us/windows/win32/api/wuapi/nf-wuapi-iupdatesearcher-put_includepotentiallysupersededupdates) Gets and sets a Boolean value that indicates whether the search results include updates that are superseded by other updates in the search results. (Get) **To Reproduce** Steps to reproduce the behavior: 1. Using a W10/11 client/agent with Microsoft Windows Defender Antivirus 2. If for any reason client not updates daily definitions for a couple of days, the third day you have 2 missing updates that never dissapears and showed as missing till end of times, and in some circunstances client/agent marked also as Patches Pending. **Workaround** Looks like IncludePotentiallySupersededUpdates = True when using updateSearcher so when polling for updates they get included. So maybe something like this could do the job: Set updateSearcher = updateSession.CreateUpdateSearcher() updateSearcher.IncludePotentiallySupersededUpdates = False Maybe even using a parameter for enabling/disabling this but anyway not understand why default to show superseded.

kerem commented

2026-03-14 07:19:34 +03:00

Author

Owner

@rabsym commented on GitHub (Mar 9, 2026):

Perhaps interested in a PR?

Code Location

Found the issue in wua_windows.go in the GetWUAUpdateCollection function.

File: wua_windows.go
Function: GetWUAUpdateCollection

Current code:

searcherRaw, err := s.CallMethod("CreateUpdateSearcher")
if err != nil {
	return nil, fmt.Errorf("error calling CreateUpdateSearcher: %v", err)
}
searcher := searcherRaw.ToIDispatch()
defer searcher.Release()

// Missing: searcher.PutProperty("IncludePotentiallySupersededUpdates", false)

resultRaw, err := searcher.CallMethod("Search", query)

Proposed fix:

searcherRaw, err := s.CallMethod("CreateUpdateSearcher")
if err != nil {
	return nil, fmt.Errorf("error calling CreateUpdateSearcher: %v", err)
}
searcher := searcherRaw.ToIDispatch()
defer searcher.Release()

// Exclude superseded updates from search results
_, err = searcher.PutProperty("IncludePotentiallySupersededUpdates", false)
if err != nil {
	logger.Debugf("Warning: Could not set IncludePotentiallySupersededUpdates: %v", err)
}

resultRaw, err := searcher.CallMethod("Search", query)

Reference:
https://docs.microsoft.com/en-us/windows/win32/api/wuapi/nf-wuapi-iupdatesearcher-put_includepotentiallysupersededupdates

@rabsym commented on GitHub (Mar 9, 2026): Perhaps interested in a PR? ## Code Location Found the issue in `wua_windows.go` in the `GetWUAUpdateCollection` function. **File:** `wua_windows.go` **Function:** `GetWUAUpdateCollection` **Current code:** ```go searcherRaw, err := s.CallMethod("CreateUpdateSearcher") if err != nil { return nil, fmt.Errorf("error calling CreateUpdateSearcher: %v", err) } searcher := searcherRaw.ToIDispatch() defer searcher.Release() // Missing: searcher.PutProperty("IncludePotentiallySupersededUpdates", false) resultRaw, err := searcher.CallMethod("Search", query) ``` **Proposed fix:** ```go searcherRaw, err := s.CallMethod("CreateUpdateSearcher") if err != nil { return nil, fmt.Errorf("error calling CreateUpdateSearcher: %v", err) } searcher := searcherRaw.ToIDispatch() defer searcher.Release() // Exclude superseded updates from search results _, err = searcher.PutProperty("IncludePotentiallySupersededUpdates", false) if err != nil { logger.Debugf("Warning: Could not set IncludePotentiallySupersededUpdates: %v", err) } resultRaw, err := searcher.CallMethod("Search", query) ``` **Reference:** https://docs.microsoft.com/en-us/windows/win32/api/wuapi/nf-wuapi-iupdatesearcher-put_includepotentiallysupersededupdates