Windows更新代理（WUA）识别需安装KB的机制及相关技术咨询

Great question—let’s break down how WUA works, where to find component version info, and how it targets specific updates like those for .NET, IE, or VBScript.

Core Mechanism of WUA’s Update Assessment #

WUA doesn’t just guess which updates you need—it follows a structured scanning and matching process:

• System Inventory Scan: First, WUA collects detailed info about your system: OS version/build, installed hardware, software components, their current versions, and even language settings.
• Metadata Comparison: It then pulls update metadata from Microsoft’s servers (or a local WSUS server) which includes rules for each KB. These rules define exactly which systems qualify for the update—like minimum/maximum OS versions, specific component version ranges, or even excluded configurations.
• Applicability Checks: For each KB, WUA runs these rules against your system’s inventory. If your system meets all the criteria (e.g., your .NET version is older than the one the KB updates to), the KB is marked as "required."
• Filtering Out Irrelevant Updates: It also excludes updates that are already installed, explicitly declined by the user/admin, or incompatible with other installed software.

Where to Find Component/KB Version Info (Registry & Tools) #

Yes, there are centralized locations (mostly in the Registry) and built-in tools to check installed components and KBs:

Registry Locations #

• Installed KBs:
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages: Each subkey corresponds to an update package; look for the Installed DWORD (value 1 means installed) and names starting with Package_for_KBXXXXXXX.
  • HKLM\SOFTWARE\Microsoft\Updates: Organized by OS version, each KB has a subkey with details like installation date and version.
• Component Specific Registry Keys:
  • .NET Framework: HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP (check subkeys like v4 for version numbers; look for Version and Release values for precise build info).
  • Internet Explorer: HKLM\SOFTWARE\Microsoft\Internet Explorer (the Version string gives your IE version).
  • VBScript (Windows Script Host): HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings (check Version), or the Active Setup component key HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{10080409-2000-11D1-A28C-00C04FA35D07} (the Version value here maps to VBScript’s version).

Built-in System Tools #

• List all installed KBs: Run wmic qfe list full in Command Prompt (or PowerShell) for a detailed list of hotfixes.
• Check .NET versions: Use dotnet --list-runtimes (for .NET Core/.NET 5+) or reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP" /s for legacy .NET Framework.
• Verify IE version: Launch iexplore.exe -version from Command Prompt.
• Check VBScript/WSH version: Run cscript //version (VBScript is part of the Windows Script Host, so this returns its version).

Targeting Patches for Specific Components (.NET, IE, VBScript) #

For these components, WUA uses the same applicability rules mentioned earlier, but you can manually replicate this process:

1. Get the current component version: Use the Registry keys or tools above to note the exact version/release number of the component (e.g., .NET 4.8.0.5234).
2. Check KB applicability: Each KB’s support documentation (or the update metadata) specifies the range of component versions it applies to. For example, a .NET KB might state it’s for systems running .NET 4.8 versions between 4.8.0.1234 and 4.8.0.5233.
3. Match against your system: If your component’s version falls within that range (and meets other OS/hardware criteria), the KB is required.

WUA automates this by embedding these version checks directly into the update’s applicability rules—so it doesn’t have to "search" for the component manually; it just verifies the version against the rule set.

内容的提问来源于stack exchange，提问作者ahelpyguy