I'm running Windows Server 2003 with auto update turned off. Not because I don't want the updates, but because this is a mission critical server and I need to be able to test on a seperate box prior to implementing updates.I just got back from vacation and my automation softwarewas acting squirly so I did some digging. On October 16, 19, 20, & 22, over thirty five security and server updates were installed as well as the IE8. I have one assistant and am trying to determine if he installed them (which he is denying) or if Microsoft pushed them out without my approving them.He did tell me that the server had locked up and he had to do a cold boot on it on the 19th (and this has happend to me about 3 times over the last 6 months as well). It will probably be easier to work out the new issues than it would be to roll back all of the updates but I'd like to know if their is a way to tell how the updates were installed (and maybe what time).thanks,RATMAN2009

You could run the command below to query installed updates and save to a shared folder:wmic qfe GET description,FixComments,hotfixid,installedby,installedon,servicepackineffect >>\\server\folder\update.txtThe following contains other methods: Scripts to query installed Service Packs, Patches/updates and Hotfixeshttp://msmvps.com/blogs/athif/archive/2005/11/20/76035.aspxCertifications: MCSA 2003 MCSE 2003