Important Notice: On February 29th, this community was put into read-only mode. All existing posts will remain but customers are unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

What am I doing wrong with this filter?

So this is the filter posted about the new IIS CVE except it leaves behind patched machines in the collection so I tried adding the hot fix KB to it so it would be removed from the collection...

Yet here is a patched machine and still in the collection even after a reboot and scan after

What am I doing wrong here?

1

Comments

2 comments
Date Votes
  • 1) Is that machine running 2004, or something newer like 20H2? The Collection from the blog only accounts for 2004.

    2) You need to add a Not Any group filter to your KB value filter. https://help.pdq.com/hc/en-us/community/posts/360078090652

    1
  • Yep, still new and learning how these work. Tried finding an article but i guess my search foo failed. Anyway this fixed it.

    1