KB5075970: Windows Server 2012 R2 Security Update (February 2026)

# check-kb5075970.ps1

# Purpose: Verify whether Windows Server 2012 R2 has KB5075970 installed.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


$ErrorActionPreference = 'Stop'

function Write-Result {
    param(
        [string]$State,
        [string]$Message,
        [int]$Code
    )
    Write-Output "$State - $Message"
    exit $Code
}

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $caption = $os.Caption
    $version = $os.Version

    if ($caption -notmatch 'Windows Server 2012 R2') {
        Write-Result -State 'UNKNOWN' -Message "This script is intended for Windows Server 2012 R2. Detected: $caption ($version)" -Code 2
    }

    $kbInstalled = $false
    $installMethod = @()

    # Method 1: Get-HotFix

    try {
        $hf = Get-HotFix -Id KB5075970 -ErrorAction Stop
        if ($hf) {
            $kbInstalled = $true
            $installMethod += 'Get-HotFix'
        }
    } catch {
        # ignore and continue

    }

    # Method 2: Component Based Servicing package registry

    if (-not $kbInstalled) {
        try {
            $cbsPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages'
            $pkg = Get-ChildItem $cbsPath -ErrorAction Stop | Where-Object { $_.PSChildName -match 'KB5075970' }
            if ($pkg) {
                $kbInstalled = $true
                $installMethod += 'CBS Registry'
            }
        } catch {
            # ignore and continue

        }
    }

    # Method 3: DISM package listing fallback

    if (-not $kbInstalled) {
        try {
            $dism = & dism.exe /online /Get-Packages 2>$null | Select-String -Pattern 'KB5075970'
            if ($dism) {
                $kbInstalled = $true
                $installMethod += 'DISM'
            }
        } catch {
            # ignore and continue

        }
    }

    # Optional: note servicing stack prerequisite visibility

    $ssuInstalled = $false
    try {
        $ssu = Get-HotFix -Id KB5068783 -ErrorAction Stop
        if ($ssu) { $ssuInstalled = $true }
    } catch {
        try {
            $ssuPkg = Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages' -ErrorAction Stop | Where-Object { $_.PSChildName -match 'KB5068783' }
            if ($ssuPkg) { $ssuInstalled = $true }
        } catch {
            # ignore

        }
    }

    if ($kbInstalled) {
        $msg = 'KB5075970 is installed'
        if ($installMethod.Count -gt 0) {
            $msg += " (detected via: $($installMethod -join ', '))"
        }
        if ($ssuInstalled) {
            $msg += '; prerequisite SSU KB5068783 also present'
        }
        Write-Result -State 'PATCHED' -Message $msg -Code 0
    } else {
        $msg = 'KB5075970 not detected on Windows Server 2012 R2'
        if (-not $ssuInstalled) {
            $msg += '; SSU KB5068783 also not detected and may be required before install'
        }
        Write-Result -State 'VULNERABLE' -Message $msg -Code 1
    }
}
catch {
    Write-Result -State 'UNKNOWN' -Message $_.Exception.Message -Code 3
}