原创： How to build a query based on Definition Updates installed

In SCCM 2012 R2, you can use following class.

Use SMS_CombinedDeviceResources.EPAntivirusSignatureLastVersion in WMI

E.g.

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_CombinedDeviceResources on SMS_CombinedDeviceResources.ResourceID = SMS_R_System.ResourceID WHERE SMS_CombinedDeviceResources.EPAntivirusSignatureLastVersion = "1.175.841.0"

You can also build a query based on CI:

Note: you should create a CI and evaluted it first.

E.g.

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_CI_ComplianceState on SMS_G_System_CI_ComplianceState.ResourceID = SMS_R_System.ResourceID WHERE SMS_G_System_CI_ComplianceState.CI_UniqueID = "518e5e65-06df-4662-b918-a604828c634f" AND SMS_G_System_CI_ComplianceState.IsDetected = 1

In SCCM 2007 SP2, you can use: SMS_G_System_PatchStatusEx class

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_PatchStatusEx on SMS_G_System_PatchStatusEx.ResourceId = SMS_R_System.ResourceId where SMS_G_System_PatchStatusEx.Title  = "Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.169.2635.0)" and LastStateName = "Install Verified"