Free Windows Patch Compliance Report Template (Excel)
A monthly Excel report for Windows endpoints: which machines are fully patched, which are missing critical updates, how long since each was last patched, and which gaps are approved exceptions. The summary sheet works out the numbers for you.
Download the patch compliance report template (.xlsx)Excel workbook, about 33 KB. No sign-up, no macros.
What is in the workbook
| Sheet | What it is for |
|---|---|
| Summary | The numbers an auditor or manager reads first. Every figure except the report month is a formula from the other sheets. |
| Endpoints | One row per Windows machine. An Excel table with a frozen header, filters and a Status dropdown. Three rows marked EXAMPLE show the format. |
| Exceptions | Updates you have agreed not to install yet, with the reason, who approved it and when you will look again. |
| How to use | The monthly routine, what an auditor reads in the report, and a PowerShell command for checking one machine. |
The Endpoints columns
| Column | What to record |
|---|---|
| Hostname, Owner | Which machine and who is responsible for it. Use the same hostnames as your asset register. |
| OS, OS version / build | For example Windows 11 Pro, 24H2 (26100). |
| Last update installed | The date of the most recent update on the machine. |
| Missing critical updates, Missing other updates | Counts from your update tool or from checking the machine. |
| Days since last patch | A formula: today’s date minus Last update installed. You do not type it. |
| Status | Dropdown: Compliant, Non-compliant or Exception. |
| Exception reason | Why a missing update is accepted for now. Add a matching row on the Exceptions sheet. |
| Remediation due date | When a Non-compliant or Exception machine must be fixed or reviewed. |
The Summary figures
| Figure | How it is worked out |
|---|---|
| Total endpoints | Rows with a hostname on the Endpoints sheet. |
| Endpoints fully patched | Rows with zero missing critical and zero missing other updates. |
| Compliance % | Fully patched divided by total endpoints. |
| Endpoints missing critical updates | Rows where missing critical updates is above zero. |
| Oldest gap | The largest days since last patch among machines missing critical updates. Needs Excel 2019 or later. |
| Endpoints marked Exception, Approved exceptions logged | Status set to Exception, and rows on the Exceptions sheet. The two should tell the same story. |
Filling it in each month
- Save a copy for the month, for example patch-report-2026-10.xlsx. Old months are your evidence of a routine.
- Set the report month on the Summary sheet.
- List every Windows endpoint. Check the count against your asset register so none are missed.
- Fill in the last update date and the missing update counts, then set each Status.
- Give every Non-compliant machine a remediation due date, and log every exception with an approver and a review date.
To see the updates installed on one machine, run this in PowerShell:
Get-HotFix | Sort-Object InstalledOn -DescendingGet-HotFix reads the Win32_QuickFixEngineering class. Microsoft notes that this class does not return updates installed by Windows Installer (MSI) or from the Windows Update site, so treat it as a quick check rather than a full update history.
What an auditor reads in it
- Coverage. Does the endpoint count match the asset register?
- Critical gaps. Which machines are missing critical updates, and does each one have a due date?
- Ages. How long since each machine was last patched, and is the oldest gap shrinking month to month?
- Approved exceptions. Is each one written down, approved by a named person and reviewed by a set date?
When a spreadsheet stops being enough
A monthly spreadsheet is a fair start for a small fleet. The weak point is that someone has to collect the numbers by hand, and manual updates drift. Laptops change between reports: they miss updates while off the network, install them a week later, or get rebuilt. The report shows what was true on the day you filled it in, not today.
If filling it in takes more than an afternoon, or the endpoint count keeps disagreeing with your asset register, it is time to collect the data automatically.
Where Sentrivox fits
The Sentrivox Windows agent collects hardware, software, patch, service, user and port inventory automatically, so the same fields stay current without manual updates. Patch history is tracked per endpoint.
Download the patch compliance report template (.xlsx)Excel workbook, about 33 KB. No sign-up, no macros.
Frequently asked questions
Is this patch compliance report template free?
Yes. Download the Excel file and use it as you like. There is no sign-up and the workbook contains no macros.
How often should I fill in a patch compliance report?
Monthly suits most small businesses. Save a copy for each month so you can show the trend over time.
What counts as a critical update?
Use the severity your update tool reports. Microsoft rates security updates as Critical, Important, Moderate or Low. Decide in writing which ratings you count as critical and keep to it.