SCCM WQL Query – Clients without latest version installed

SCCM WQL Query: Clients Without the Latest ConfigMgr Client Version

This WQL query builds a Configuration Manager collection of every client that isn’t running a specific ConfigMgr client version — useful for spotting machines that missed a client upgrade during a site-wide update, so you can target them for a manual push rather than waiting for them to catch up on their own.

select SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ClientVersion != "5.00.9040.1000"

Replace the version string with whichever client version your site is currently targeting — you can find your site’s current client version under Administration > Site Configuration > Sites in the console. Save this as a collection with a daily or weekly refresh schedule so it stays current as new machines get discovered or upgraded, rather than running it as a one-off report.

A Note on the Example Version Number

The 5.00.9040.1000 example above reflects an older ConfigMgr build (SCCM 2012-era numbering) — it’s illustrative of the format, not a value to copy as-is. Current Configuration Manager version numbers follow the same four-part 5.00.XXXX.YYYY pattern but with much higher numbers reflecting the active current branch release; always pull the exact string from your own site (Site Configuration > Sites, or Get-CMSite | Select Version in the ConfigMgr PowerShell module) rather than assuming any example value applies to your environment.

Excluding Machines That Haven’t Checked In Recently

One gotcha with this query as written: a machine that’s been offline for months (decommissioned, in storage, or simply powered off) will show up here too, since its last-known ClientVersion is stale rather than current — and it’ll stay in the collection indefinitely since it can never receive the upgrade while offline. If you want to focus specifically on machines that are online and reachable but genuinely behind, combine this with a recent-heartbeat check:

select SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ClientVersion != "5.00.9040.1000" and DateDiff(dd, SMS_R_System.LastLogonTimestamp, GetDate()) <= 30

That variant limits results to machines with a logon within the last 30 days, filtering out the long-offline noise and leaving a more actionable list of genuinely reachable stragglers.

Resources

• WQL
• query