Windows Update scan

When using the Windows Update site, what is scanned to determine missing

patches? Is the scan searching the registry to determine installed patches or

is the scan actually checking file versions to determine if a patch is

needed. The reason I ask is because our security scanning tool is only

checking the registry for installed patches. Our desktop staff says the list

of missing patches is incorrect because the way they are installing patches

isn’t making the registry entries (SMS packages or something like that)

Thanks