I like your approach but the report has to be modified every months, what i did for years with Lansweeper is create SQL table with a powershell script that fetch all microsoft patch each month (KB, NAME, DATE, OS etc) and compare with the current ins...