One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a Windows Server 2003 SP1 OS (extremely out of date).
I submitted the report to our service provider (along with an angry email). They responded with a simple cropped screenshot of sysinfo screen showing SOME windows 2k3 sp2 box. I have no way of knowing if that screenshot is from our box or not, and based on history with the provider, I'm inclined to think they just grabbed it from another one of their boxes to cover their butts.
With no AD or login access, it's impossible for me to know for sure the SP level of this box.
1) Is a simple sysinfo page screenshot enough for PCI-DSS compliance evidence? I can't imagine it being since as stated, it could be from any system. But then how to get evidence from this box that shows it really is our box and really is SP2?
2) How to remotely verify the SP level of a box. I've had no luck with nmap.. is there another way to prove it's not updated?
See this ServerFault thread for my OP: