Two situations with a similar goal:
1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to the system without attempting actual exploits?
2) If you have either partial or full access to a target (unprivileged login, or root access) is it possible to finger print the security patches that have been applied without attempting the exploits that the patches remedy?
I should state first, that this is from a red team perspective. The owner of the target computer cannot be asked questions, or be asked to take any actions. Furthermore, stealth is of the essence.
There is a world of difference between an unpatched system, and a patched system, but it is quite noisy, and risks downing the system to try too many actual exploits (and it seems like the dumb way to go about finding the patch level.) Is there any safe, and quiet way to fingerprint this?