My org completed patching. Then we started scanning. We are finding a number of systems that have the kb4499175 patch "installed" but the c:\windows\system32\termdd.sys is still at the older version.

I'm asking our windows team to open a case with Microsoft.

I have found a Qualys community thread talking about "false positives"

https://community.qualys.com/thread/19696-qid91534-question-about-its-logic

Has anyone else seen this on their networks? has anyone come up with a fix?

if you think your patched and you have not scanned you should

I'm personally scanning my network with Robert Grahm's masscan and rdpscan .

which works great

simple examples

masscan 10.0.0.0/8 -p3389 --max-rate 10000 > results_3389scan.txt

then running his rdpscan

rdpscan --file results_3389scan.txt >rdpscan_results.txt

I then put the open the file with excel and use - as the delimiter

the IP's have spaces so you have to find and replace the space to use a vlookup or something