You cannot adopt a manual method to check for missing Windows Update. It is the Windows Update Services (WUAUSERV) that checks for the Windows Update State of a machine using query response mechanism and by checking various files as well as registry settings and whether last update was successfully completed.
Windows update information and settings are at the following path in the registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update
Key Value Pair: NextDetectionTime
You may require to create Registry Condition & Compound Condition. Besides this you can also probe some other values in the above registry key path
So for that matter, You can configure posture validation based on the registry
Optionally, you can configure Windows Server Update Services (WSUS) remediation instead for your posture validation policy. More detailed help is available at the following location:
http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_pos_pol.html#wp1979471
