How to obtain and use the MS04-028 Enterprise Update Scanning Tool in environments that do not use Systems Management Server (886988)

MS04-28 Enterprise Update Scanning Tool options

• Scanning only: This option scans for missing updates that pertain to MS04-028 and writes the results to log files.
• Scanning and deployment: This option scans for missing updates that pertain to MS04-028 and also installs the missing updates. This option also writes the results to log files.

Scanning and deployment methods

• Computer startup script method
• User logon script method
• Manually initiated method by using a local folder or a remote share

Computer startup script method

1. Complete the steps in the Initial setup and configuration section.
2. Set up a startup script. To do this, follow these steps:
   1. In the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in, right-click the domain name, and then click Properties.
   2. Click the Group Policy tab.
   3. Click Default Domain Policy, and then click Edit.
   4. Expand Computer Configuration, expand Windows Settings, and then click Scripts.
   5. Double-click Startup, and then click Add. The Add a Script dialog box appears.
   6. In the Script Name box, type wscript.exe.
   7. In the Script Parameters box, type //B \\ServerName\UpdateStore\UpdateInstall.vbs.
   8. Click OK, and then click Apply.
3. To perform a scan on a client computer, restart the client computer that is a member of the domain.
4. To see the results, review the logs in the \\ServerName\UpdateStore\Results folder. For more information, see the Analyze the tool output section.

1. Complete the steps in the Initial setup and configuration section.
2. Continue with the server setup. To do this, go to the Configure a server for deployment section.
3. Set up a startup script. To do this, follow these steps:
   1. In the Active Directory Users and Computers MMC snap-in, right-click the domain name, and then click Properties.
   2. Click the Group Policy tab.
   3. Click Default Domain Policy, and then click Edit.
   4. Expand Windows Settings for Computer Configuration, and then click Scripts.
   5. Double-click Startup, and then click Add. The Add a Script dialog box appears.
   6. In the Script Name box, type wscript.exe.
   7. In the Script Parameters box, type //B \\ServerName\UpdateStore\UpdateInstall.vbs /Install.
   8. Click OK, and then click Apply.
4. To perform a scan and deployment on a client computer, restart the client computer that is a member of the domain.
5. To see the results, review the logs in the \\ServerName\UpdateStore\Results folder. For more information, see the Analyze the tool output section.

Logon script method

1. Complete the steps in the Initial setup and configuration section.
2. Set up a logon script. To do this, follow these steps:
   1. In the Active Directory Users and Computers MMC snap-in, right-click the domain name, and then click Properties.
   2. Click the Group Policy tab.
   3. Click Default Domain Policy, and then click Edit.
   4. Expand Windows Settings for User Configuration, and then click Scripts.
   5. Double-click Logon, and then click Add. The Add a Script dialog box appears.
   6. In the Script Name box, type wscript.exe.
   7. In the Script Parameters box, type //B \\ServerName\UpdateStore\UpdateInstall.vbs.
   8. Click OK, and then click Apply.
3. To perform a scan on a client computer, log off the client computer, and then log back on to the client computer with an administrator account to run the script.
4. To see the results, review the logs in the \\ServerName\UpdateStore\Results folder. For more information, see the Analyze the tool output section.

1. Complete the steps in the Initial setup and configuration section.
2. Continue with the server setup. To do this, go to the Configure a server for deployment section.
3. Set up a logon script. To do this, follow these steps:
   1. In the Active Directory Users and Computers MMC snap-in, right-click the domain name, and then click Properties.
   2. Click the Group Policy tab.
   3. Click Default Domain Policy, and then click Edit.
   4. Expand Windows Settings for User Configuration, and then click Scripts.
   5. Double-click Logon, and then click Add. The Add a Script dialog box appears.
   6. In the Script Name box, type wscript.exe.
   7. In the Script Parameters box, type //B \\ServerName\UpdateStore\UpdateInstall.vbs /Install.
   8. Click OK, and then click Apply.
4. To perform a scan and deployment on a client computer, log off the client computer, and then log back on to the client computer with an administrator account to run the script.
5. To see the results, review the logs in the \\ServerName\UpdateStore\Results folder. For more information, see the Analyze the tool output section.

Manually initiated method

1. Download the MS04-028 Enterprise Update Scanning tool. The following file is available for download from the Microsoft Download Center:
   Download the MS04-028 Enterprise Update Scanning tool, version 2 package now.
2. Run 2006.05.09-v2-EnterpriseScan-x86-EN.exe, and then install it to a local folder.
3. To perform a scan on the local computer, run the following command at a command prompt:

   WScript.exe //B Path\UpdateInstall.vbs

4. To see the results, review the logs in the %windir%\system32\Vpcache\Updatescan folder. For more information, see the Analyze the tool output section.

1. Download the MS04-028 Enterprise Update Scanning tool. The following file is available for download from the Microsoft Download Center:
   Download the MS04-028 Enterprise Update Scanning tool, version 2 package now.
2. Run 2006.05.09-v2-EnterpriseScan-x86-EN.exe, and then install it to a local folder.
3. In the local folder where you extracted the MS04-028 Enterprise Update Scanning Tool, create a folder that is named UpdateStore. In the UpdateStore folder, create a folder that is named Updates.
4. In the Updates folder, create a folder structure to save the updates. Create the folder structure as described in the Configure a server for deployment section. You do not have to create a file share to install updates to a local computer.
5. To perform a scan and install on the local computer, run the following command at a command prompt:

   wscript //b Path\updateinstall.vbs /store Path\updates /install

1. Complete the steps in the Initial setup and configuration section.
2. To perform a scan on the local computer, run the following command at a command prompt:

   WScript.exe //B \\ServerName\UpdateStore\UpdateInstall.vbs

3. To see the results, review the logs in the \\ServerName\UpdateStore\Results folder. For more information, see the Analyze the tool output section.

1. Complete the steps in the Initial setup and configuration section.
2. Continue with the server setup. For more information, go to the Configure a server for deployment section.
3. To perform a scan and deployment on the local computer, run the following command at a command prompt:

   WScript.exe //B \\ServerName\UpdateStore\UpdateInstall.vbs /Install

4. To see the results, review the logs in the \\ServerName\UpdateStore\Results folder. For more information, see the Analyze the tool output section.

Initial setup and configuration

1. Download the MS04-028 Enterprise Update Scanning tool. The following file is available for download from the Microsoft Download Center:
   Download the MS04-028 Enterprise Update Scanning tool, version 2 package now.
2. Configure the server and share. To do this, follow these steps:
   1. Set up a share on a member server, and then name it UpdateStore.
   2. Run 2006.05.09-v2-EnterpriseScan-x86-EN.exe, and install it to the UpdateStore folder.
   3. Configure the following share and NTFS file system (NTFS) permissions:
      • Share permission:
        • Add the domain user account for the user who is managing this share, and then choose Full Control.
        • Remove the Everyone group.
        • If you use the computer startup script method, add the Domain Computers group with Change and Read permissions. If you use the logon script method, add the Authenticated Users group with Change and Read permissions.
      • NTFS permission:
        • Add the domain user account for the user who is managing this share, and then choose Full Control.
        • Remove the Everyone group if it is in the list.
          
          Note If you receive an error message when you remove the Everyone group, click Advanced on the Security tab, and then click to clear the Allow inheritable permissions from parent to propagate to this object check box.
        • If you use the computer startup script method, grant the Domain Computers group Read and Execute, List Folder Contents, and Read permissions.
        • If you use the logon script method, grant the Authenticated Users group Read and Execute, List Folder Contents, and Read permissions.
   4. Create a folder and name it Results under the UpdateStore folder. This is where the final report files will be written to during the scanning process.
   5. Configure the NTFS permissions on the Results folder. To do this, use the following methods:
      
      Note Do not change the Share permissions in this step.
      • Add the domain user account for the user who is managing this share, and then choose Full Control.
      • If you use the computer startup script method, give the Domain Computers group Modify, Read and Execute, List Folder Contents, Read, and Write permissions.
      • If you use the logon script method, give the Authenticated Users group Modify, Read and Execute, List Folder Contents, Read, and Write permissions.
   6. Configure the UpdateInstall.ini file as described in this article.

Configure the server for deployments

1. Set up the folder structures that are required by the installer. In the shared folder (UpdateStore) that you created in the Initial setup and configuration section, create the following folder structure:

   - UpdateStore
       \ Result
       - Updates
           - .Net Framework 1.0
               \ 1033
           - .Net Framework 1.1
               \ 0
           + Internet Explorer 6
           - Office
               - 831931
                   \ 0
               + 831932
               + 832332
               + 838344
               + 838345
               + 838905
           - PictureIt! or Digital Image v6
               - 1033
           + PictureIt! or Digital Image v7
           + PictureIt! or Digital Image v9
           + Producer for 2003
           + Visual Studio .NET 2002
           + Visual Studio .NET 2003
           + Windows Server 2003
           - Windows XP
               \ 1033
   

   
   
   Microsoft has provided a batch file to automatically create the appropriate folder structure. To use the MakeFolders.cmd batch file, create an empty Updates folder, and then run the batch file with the following syntax:

   MakeFolders.cmd PathLocaleID

   Note Path is the path of the Updates folder, and LocaleID is the locale ID (LCID) for the languages that you want to install. For example:

   MakeFolders.cmd c:\UpdateStore\Updates 1033

   You can run the batch file multiple times in the same Updates folder to create as many locale folders as you must have. You may also use the "." relative path syntax to indicate the current working directory. For example, to create a folder structure for U.S. English updates in the current directory, you would run the following command:

   Makefolders.cmd . 1033

   Note that the batch file uses the Cacls.exe command to set permissions on the folders that it creates. Permissions on all files and folders inside Path will be set to Administrators/Full Control and Everyone/Read.
   
   Note After running Makefolders.cmd, you must also rename all the Picture It/Digital Image folder names as noted:
   • PictureIt! or Digital Image v6 to Picture It! or Digital Image v6
   • PictureIt! or Digital Image v7 to Picture It! or Digital Image v7
   • PictureIt! or Digital Image v9 to Picture It! or Digital Image v9
2. The folder structure for the update files is built with the following rules. If you use the batch file to create the folder structure, this process will be automated:
   • The subfolders under the Updates folder are for individual products. The product names must be the same as the product names that are in the Product column in the UpdateList.xls file. The UpdateList.xls file is located in the UpdateStore share. The product list is provided for your reference, but the file itself does not affect the scanning or deployment process in any way. The UpdateList.xls file does not include the Office, Visio, or Project updates.
     
     If you are creating a folder with a name that starts with a "." (period) character, you must create the folder from the command line. For example, you must type md .Net Framework 1.0. If you receive error message when you create the folder, you may have the command extensions turned off. To turn on the command extensions, type cmd e:on at a command prompt. After you create the folder, you can turn the command extensions off by typing cmd e:off at the command prompt.
   • For Office updates: Create subfolders that are named after the Microsoft Knowledge Base number. For example, for the Project 2002 update, you would use 831931. As soon as you have created the Microsoft Knowledge Base folders, create a subfolder under each Knowledge Base folder, and then name the subfolder 0 (zero). This folder is the folder where you must put the downloaded full-file update for the applicable Office product.
   • For the .NET Framework 1.1, Visual Studio .NET 2002, and Visual Studio .NET 2003: Create a folder for each product. Inside each product folder, create a subfolder that is named 0 (zero).
   • For products other than Office, .NET Framework 1.1, and Visual Studio .NET 2002 and 2003: Name the subfolders with the LCID of the update that you are installing. For example, you must use 1033 for English (United States) updates. For more information about Locale IDs, visit the following Microsoft Web site:

     http://www.microsoft.com/globaldev/reference/lcid-all.mspx

     .
   • Locale ID list
     The following is a list of languages and the corresponding Locale IDs that are supported by various updates that the tool can deploy:
     • 1033 English - United States
     • 1036 French - France
     • 1031 German - Germany
     • 1041 Japanese
     • 1040 Italian - Italy
     • 1034 Spanish - Spain
     • 1042 Korean
     • 1028 Chinese - Taiwan
     • 4100 Chinese - China
3. Download the updates.
   
   For updates that pertain to Office, Visio, and, Project, download each applicable full-file update from the links that are provided in the MS04-028 security bulletin. Put the full file updates in their respective folder. For example, for Project 2002 you would put the full-file update in the UpdateStore\Updates\Office\831031\0 folder.
   
   For non-Office updates, you can find the complete list of downloads that are available for this bulletin in the UpdateList.xls file. This file is located in the UpdateStore share. Put the downloaded executable file (.exe file) in the folder that is named after the LCID under the product folder. For example, for the Windows XP English update, put the executable file in the UpdateStore\Updates\Windows XP\1033 folder.

Configure the UpdateInstall.ini file

• Share= \\ServerName\ShareName\Path
  This parameter specifies the location to which the tool will write its log files. For more information, see the Analyze the tool output section. Include the full path of the target folder.
• Store= \\ServerName\ShareName
  This parameter specifies the location of the product update files. If you use the tool to deploy updates, this is where we recommend that you build the deployment folder structure.
  
  Note The tool will look for an "Updates" folder in the share. Do not include the "Updates" folder in the path.
• Norestart= {True|False}
  When this parameter is set to True, the tool will not restart the computer after you install updates, even if one or more of the installed updates requires a restart to complete installation of the update. When this parameter is set to False, if the tool installs one or more product updates that require a restart for installation to complete, the tool will restart the computer to complete the installation of the updates. It is possible, however unlikely, that an update may not always install correctly yet may cause the tool to restart the computer. If this behavior occurs, the computer may continually restart. To correct the issue, set the NoRestart parameter to True. This will let the computer restart ordinarily and let you troubleshoot the problem.
  
  Note If Microsoft Producer is installed by the tool, a restart of the computer cannot be suppressed. To avoid unwanted restarts on computers that have Producer installed, do not copy the update for Producer to the UpdateStore file share. Instead, manually update computers where Producer is installed.
• Debug=
  Leave this parameter blank unless instructed otherwise by Microsoft Product Support Services.
• Authorized=
  This parameter is a list of Office updates that the tool will report as missing if they are not present on the computer. If this parameter is left blank, the tool will report on all Office updates.
• ScanInterval=
  This parameter determines the number of days that the tool will wait to rescan a computer that it has determined needs no updates. This parameter is valuable for deploying the tool through a logon script or a computer startup script. Instead of running at every logon or startup, the tool will first test whether it determined that no updates were needed on its last run. If no updates were needed, the tool will only perform another scan if more than ScanInterval days have elapsed. In this manner, the tool can provide updates for products that are installed on a computer after the tool has been deployed. However, the tool does not create excessive output logs. The tool stores the date that it last ran and determined the computer needed no updates in the following registry value:

  HKEY_LOCAL_computer\Software\Microsoft\Updates\UpdateScan\LastRun

  The tool only examines the ScanInterval parameter if it has previously determined that all applicable updates were installed on a computer. If one or more updates are missing, the tool will scan and deploy updates, as applicable, on its next run regardless of what the value of the ScanInterval parameter is.
  
  If you want to perform a scan every time that the tool is run, set this parameter to 0 (zero).
  
  If you want the tool to install all applicable updates and then never run again, set this parameter to an arbitrarily large number like 9999.
  
  If you want to rescan a single computer before ScanInterval days have elapsed, delete the HKEY_LOCAL_computer\Software\Microsoft\Updates\UpdateScan\LastRun registry value before you rescan the computer. If you want to rescan all the computers that are in your environment, set this parameter to 0 (zero).

Analyze the tool output

1. Start Excel.
2. On the File menu, click Open.
3. In the Files of type list, click *.csv.
4. Click the file that you want to open, and then click Open.
5. The import wizard will guide you through opening the file.

Result.txt

• The tool is being run on an unsupported operating system.
• No non-Office products are installed that are vulnerable to the MS04-028 vulnerability.

no missing updates detected

UpdateScan.log

Results.xml

OfficeUpdate.MOF

Result.csv

ComputerName_Date.txt

ComputerName_Date.csv

Consolidate data from multiple computers

Uninstall the tool

Limitations

• You must run the MS04-028 Enterprise Update Scanning Tool under the Administrator or System context.
• This tool has been tested on Windows 2000 and later operating systems with supported service packs only. When the tool is run in an unsupported operating system configuration such as Windows 2000 Service Pack 2 (SP2), you receive the following message:No checks apply to this system
• This tool performs local scans only.
• If you have used the administrative installation point to deploy Office products, you must continue to use that method of deployment. However, you can use this tool to obtain a scanning report.
• This tool does not provide detection for third-party applications that may be using a vulnerable version of the GDI+ component. For more information, see the MS04-028 security bulletin.
• Any modification or customization of the tool is not permitted under the End User License Agreement (EULA).
• Microsoft only supports the MS04-028 Enterprise Update Scanning Tool by executing the Updateinstall.vbs script. Any other entry point into the tool is unsupported.
• To run the tool on Windows NT 4.0 Server-based computers, you must have the following components installed on the computer. If these components are not present, the tool will not run correctly, and no output reports will be generated:
  • Windows Script Host (WSH). To download the WSH, visit the following Microsoft Web site:

    http://www.microsoft.com/downloads/details.aspx?FamilyId=0A8A18F6-249C-4A72-BFCF-FC6AF26DC390&displaylang=en

  • Windows Management Instrumentation (WMI). To download WMI, visit the following Microsoft Web site:

    http://www.microsoft.com/downloads/details.aspx?FamilyID=c174cfb1-ef67-471d-9277-4c2b1014a31e&DisplayLang=en

  • Windows Installer 2.0. To download Windows Installer 2.0, visit the following Microsoft Web site:

    http://www.microsoft.com/downloads/details.aspx?FamilyID=4b6140f9-2d36-4977-8fa1-6f8a0f5dca8f&DisplayLang=en

• In certain circumstances, you may be prompted for the source location of Office files during detection. If this behavior occurs, make sure that Windows Installer 2.0 is installed on the computer. Windows Installer 2.0 is required for the Office updates according to the MS04-028 security bulletin.
• The tool has only been tested on supported operating systems with supported versions of affected products. The tool may report inaccurate information or may not report information about unsupported products. For more information about supported product versions, see the following Microsoft Web sites:

  Windows Life-Cycle Policy
  http://www.microsoft.com/windows/lifecycle/default.mspx
  
  Product Lifecycle Dates - Windows Product Family
  http://support.microsoft.com/gp/lifeselect

• The tool requires MSXML (Microsoft XML Parser) 3.0 to be present on any computer on which it is run. MSXML 3.0 is installed by Internet Explorer 6 and Internet Explorer 6 SP1. MSXML 3.0 is also part of Windows Server 2003. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

  269238 Version list for the Microsoft XML parser

• The tool requires Internet Explorer 6 or Internet Explorer 6 SP1. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

  328548 How to obtain the latest service pack for Internet Explorer 6

Frequently asked questions