Microsoft has released the commandline utility QFEcheck that gives admins the ability to track and verify installed Windows 2000 hotfixes. Run qfecheck and the installed hotfixes will be listed in order of Microsoft Knowledge Base article ‘Q’ number. You can run the utility remotely and create logs with hotfix information for each computer. This can be used to create a database to manage hotfix consistency across the enterprise. QFEcheck does more that list the hotfixes installed. The utility will identify installed hotfix files that are current but not considered valid and files that have been hotfixed but are not current. QFEcheck works by comparing the update registry information found in the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates and generating an error if it does not match the current version of the file. It also verifies that the file information for hotfixed files is valid in the Windows File Protection (WFP) system. WFP could have rolled back a hotfix re-opening a vulnerability an administrator thought closed.

Related Files:

• Packaging Anomaly Could Cause Hotfixes to be Removed
• Microsoft Security Bulletin (MS01-005): Frequently Asked Questions