How to deploy Microsoft patches without Active Directory or SMS

How to deploy Microsoft patches without Active Directory or SMS

What is the simplest way to deploy Microsoft patches to 100+ desktops if you do not have Active Directory or SMS?

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

There are several patch management tools for Windows, including products from Configuresoft, PatchLink, St. Bernard Software, Ecora, BigFix and Shavlik Technologies. Shavlick developed the HFNetChk scanning engine that is used by Microsoft's Baseline Security Analyzer. They also have a basic edition of their HFNetChkPro, which targets smaller organizations that don't need advanced patch management functions, such as scheduled scans and e-mail support.

If you are looking for a free Windows Hotfix utility, look into the Windows Hotfix Checker (WHC) by Michael Dunn. WHC is a front-end for HFNetChk. WHC runs HFNetChk, captures its output, and creates a report on the hotfixes that need to be installed. WHC can scan a local computer, remote computer or an entire NT Domain. On Windows 2000 and later, it can also scan an IP address, or a range of IP addresses. Once you've scanned for necessary hotfixes, WHC can also download them from Microsoft. WHC's detailed hotfix report includes hyperlinks to the Microsoft security bulletin and Knowledge Base article for each hotfix, so finding the correct page for hotfixes that are not directly downloadable is easy. Finally, once you have downloaded the necessary hotfix installers, WHC can run them for you.

Hotfixes are often chainable, meaning you can install several at once without having to reboot after each. WHC supports this by using Microsoft's QChain utility. It's important, however, to verify that the hotfixes you add to the install list are chainable, because it doesn't work with product updates that do not use update.exe as the installation program, such as Internet Explorer updates for Windows 2000 and Windows XP. Once you have installed your updates, you can verify that your computers have all the fixes you wanted to install by using the Qfecheck.exe tool.

This was first published in November 2005