Scan Your Network for Missing Office Updates

Given the various worms, viruses, and exploits that target Microsoft Office components, keeping Office patched is almost as important as patching Windows is to your network's security. Together, Microsoft Baseline Security Analyzer (MBSA) and Windows Server Update Services (WSUS) do a good job of automating the process of managing Windows patches, but MBSA can scan only the local computer for missing Office patches.

Microsoft's Office Update Inventory Tool 2.1 gives you a way to scan your entire network for missing Office 2000 Service Release 1a (SR-1a) and later patches. This free tool can generate a report of missing Office updates for a group of computers. Although each computer must execute the tool locally, the inventory tool, unlike MBSA, can consolidate the scan results of all your computers into one actionable report.

Office Update Inventory Tool
The Office Update Inventory Tool comprises two executables: inventory.exe and convert.exe. Inventory.exe scans the local computer for Office applications and determines which applications are present, what updates are applicable to each application, and which of those updates have been installed. The Inventory component then creates a log file containing this information, names the file after the computer, and stores it in the specified output folder.

After running inventory.exe on each computer and directing all the log files to the same folder on the network, you run convert.exe once. Convert.exe collects all the log files and produces a consolidated report, which you can then use to asses the patch status of Office on your network.

How do you get the inventory tool to run on all computers on your network without logging on to each system and manually running the tool? Your options depend on the size of your network and how cooperative your users are. If you can depend on your users to cooperate, you can simply email everyone a link to the inventory tool. But for most networks, you'll want to automate the inventory process.

Obtaining an Inventory
To automate the Office Update Inventory Tool, you can include it in a startup or logon script that you configure through Group Policy. (To configure a startup or logon script, open any Group Policy Object—GPO—and navigate to Computer ConfigurationWindows SettingsScripts (Startup/Shutdown) or User ConfigurationWindows SettingsScripts (Logon/Logoff), respectively.) Alternatively, you can create a scheduled task. All three options have advantages. I like startup scripts because they run under the authority of the local system, so there's no question about whether the inventory program will be able to complete. However, startup scripts execute only when the computer reboots, and most servers—and even many workstations—don't reboot regularly.

Logon scripts run each time the user logs on, but they run under the authority of the current user, who might not have the authority to run the inventory tool depending on how you configure security on workstations. Additionally, most servers can go for long periods without someone logging on at the console, which could delay scanning for or deploying important security patches.

I prefer the scheduled task approach because you can control when the task is executed and specify an account that has sufficient authority to install software. The Schtasks utility lets you create a scheduled task on remote systems from the command line. However, Schtasks isn't available under Windows 2000—if you run Win2K, you'll need to use the At command instead.

Step 1: Install the Office Update Inventory Tool
First, you need to download and install the Office Update Inventory Tool.

Step 2: Scan Your Domain
To scan a single computer, you can now simply log on to the computer and run the following command from the Run dialog box or a command-shell window:

\mtg1oinventoryinventory.exe  /s \mtg1oinventorycifs  /o \mtg1oinventoryinvout

You must type this command—and others provided in this article—all on one line.

To schedule a scan of a computer, you'd use the Schtasks command. For example, to schedule \wkstn11 to run the inventory tool once at midnight on April 3, 2005, under the authority of an account named batchwork whose password is ksdkui#, you'd enter

schtasks /create  /tn "Office Update Scan" /tr"\mtg1oinventoryinventory.exe  /s \mtg1oinventorycifs  /o mtg1oinventoryinvout"  /sc once /st 00:00:00  /sd 04/03/2005 /s wkstn11  /u batchwork /p "ksdkui#"

Schtasks can create a task on only one computer at a time, but you can use the For command to call Schtasks once for each computer in your domain. Here's how.

For Win2K, you need to use the At command instead, as I mentioned earlier:

for /f  %x in (computers.txt)  do at \%x 00:00   /next:8/3/2005   "\mtg1oinventoryinventory.exe  /s \mtg1oinventorycifs  /o \mtg1oinventoryinvout"

Step 3: Consolidate the Log Files
Run convert.exe manually to consolidate all the individual log files into one .xml file that you can analyze within Microsoft Excel. The command

\mtg1oinventoryconvert  /d \mtg1oinventoryinvout  /o \mtg1oinventoryresults.xml  /xml \mtg1oinventorypatchdata.xml

consolidates the log files into a file named results.xml.

Step 4: Determine Which Updates Need to Be Installed
After convert.exe is finished, open results.xml in Excel. For each computer, convert.exe reports every applicable Office update that isn't already installed as well as each update that's been installed or has expired.

We're interested only in unexpired updates that haven't been installed. Click the EXPIRED6 column heading and select False. This filter immediately shortens the list to show just the updates that need to be installed for each computer.

Hide all columns except NAME, NAME3, PATCHID4, URL5, EXPIRED6, and BASELINEREQUIRED. Now, as Figure 1 shows, you have a workable list of the Office updates that are missing on your network. The NAME column specifies the computer name. NAME3 and PATCHID4 are the friendly and short names, respectively, of the update that the computer lacks. The BASELINEREQUIRED column specifies the prerequisite update, if any, that must be installed before you install the update in question. This column is informational only; WSUS makes sure that updates are applied in the correct order. (If you can't use WSUS to deploy updates, you can use OHotFix; see the sidebar "Using OHotFix When WSUS Isn't an Option" for instructions.) Sort on the PATCHID4 column to see a list of the updates that you need to install.

Tips
Using Schtasks is a good way to create a recurring task that runs the inventory tool regularly—every day and at system start-up, for example. Another benefit of executing inventory.exe regularly is that you can run convert.exe at any time and get a good picture of the status of Office updates on your network.

When you add new systems, be sure you create the scheduled task on those systems so that you don't begin to accumulate computers that never update Office. If the scheduled task doesn't run correctly, use the Task Scheduler log file (%systemroot%SchedLgU.txt) to help diagnose the problem. The most common problems are a bad username or password or an account that lacks the Log on as a batch job right (SeBatchLogonRight) or that doesn't have sufficient permissions (e.g., Power User, Administrator) to install updates.

Finally, make sure you keep the inventory up-to-date so that the scheduled task looks for all applicable updates. To update the inventory manually at any time, simply run

\mtg1oinventoryinventory  /update \mtg1oinventory

The /update switch causes inventory.exe to download the latest version of invcif.exe.

Take Charge of Updates
Most computers also house common third-party applications (e.g., WinZip, Adobe Systems products) that you need to keep patched. If a software vendor offers updates for its products in .msi format, chances are you can automatically deploy those updates through Group Policy's Software Installation feature. But the only tools that can help you deploy patches that aren't available in .msi format are Microsoft Systems Management Server (SMS) or Independent Software Vendor (ISV) patch management products such as those from St. Bernard Software or Shavlik Technologies.

The Office Update Inventory Tool can help you get a handle on Office security holes on your network if you're willing to do a bit of simple scripting. Running before- and after-update inventory reports lets you show management your progress and verify that your scheduled tasks have successfully updated Office throughout your network.

Using OHotFix
When WSUS Isn't an Option
If you can't use Windows Server Update Services (WSUS) to update your systems, perhaps because of unavailable server capacity or some other reason, you can use Microsoft's free OHotFix tool to deploy Office updates automatically. You can use OHotFix independently of the Office Update Inventory Tool. You place OHotFix in a shared folder on your network. To the same folder, you download Office updates for any combination of Office applications and versions. Then, when you execute OHotFix, it scans the local computer and installs all the updates you placed in its folder that are applicable to the local computer. Here's how to set up OHotFix.

Unless you have hundreds of computers, I wouldn't worry about them all accessing the OHotFix folder at the same time; the Windows server will serve the OHotFix-related files to all your computers out of cache. Of course, some computers might be down when their scheduled task is supposed to run or at the time OHotFix is scheduled to kick off. If you run the Office Updates Inventory Tool, you'll be able to identify such computers because they'll be missing Office updates.