Using the Microsoft QFECHECK Tool

Using the Microsoft QFECHECK Tool

Based upon the way Microsoft concatenates or chains together their hot fixes, they have also created a problem as these new chained fixes actually undo some previously applied hot fixes. With that, Microsoft has released a command-line tool named Qfecheck.exe that will provide you with the ability to track and verify your installed Windows 2000 hot fixes.

This tool was developed to:

• Help users who thought they had properly installed an update, but in fact had not, and are now experiencing a problem. Previously, it was somewhat difficult to identify which fixes were actually installed on a computer. This tool easily enumerates all of the installed fixes by Microsoft Knowledge Base article number. Users can now confirm that they have installed the appropriate set of fixes before using a valuable support incident and potentially experiencing unplanned down time.
• Many users identify a common set of fixes that are required for all servers and work stations in a given data center. To help ensure that Windows 2000 hot fixes are applied in a consistent manner across many units, this tool will allow you to create logs for each computer that will identify which fixes are installed. Once those logs are created, you can easily scan them for consistency.
• There are situations in which, because of a network problem, a problem with the update itself, or a subsequent update that improperly overwrites a previous fix, updates can be damaged or removed in error. This tool ensures that not only have the fixes been installed, but that they are current on the computer.
• There is a significant correlation between maintaining a consistent platform throughout an organization and the overall stability and uptime of those systems. Regular use of this tool to audit computers is a practice that will help you achieve higher reliability on all computers.

How Qfecheck Works   Qfecheck determines which hot fixes are installed by reading the information that is stored in the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates

Using the file version information that is stored in this key by each hot fix that is installed, the Qfecheck tool checks the installed binary files to verify that they match.

Qfecheck identifies the following types of issues:

• Files that have had the hot fix applied, but for which the installed binary file is not current. Qfecheck reads the registry key that is associated with each update, and checks the version number that is recorded in the registry against the current version of the same file that is installed. If the current version is lower than the version that is recorded in the registry, Qfecheck reports an error.
• Hot fix files that are current, but are not considered valid by the installed catalogs.

  For each file that is installed by a hot fix, Qfecheck checks to see that the current catalogs on the computer contain the information that would be used by Windows File Protection (WFP) to validate the file. If a file is valid according to the hot fix information in the registry, but the installed catalogs do not concur, Qfecheck reports an error.

  Important! If Windows File Protection were to be triggered in this case, the hot fixed file would be rolled back to an earlier version.

Qfecheck displays its information in a command-prompt window when run. If you log the results of Qfecheck to a log file with the /l switch, the log file is stored in the current folder unless you specify a location. This location can be any valid path, including a Universal Naming Convention (UNC) path. Qfecheck does not log information in any event log.

If Qfecheck reports that some files are not valid in the system catalog, you may need the updated Service Pack 2 Catalog. A Microsoft Knowledge Base Article has been issued regarding this issue, Article # Q281767 Service Pack 2 Catalog is Available to Resolve Versioning Issues with Post Service Pack 1 Hot fixes.

How to Obtain Qfecheck

Qfecheck is available for download from the Microsoft Download Center:

Download q282784_w2k_sp3_x86_en.exe

or from our server:

Download q282784_w2k_sp3_x86_en.exe

Command Syntax for Qfecheck

QFECHECK [/l[:location] /v /q /?]

   /l   Log output to .log in the current folder
        location. Use the specified location to store the 
        log file.
   /v   Verbose output
   /q   Quiet mode
   /?   This help 

Output Examples for Qfecheck

Windows 2000 without a service pack or hot fixes installed:

Windows 2000 Hotfix Validation Report for \\WinAdvSrv Report Date: 1/7/2001 9:9pm Current Service Pack Level:

Hotfixes Identified:No Hotfixes found on system.

Windows 2000 Service Pack 1 (SP1) without hot fixes installed:

Windows 2000 Hotfix Validation Report for \\WinAdvSrv Report Date: 1/7/2001 9:39pm Current Service Pack Level: Service Pack 1

Hotfixes Identified:No Hotfixes found on system.

Windows 2000 SP1 with Q274835 installed:

Windows 2000 Hotfix Validation Report for \\WinAdvSrv Report Date: 1/7/2001 9:54pm Current Service Pack Level: Service Pack 1 Hotfixes Identified:

Q274835: Current on system.

Windows 2000 SP1 on which a hot fix is installed and the binary file is correct, but the catalog is not correct:

Windows 2000 Hotfix Validation Report for \\WinAdvSrv Report Date: 1/9/2001 2:49pm Current Service Pack Level: Service Pack 1 Hotfixes Identified: Q267866: Current on system.

Q272743: This hotfix should be reinstalled.

Using the /v (verbose output) switch:

Windows 2000 Hotfix Validation Report for \\WinAdvSrv Report Date: 1/11/2001 9:24pm Current Service Pack Level: Service Pack 1 Hotfixes Identified: Q267866: Current on system. Q272743: This hotfix should be reinstalled. The following files are not valid in the system catalog: C:\WINNT\SYSTEM32\TELNET.EXE

C:\WINNT\SYSTEM32\DLLCACHE\TELNET.EXE

Windows 2000 SP1 on which a hot fix is installed but the binary file is not current:

Windows 2000 Hotfix Validation Report for \\WinAdvSrv Report Date: 1/9/2001 10:54pm Current Service Pack Level: Service Pack 1 Hotfixes Identified: Q267866: Current on system.

Q272743: This hotfix should be reinstalled.

Using the /v (verbose output) switch:

Windows 2000 Hotfix Validation Report for \\WinAdvSrv Report Date: 1/11/2001 9:30pm Current Service Pack Level: Service Pack 1 Hotfixes Identified: Q267866: Current on system. Q272743: This hotfix should be reinstalled. The following files are incorrect for this hotfix: C:\WINNT\SYSTEM32\TELNET.EXE

C:\WINNT\SYSTEM32\DLLCACHE\TELNET.EXE

Additional Information

Note that all Windows 2000 files are protected by Windows File Protection. Hot fixes can contain updates to these files, examples of which may be .asp or .chm files. Qfecheck does not verify these files because they do not have catalog information on the computer.

Qfecheck.exe is placed in the %SystemRoot%\System32 folder. The installation alone does not verify hot fix integrity. To receive verification, open a command prompt window and run Qfecheck.exe.

More..

There is also a Microsoft Windows 95 version of Qfecheck. You must not use this version with Windows 2000. For additional information about the Windows 95 version, click the article number below to view the article in the Microsoft Knowledge Base:

Q145990 Windows 95 Update Information Tool (Qfecheck.exe)

Notice: Windows® 95, Windows® 98, Windows® NT, Windows® 2000 and
Microsoft® Office are registered trademarks or trademarks of the Microsoft Corporation.