Article ID: 282784
Article Last Modified on 10/26/2007
APPLIES TO
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows Server 2003, Enterprise Edition
- Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
- Microsoft Windows Server 2003, Standard x64 Edition
- Microsoft Windows Server 2003, Enterprise x64 Edition
- Microsoft Windows XP Home Edition
- Microsoft Windows XP Professional
- Microsoft Windows XP Professional x64 Edition
- Microsoft Windows XP Professional for Itanium-based systems
- Microsoft Windows 2000 Professional Edition
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
This article was previously published under Q282784
SUMMARY
Microsoft has released a command-line tool named Qfecheck.exe that gives network administrators increased ability to track and verify installed Windows 2000 and Windows XP hotfixes. This tool provides the following benefits:
- This tool helps customers who thought they had properly installed an update, but had not, and are now experiencing a problem. Previously, it was somewhat difficult to identify which fixes were installed on a computer. This simple tool easily enumerates all of the installed fixes by Microsoft Knowledge Base article number. Customers can then confirm that they have installed the appropriate set of fixes before using a valuable support incident and potentially experiencing unplanned down time.
- Many companies identify a common set of fixes that are required for all servers in a given data center. To help ensure that Windows 2000 and Windows XP hotfixes are applied in a consistent manner across many servers, this tool allows you to create logs for each computer in your organization that show which fixes are installed. Once those logs are created, you can easily scan them for consistency.
- There are rare situations in which, because of a network problem, a problem with the update itself, or a subsequent update that improperly overwrites a previous fix, updates could be damaged or removed in error. This tool ensures that not only have the fixes been installed, but that they are current on the computer.
- Microsoft has noted a significant correlation between maintaining a consistent platform across organizations and the overall stability and uptime of those systems. Microsoft believes that using this tool to regularly audit computers is a best practice that will help customers achieve higher reliability on their computers.
MORE INFORMATION
Qfecheck.exe determines which hotfixes are installed by reading the information that is stored in the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates
Using the file version information that is stored in this key by each hotfix that is installed, the Qfecheck.exe tool checks the installed binary files to verify that they match.
Qfecheck.exe identifies the following types of issues:
- Files that have been hotfixed, but for which the installed binary file is not current.
Qfecheck reads the registry key that is associated with each update, and checks the version number that is recorded in the registry against the current version of the same file that is installed. If the current version is lower than the version that is recorded in the registry, Qfecheck reports an error.
- Hotfix files that are current, but are not considered valid by the installed catalogs.
For each file that is installed by a hotfix, Qfecheck checks to see that the current catalogs on the computer contain the information that would be used by Windows File Protection (WFP) to validate the file. If a file is valid according to the hotfix information in the registry, but the installed catalogs do not concur, Qfecheck reports an error.
NOTE: If WFP were to be triggered in this case, the hotfixed file would be rolled back to an earlier version.
Qfecheck displays its information in a command-prompt window when you run it. If you log the results of Qfecheck to a log file with the /l switch, the log file is stored in the current folder unless you specify a location. This location can be any valid path, including a Universal Naming Convention (UNC) path. Qfecheck does not log information in the event log.
If the Windows 2000 version of Qfecheck reports that some files are not valid in the system catalog, see the following article in the Microsoft Knowledge Base:
281767 Updated Sp2.cat available to resolve versioning issues with post Service Pack 1 hotfixes
How to Obtain Qfecheck.exe
Windows XP Home and Windows XP Professional
The following file is available for download from the Microsoft Download Center:
![[GRAPHIC: ]](/wiki/index.php?title=File:Download.gif){kind=small}
Release Date: January 18, 2002
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.
Windows 2000
The following file is available for download from the Microsoft Download Center:
Release Date: January 18, 2002
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.
The Qfecheck.exe Command Syntax
QFECheck can be run on any language version of Windows, but the text output is English only.
QFECHECK [/l[:location] /v /q /?]
/l Log output to <Computername>.log in the current folder
location. Use the specified location to store the
log file.
/v Verbose output
/q Quiet mode
/? This help
Examples of Qfecheck Output
Windows 2000 without a service pack or hotfixes installed:
Windows 2000 Hotfix Validation Report for \\WinAdvSrv
Report Date: 1/7/2001 9:9pm
Current Service Pack Level:
Hotfixes Identified:No Hotfixes found on system.
Windows 2000 Service Pack 1 (SP1) without hotfixes installed:
Windows 2000 Hotfix Validation Report for \\WinAdvSrv
Report Date: 1/7/2001 9:39pm
Current Service Pack Level: Service Pack 1
Hotfixes Identified:No Hotfixes found on system.
Windows 2000 SP1 with Q274835 installed:
Windows 2000 Hotfix Validation Report for \\WinAdvSrv
Report Date: 1/7/2001 9:54pm
Current Service Pack Level: Service Pack 1
Hotfixes Identified:
Q274835: Current on system.
Windows 2000 SP1 on which a hotfix is installed and the binary file is correct, but the catalog is not correct:
Windows 2000 Hotfix Validation Report for \\WinAdvSrv
Report Date: 1/9/2001 2:49pm
Current Service Pack Level: Service Pack 1
Hotfixes Identified:
Q267866: Current on system.
Q272743: This hotfix should be reinstalled.
Using the /v (verbose output) switch:
Windows 2000 Hotfix Validation Report for \\WinAdvSrv
Report Date: 1/11/2001 9:24pm
Current Service Pack Level: Service Pack 1
Hotfixes Identified:
Q267866: Current on system.
Q272743: This hotfix should be reinstalled.
The following files are not valid in the system catalog:
C:\WINNT\SYSTEM32\TELNET.EXE
C:\WINNT\SYSTEM32\DLLCACHE\TELNET.EXE
Windows 2000 SP1 on which a hotfix is installed but the binary file is not current:
Windows 2000 Hotfix Validation Report for \\WinAdvSrv
Report Date: 1/9/2001 10:54pm
Current Service Pack Level: Service Pack 1
Hotfixes Identified:
Q267866: Current on system.
Q272743: This hotfix should be reinstalled.
Using the /v (verbose output) switch:
Windows 2000 Hotfix Validation Report for \\WinAdvSrv
Report Date: 1/11/2001 9:30pm
Current Service Pack Level: Service Pack 1
Hotfixes Identified:
Q267866: Current on system.
Q272743: This hotfix should be reinstalled.
The following files are incorrect for this hotfix:
C:\WINNT\SYSTEM32\TELNET.EXE
C:\WINNT\SYSTEM32\DLLCACHE\TELNET.EXE
Additional Information
Note that all Windows 2000 and Windows XP files are protected by WFP. Hotfixes can contain updates to these files, examples of which may be .asp or .chm files. Qfecheck does not verify these files because they do not have catalog information on the computer.
Qfecheck.exe is placed in the %SystemRoot%\System32 folder. The installation alone does not verify hotfix integrity. To receive verification, open a command prompt window and run Qfecheck.exe.
Note that there is also a Microsoft Windows 95 version of Qfecheck.exe. Do not use this version with Windows 2000 or Windows XP. For additional information about the Windows 95 version, click the article number below to view the article in the Microsoft Knowledge Base:
145990 Windows 95 Update Information Tool (Qfecheck.exe)
Additional query words: kbSetup qfecheck exe kbregistry kbqfe
Keywords: kbproductlink kbhotfixserver kbqfe kbenv kbbug kbfix kbgraphxlinkcritical kboswin2000fix kbsetup kbwin2000sp3fix kbwinxpsp1fix KB282784
