Microsoft Personal Security Advisor (MPSA) is an easy to use web application
that will help you secure your Windows NT™ 4.0 or Windows 2000™ computer system.
Simply press the Scan Now button to receive a detailed report of your computer's
security settings and recommendations for improvement.
MPSA will scan your system and build a customized report on items such as:
missing security patches, weak passwords, Internet Explorer and Outlook Express
security settings, and Office macro protection settings. More details on the
specific tests performed by MPSA are available by clicking on the "Features"
menu option above.

For each weakness identified on your computer, MPSA provides easy to understand
information on the security issue at hand, how to fix it, and links to additional
information about the issue. Once you correct a reported deficiency, you can run
the scan again and see the results of the change. Running MPSA on a regular basis
will help ensure that your system stays up to date and secure.

How secure is your information when you are using this online tool. Privacy is
a great good.
greetings.

Bill

HFNETCHK: HFNetChk

QCHAIN:QChain

I think though that the MPSA tool for your own individual machine is cool to use because is shows many things and attempts to explain why you should do such and oftens gives the links to files or KB for doing such and HFSNETCHK does not go that far. If however you had a normal user run this MPSA tool and perform everything that it recommends, you would probably be paying a visit to the machine to repair the functionality of the system. Many suggestions are more applicable to a home machine then a business machine connected to a LAN/WAN.

As far as how secure is the information? I can not vouch for them, but it does not appear to send data back to M$. (your mileage may vary).

NOTE:
The current release version of the HFNETCHK tool is broken for most companies using firewalls, etc... Microsoft has a HFNetChk 3.2 Release Candidate beta that fixes the problems which prevent you from remotely scanning a system. It was working in 3.1x and they broke it in an updated version. The next version is supposed to be 3.3 I think and it should have some new functionality/and repairs.

Great tool for at least keeping on top of Servers. Nothing is automated, so how useful it is for trying to keep Workstations up to date is up to interpretation. For myself, trying to manually update and do multiple reboots on 1,000+ workstations is not very manageable. This would be much more of a job for SMS or other similar tools. (unless Bill gets his code completed and it works good, then I might be swayed to give it a try - That kind of coding is too
ambitious for me though)

[ 23 October 2001: Message edited by: NTDOC ]

Here is my script in progress I have put together that will utilize hfnetchk, qchain, and read a downloaded 'mssecure.xml' file stored in central location.

Current scripting will build qchain script that will execute on Win2K/NT clients without a problem. Still factoring such issues as when to run after build, HotFixes that do not write to the registry, etc.

Examples below snippets from current login script and QChain build/execute script - so no one should expect any funtionality at this time. Any good scripter on this site should be able to complete in no time.

Bill

code:

---

*
**  THIS SECTION CHECKS IF HFNETCHK SHOULD RUN  (Seperate area of script)
**  ALREADY DEPLOYED AND IN USE
*
; ##############################################################
; ##   Run HFNETCHK to check Win2K/NT HotFix installations.   ##
; ##   Set variable to run the check at script end.	      ##
; ##############################################################

  $HfxLog = "$LogDir\Hotfix\@WKSTA_$UserID.txt"					; REM **  Location of the HFNETCHK HotFix log
  IF ($InWin = 2)								; REM **  Only runs for Win2K/NT
    $Status = $OK
    $wri = WRITELINE (1, "$SkipMsg $SectDesc" + $CR)
    RETURN   
  ENDIF

  IF EXIST ("$HfxLog") = 1							; REM **  Look for check file to see if this recently run.
    $Status = $OK
    $wri = WRITELINE (1, "Verified HotFix check run previously" + $CR)
    RETURN
  ENDIF

  $TmpFile = "hfnetchk.exe"
  IF EXIST ("$OSDir\$OSSys\$TmpFile") <> 1					; REM **  Copy 'HFNETCHK.EXE' to client
    COPY "$CallDrv\Files\HotFix\$TmpFile" "$OSDir\$OSSys\"
    IF (@ERROR = 0)				$Msg = "Success copying"
    ELSE		$Err = $Err+1		$Msg = "Error @ERROR copying"
    ENDIF
  ELSE
    $SrcSize = GETFILESIZE ("$CallDrv\Files\HotFix\$TmpFile")			; REM **  Confirm current version of 'HFNETCHK' on client
    $SrcTime = GETFILETIME ("$CallDrv\Files\HotFix\$TmpFile")
    $DstSize = GETFILESIZE ("$OSDir\$OSSys\$TmpFile")
    $DstTime = GETFILETIME ("$OSDir\$OSSys\$TmpFile")
    IF ($SrcSize <> $DstSize) OR ($SrcTime <> $DstTime)
      COPY "$CallDrv\Files\HotFix\$TmpFile" "$OSDir\$OSSys\"
      IF (@ERROR = 0)				$Msg = "Success copying"
      ELSE		$Err = $Err+1		$Msg = "Error @ERROR copying"
      ENDIF
    ELSE
      $Msg = "Verified"
    ENDIF
  ENDIF
  $wri = WRITELINE (1, "$Msg hfnetchk" + $CR)

  IF ($Err = 0)		$RunHotFix = 1		$Status = $OK
  ELSE			GOSUB "ScriptError"
  ENDIF
RETURN

================================================
*
**  THIS SECTION RUNS HFNETCHK  (Seperate area of script)
**  ALREADY DEPLOYED AND IN USE
*
  IF $RunHotFix = 1
    SHELL "cmd /c $OSDir\$OSSys\hfnetchk.exe -a b -o tab -x $CallDrv\Files\HotFix\mssecure.xml > $HfxLog"
  ENDIF
================================================
*
**  THIS SECTION SCRIPTING IN PROGRESS
**  BUILDS QCHAIN EXECUTABLE FILE
**  NOT DEPLOYED - NOT COMPLETE
**  REQUIRES HOTFIXES STORED IN 'MSxx-yyy' STRUCTURE
**  REQUIRES HOTFIX EXECUTABLE IS NAMED 'MSxx-yyy*.EXE'
*
  $Err = 0
  $CR = CHR(13) + CHR(10)
  SELECT
    CASE @DOS > 5 $OS = "Win2K"
    CASE @DOS > 4 $OS = "WinNT"
  ENDSELECT

  $tmpfil = @WKSTA + "_" + @USERID.txt
  $con = OPEN (1, $tmpfil, 2)
  DIM $array[40]
  $z=0
  $x = READLINE (1)
  WHILE @ERROR = 0
    IF INSTR ($x, "NOT Found")
      $array[$z] = SUBSTR ($x, INSTR ($x, "MS0"), 8)
      $z=$z+1
    ENDIF
    $x = READLINE (1)
  LOOP
  $con = CLOSE (1)

  $QCFile = "QC_TST.txt"
  IF EXIST ($QCFile) = 1
    DEL $QCFile
  ENDIF
  $con = OPEN (1, $QCFile, 5)
  $z1=0
  DO
    $TmpVal = $array[$z1]
    use z: \\server1\share
    $QPath = "z:\Microsoft\Hotfix\$OS"
    IF EXIST ("$QPath\$TmpVal") = 0
      $Err = $Err+1
    ELSE
      $tmpfil = DIR ("$QPath\$TmpVal\$TmpVal*.exe")
      $wri = WRITELINE (1, "$QPath\$TmpVal\$tmpfil -z -m" + $CR)
    ENDIF
    $z1=$z1+1
  UNTIL $z1=$z

  $wri = WRITELINE (1, "qchain.exe z:\@WKSTA.txt" + $CR)
  $wri = WRITELINE (1, "Errors: $Err" + $CR)
  $con = CLOSE (1)
RETURN

---