Automating Security Patch checks using HFNETCHK – Calvin McLennan

Files for this FAQ are in the Files section of the SBSFAQ website under the section “Automation”
Download and unzip the AUTOHFNETCHK.ZIP file into D:\HFNETCHK
install BLAT by copying BLAT.EXE to the WINNT\SYSTEM32 directory
modify BLAT.BAT for proper SMTP server names and sending account
run BLAT.BAT
verify proper setup by opening D:\BLAT-ERR.TXT
NOTE: Daryl uses LOCALHOST for the SMTP name – which is fine if you are running it directly on the SMTP server. As I wanted to be able to run this on any server in an site – I’ve left it as a more defined name. Use LOCALHOST if you can.
filename: BLAT.BAT
contents>————————
rem: replace smtpservername.domain with the SMTP server you are using
rem: replace sendasname.address with the account name you are using
rem: run this once to install BLAT
rem: results of this run can be found in D:\BLAT-ERR.TXT
blat -install smtpservername.domain sendasname.address > D:\BLAT-ERR.TXT
————————————————
HFNETCHK results from servername.domainname
———————— dump.txt) will give you the necessary patch level information, but I wanted to also have the current version of HFNETCHK being run, whether there is a new version available, and the version of the MSSECURE.XML file being used, and whether it was a new download. Later versions of HFNETCHK are to have the proper version info sent without all the extra capture code required – so the usefulness of this CMD file may be eliminated soon.
filename: HFNETCHK.CMD
contents>————————
rem: this file must be edited before use
rem:
rem: servername.domainname.txt must be replaced with the actual servername.domainname.txt file name
rem:
rem: recipient.address must be replaced with the actual recipient address
rem:
rem: Command file to run for status of server’s patch levels
rem: based upon Microsoft’s HFNETCHK utility – using MSSECURE.XML file
rem: requires BLAT command line mailer to be previously installed and tested
rem: BLAT requires access to an SMTP server to send mail through
rem:
rem: Once tested, create a daily scheduled run of this command
rem:
rem: make path to required files
D:
cd\hfnetchk
rem:
rem: date stamps the log file, /T calls for command line extensions
rem: single creates a new log file
date /T > netchk.log
rem:
rem: time stamps the log file, /T calls for command line extensions
time /T >> netchk.log
rem:
rem: run the HFNETCHK executable
rem: it will check for new version of itself
rem: it will check for new version of mssecure.xml file
rem: and download the new one if it can
rem: -v switch allows for verbose output
rem: -z switch stops check of registry, just does file inspection
rem: netchk.log is the capture file name
rem: 2>&1 sends the STDERR output to the log file for version capture
hfnetchk -v -z >> netchk.log 2>&1
rem:
rem: BLAT sends the log file to the desired recipient
rem: BLAT must be previously installed and tested
rem: the first file name is created specific to the server the command runs on
rem: the .txt file exists in the same folder
rem: -to address.name specifies the intended recipient
rem: -attach attachs the .log file to the email
blat servername.domainname.txt -to recipient.address -attach netchk.log
————————