Check OS and then Run Security Patch

[Greg Halpin]

Hello,

I have read a lot here and on www.microsoft.com/technet/scriptcenter
I found great stuff but need some help putting different scripts
together.

I want to run security patch updates from the Logon script for
different versions of Windows. I found a script on technet that finds
the OS version but I don't know how to tell it to run the appropriate
patch.

For example, if the OS is XP, I want to run patch:
\\server\share\patches\xp\patch1

If the OS is Win 2000 Pro, I want to run patch:
\\server\share\patches\2000pro\patch1

Here's the VB Script. It will be called upon from the logon script.
How do I tell it to point to \\server\share\patches\xp\patch1 or the
2000 patch?

Thanks.
Greg
- - - - - - - - - - - -

Set objWMIService = GetObject("winmgmts:" & _
"{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery _
("Select * from Win32_OperatingSystem")

For Each objOperatingSystem In colOperatingSystems
intOSType = objOperatingSystem.OSType
strOSVer = Left(objOperatingSystem.Version, 3)
Next

Select Case intOSType
Case 16 'Windows 95
intOSVer = 1
Case 17 'Windows 98
intOSVer = 2
Case 18
Select Case strOSVer
Case 4.0
intOSVer = 4 'Windows NT 4.0
Case 5.0
intOSVer = 5 'Windows 2000
Case 5.1
intOSVer = 6 'Windows XP
Case 5.2
intOSVer = 7 'Windows Server 2003
Case Else
intOSVer = 0 'Older or newer version
End Select
Case Else
intOSVer = 0 'Older or newer version
End Select

[Torgeir Bakken]

Greg Halpin wrote

> I want to run security patch updates from the Logon script for
> different versions of Windows. I found a script on technet that finds
> the OS version but I don't know how to tell it to run the appropriate
> patch.
>
> For example, if the OS is XP, I want to run patch:
> \\server\share\patches\xp\patch1
>
> If the OS is Win 2000 Pro, I want to run patch:
> \\server\share\patches\2000pro\patch1
>
> Here's the VB Script. It will be called upon from the logon script.
> How do I tell it to point to \\server\share\patches\xp\patch1 or the
> 2000 patch?

Hi

I prefer to get the OS version with a registry read and not WMI (quicker),
take a look at the function GetOsVersionNumber and how to use it in this
post (it has a function to get Service Pack level as well):
http://groups.google.com/groups?selm=3EB70B7E.12C8CE54%40hydro.com

Here is a updated version of your script that launches different patches
based on OS (added "SetLocale "en-us"" as well to support computers with
different locale):

Set objWMIService = GetObject("winmgmts:" & _
"{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery _
("Select * from Win32_OperatingSystem")

For Each objOperatingSystem In colOperatingSystems
intOSType = objOperatingSystem.OSType
strOSVer = Left(objOperatingSystem.Version, 3)
Next

SetLocale "en-us"

Select Case intOSType
Case 16 'Windows 95
intOSVer = 1
Case 17 'Windows 98
intOSVer = 2
Case 18
Select Case strOSVer
Case 4.0
intOSVer = 4 'Windows NT 4.0
Case 5.0
intOSVer = 5 'Windows 2000
Case 5.1
intOSVer = 6 'Windows XP
Case 5.2
intOSVer = 7 'Windows Server 2003
Case Else
intOSVer = 0 'Older or newer version
End Select
Case Else
intOSVer = 0 'Older or newer version
End Select

Set objShell = CreateObject("Wscript.Shell")

If intOSVer = 6 Then
objShell.Run "\\server\share\patches\xp\patch1", 1, True
ElseIf intOSVer = 5 Then
objShell.Run "\\server\share\patches\2000pro\patch1", 1, True
End If

--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter

[Greg Halpin]

Torgeir,

Your information was very helpful. I have tested it and it works with
executable files but not .bat files. Is there some other syntax I
need to call upon a .bat file from a VB script?

The reason I need to do it that way is because I can put switches in
the .bat file to tell the PC not to reboot after running the patch.
And also, I need to use the RunAs command to run it as admin.

Thanks,

Greg

"Torgeir Bakken" <torgeir.b...@hydro.com> wrote in message news:<uuhE$TCvDH...@TK2MSFTNGP10.phx.gbl>...

[Torgeir Bakken (MVP)]

Greg Halpin wrote:

> Torgeir,
>
> Your information was very helpful. I have tested it and it works with
> executable files but not .bat files. Is there some other syntax I
> need to call upon a .bat file from a VB script?

Hi

There is no difference really, you should be able to start the batch file like this:

objShell.Run "\\server\share\patches\xp\patch1.bat", 1, True

If you want to hide the command prompt, change the second parameter from 1 to 0, like this:

objShell.Run "\\server\share\patches\xp\patch1.bat", 0, True

[Greg Halpin]

Torgeir,

That worked. Thanks again. I was also able to get it to work with
the %logonserver% variable so the script does not have to point to a
specific server.
I changed it to:
objShell.Run "%logonserver%\netlogon\share\patches\xp\patch1.bat",
1, True

[Greg Halpin]

Torgeir,

It works but I ran into a glitch. When it checks the OS it does not
make a distinction between Win 2000 Pro and Win 2000 Server or
Terminal services.

If a user logs in via Terminal services, we want the script to just
end because the patches for Windows 2000 server are different than
2000 Pro. Plus we do not want to install patches on the servers via a
user's logon. We would need to check for WINNT 40 server also or any
version of server.

Can you advise on how to modify this?
Thanks again,
Greg

SetLocale "en-us"

objShell.Run "%logonserver%\netlogon\patchtest\XP\xpmain.bat", 1,

True
ElseIf intOSVer = 5 Then

objShell.Run "%logonserver%\netlogon\patchtest\2000\2000main.bat",
1, True
End If

[Torgeir Bakken (MVP)]

Greg Halpin wrote:

> Torgeir,
>
> It works but I ran into a glitch. When it checks the OS it does not
> make a distinction between Win 2000 Pro and Win 2000 Server or
> Terminal services.
>
> If a user logs in via Terminal services, we want the script to just
> end because the patches for Windows 2000 server are different than
> 2000 Pro. Plus we do not want to install patches on the servers via a
> user's logon. We would need to check for WINNT 40 server also or any
> version of server.

Hi

The registry value ProductType under
HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions\ can help you with this.

Take a look at the function GetPlatform here, it will work for NT4 and up:

http://groups.google.com/groups?selm=3F79645E.B132DBB0%40hydro.com