Re: ie patches - deploying

From: David Dickinson [MVP] (eis@no-spam.softhome.net)
Date: 06/03/02 

From: "David Dickinson [MVP]" <eis@no-spam.softhome.net>
Date: Mon, 3 Jun 2002 02:18:12 -0600

Timboi wrote:
> Hi,
> I"m trying to figure out how you are suppose to deploy the
> ie patches in an enterprise. The windows patches are no
> problem - we create Ghost packages which we deloy with
> ghost (running each package in quiet mode and qchaining
> them). However, each damn internet explorer patch demands
> that the user clicks yes/no for a restart. There seems to
> be no way around this (no proper quiet mode? why not?),
> meaning that we cannot deploy these packages through ghost
> and therefore we will have to deploy these patches
> manually, which really isn't a good option. Any idea?

These are the command line switches for IE updates, although not all
switches work with all packages:

/q - Specifies quiet mode, or suppresses prompts, when files are being
extracted.
/q:u - Specifies user-quiet mode, which presents some dialog boxes to the
user.
/q:a - Specifies administrator-quiet mode, which does not present any dialog
boxes to the user.
/t:path - Specifies the target folder for extracting files.
/c - Extracts the files without installing them.
/c:path - Specifies the path and name of the Setup .inf or .exe file.
/r:n - Never restarts the computer after installation.
/r:i - Restart if necessary - Automatically restarts the computer if it is
necessary to complete installation.
/r:a - Always restarts the computer after installation.
/r:s - Restarts the computer after installation without prompting the user.
/n:v - No version checking - Install the program over any previous version.

See http://support.microsoft.com/default.aspx?scid=kb;en-us;Q197147

Note that /n:v is not supported and may result in an unbootable system.

For automatically restarting the destination computer, you would use
 /q:a /r:s

Some patch distributions are setup programs that are encapsulated in other
setup programs. "The outer setup provides a single .exe which, when run,
extracts the contents needed for the inner setup and then invoke the setup.
Subsequently, to control the behavior of the redistribution, you need to
invoke it with command line switches that control both inner and outer
setups" (see Q192009 for an example using the MDAC redistribution package).
When used as a switch for the outer wrapper, /Q is usually passed on by
default to the inner setup options. Some switches for the inner wrapper may
be:

/A Administrator Mode.
/G <filename> Generate logfile of installation activity.
/Q[0|1|T] Quiet install mode (0 shows exit, 1 hides exit, T hides
all display).
/QN[1|T] Quiet install mode with reboot suppressed.
/R Reinstall application (MDAC 1.5 Redistribution only)
/U[A] Uninstall the application but leaves shared components
(/UA to remove all).
/X <filename> Set network log location for tracking install instances.
/Y Install without copying files.

For these types of patches, you would put switches intended for the inner
setup program in quotation marks on the command line for the outer package,
e.g.

Q318203_MSXML30_x86.exe /Q "/C:dahotfix /Q /N"

where dahotfix is, in this case, the name of the encapsulated setup program.
Alternatively, of course, you could use the wrapper's switches to extract
the contents and then call the setup program directly.

However, because different patches for different applications may behave
differently and recognize different switches, it's always best to test.
Maybe one of these days there will be a little more uniformity. 

--
David Dickinson, MVP (Security)
EveningStar Information Services
Las Cruces, NM USA
Summary of Microsoft Security Bulletins
http://www.zianet.com/bwd/securitybulletins.asp