Determining Patch Changes

[Glenn9999]

The question I have is how do you determine which patches are still valid? In other words, say a patch comes out that patches the same files as another patch did in the past. Is there a quick way to find that out by looking at the patch files? Or do you have to read all the KB entries and see if it mentions newer versions of the same files?

[#rootworm]

i do it the easy way and check to see what patches RyanVM uses in his update pack at: ryanvm.net

[RyanVM]

Pretty much every KB article lists the new file revisions a various hotfix includes, so keeping track of what obsoletes what is pretty straightforward. Just note the difference between GDR and QFE versions of the files, as they carry the same version number.

http://support.microsoft.com/default.aspx?...kb;en-us;824994

Edited April 24, 2007 by RyanVM

[Glenn9999]

As it turns out, I found out that Microsoft put all I wanted to know about this topic in the registry, so I have all I want to know

[deduijk]

Too bad you don't elaborate where.... This could help others u kno...

...

Really appreciate if you tell me where.. saves me the time looking it over..

Cya,

deduijk

Edited April 30, 2007 by deduijk

[RyanVM]

My bet is that he's referring to HKLM\Software\Microsoft\Updates

[Glenn9999]

Good bet.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates

You'll find for each patch (most of them anyway) applied to the system that it will list the files in the patch along with versions and where on the system the file was placed. If you put all the values in that subkey path together in the right way it can tell you a file version history along with the patch ID for each one. It doesn't give you anything certain, but it points you towards some places to look.

A good example of something that came out of the registry on my computer after I put the data together:

tzchange.exe is in:

KB928388 5.1.2600.3037 5.1.2600.3073

KB929120 5.1.2600.3042 5.1.2600.3073

KB931836 5.1.2600.3073 5.1.2600.3073

The current version of the file on the machine is 5.1.2600.3073 (that's the third column), so you can look at the other two patches as possibly deprecated by KB931836. Now Microsoft sometimes patches a file along with other things, so you really do have to check things out. But it's a better start than just looking up all the KB numbers.

BTW, if you look at the KB entry for 931836 it says: "The update that this article describes is a cumulative update rollup that includes all the changes that were previously released in Microsoft Knowledge Base articles 928388 and 929120." So those two patches are safe to delete.