How to install multiple Windows updates or hotfixes with only one reboot

This article describes how to install multiple Windows product updates (for example, critical updates, security patches, or hotfixes) that use Hotfix.exe (Microsoft Windows NT 4.0) or Update.exe (Microsoft Windows 2000, Microsoft Windows XP, or Microsoft Windows Server 2003) with only one restart. This article is intended for administrators and IT professionals. You can install Windows product updates that use Hotfix.exe or Update.exe either alone or in combination with Windows (with or without a service pack).

Note The procedure that is described in this article does not work for product updates that do not use Hotfix.exe or Update.exe as the installation program. For example, Internet Explorer updates for Windows NT 4.0, Windows 2000, and Windows XP use an INF-based installation instead of Update.exe. As a result, you cannot use this procedure to install multiple Microsoft Internet Explorer updates with only one restart on Windows NT 4.0, Windows 2000, or Windows XP. Because Internet Explorer updates for Windows Server 2003 use Update.exe as the installation program, you can use this procedure to install them.

For additional information about these topics, see the following Microsoft Web sites:

Windows 2000Windows XPWindows Server 2003 and Windows XP Professional x64 EditionWindows Server 2003 Service Pack 1

A Windows product update (for example, a critical update, a security patch, or a hotfix) is an executable (.exe) file that contains one or more system files that you can apply to Windows to correct a specific problem. Microsoft Product Support Services distributes hotfixes to customers who are severely affected by a specific problem. Critical updates and security patches are updates that Microsoft recommends for all customers. You can obtain critical updates and security patches from the Windows Update Web site, the Microsoft Update Web site, the Microsoft Download Center, or from other Microsoft Web sites.

Windows XP x64 Edition updates and Windows Server 2003 updates or Windows XP and Windows 2000 updates that were created after December 2002

Note To determine when an update was created, view the Modified date on the Update.exe or Hotfix.exe installation program in the update package.

To install a Windows product update on a single computer, run the product update program on the computer that you want to update. To install multiple product updates without restarting the computer between each installation, use the /z switch.

Command-line options for the Update.exe program

The following table identifies the command-line options (or switches) that the Update.exe program supports:The following code sample is a batch file that installs multiple product updates and makes sure that the correct files are replaced after the computer is restarted. Note QChain.exe functionality is included in all Windows XP x64 Editions, Windows Server 2003, Windows XP, and Windows 2000 product updates that use Update.exe and that were released since May 18, 2001. However, an issue exists in product updates that were released before December 2002 that may apply the wrong binary on your computer in some circumstances. In March 2003, Microsoft released an updated version of QChain.exe to resolve this issue. For additional information about this issue or to obtain the updated Qchain.exe tool, click the following article number to view the article in the Microsoft Knowledge Base:

All Windows NT 4.0 updates or Windows XP and Windows 2000 updates that were created before December 2002

Note To determine when a product update was created, check the Modified date on the Update.exe or Hotfix.exe installation program in the update package.

Microsoft has released a command-line tool that is named QChain.exe. With QChain.exe, system administrators can chain updates together. When you chain updates, you install multiple updates without restarting the computer between each installation. Without this tool, the only supported method is to restart the computer after each update installation. The QChain.exe tool has the following benefits:

• It increases uptime for servers because computers are not being restarted between each update installation.
• It permits faster installations of multiple updates on a single computer.
• It works on both Windows 2000 and Windows NT 4.0.

Note QChain.exe functionality is included in all Windows XP and Windows 2000 updates that were released since May 18, 2001, but an issue exists in updates released before December 2002 that may result in the wrong binary being placed on your computer in some circumstances. In March 2003, Microsoft released an updated version of QChain.exe to resolve this issue. For more information about this issue or to obtain the updated Qchain.exe tool, click the following article number to view the article in the Microsoft Knowledge Base:

Chaining update installations without QChain.exe is not safe

When you install updates, if a file is locked or in use, it cannot be replaced. As a result, the file is placed in the Pending File Rename queue and is replaced after the computer restarts. The problem occurs in the following scenario:

• You install updates A and B without restarting the computer between installations.
• Both packages contain file X. Package A's file X is version 3; package B's file X is version 2. The version of file X on the computer is version 1.
• When package A is installed, it places its version of file X in the Pending File Rename queue.
• When package B is installed, it places its version of file X in the Pending File Rename queue.
• When the computer is restarted, because package B was installed last, its version of file X is installed (in the Pending File Rename queue, the last file is the one that is used). As a result, version 2 is installed instead of version 3 as you expected.

If previously chained updates are installed without restarting

Although this scenario is rare, it is good practice to verify that your computer has all the fixes that you believe are installed. To verify this, use the Qfecheck.exe tool. For more information about Qfecheck.exe, click the following article number to view the article in the Microsoft Knowledge Base: QChain.exe cleans the Pending File Rename Operations key in the registry to make sure that only the latest version of a file is installed after the computer is restarted.

To install multiple updates with only one restart

1. Run the update installer with the -z switch to instruct the installer not to restart after the installation. Add the -m switch (for Quiet mode) if you do not want prompts or messages to appear during the installation.
   
   The update installer is one of the following programs:
   • The self-extracting package program file (for example, Qnnnnnn_w2k_spx_x86_en.exe).
   • Hotfix.exe (if you have extracted all the files from the package).
2. After you install all the hotfixes, run QChain.exe.
3. Restart the computer.

You can also create a batch file to do this. The following sample batch file demonstrates this method:

How to obtain QChain.exe

QChain.exe functionality is included in all Windows XP and Windows 2000 updates that were released since May 18, 2001, but an issue exists in updates that were released before December 2002 that may result in the wrong binary being placed on your computer in some circumstances. In March 2003, Microsoft released an updated version of QChain.exe to resolve this issue. For more information about this issue or to obtain the updated Qchain.exe tool, click the following article number to view the article in the Microsoft Knowledge Base:

The QChain.exe Command Syntax

The optional [logfilename] parameter creates a file with a before and after snapshot of the Pending File Rename Operations key.

Sample QChain.exe output

Limitations of QChain.exe

Although QChain works with most Windows NT 4.0 and Windows 2000 updates, QChain.exe may not work with updates that contain binary files that are listed in the following registry key: Binary files (binaries) that are listed in this registry key are loaded in memory at startup. When the update installer calls the GetFileVersionInfo function on a binary from this list, update installer refers to the binary that is already loaded instead of the binary that is actually present in the target location.

Because the binaries that are listed in the KnownDLLs registry key load into memory at startup, the update installer must replace the target binary with the fixed binary before the computer restarts. Therefore, the update installer does not create a Pending File Rename Operation to replace the binary at restart. Instead, the update moves the current binary to a temporary location, puts the fixed binary where the current binary was, and then creates a Pending File Rename Operation to delete the current binary when the computer restarts.

QChain affects only Pending File Rename Operations that perform binary replacement operations. It does not do anything with Pending File Rename Operations that perform delete operations.

All Windows NT 4.0 updates and all Windows 2000 updates that are earlier than SP2 use GetFileVersionInfo to identify the version of a file. If you install two or more Windows NT 4.0 updates or pre-SP2 Windows 2000 updates, and the updates contain overlapping KnownDLLs, the use of QChain to chain the installation of those updates does not make sure that the latest-versioned fix is installed.

The following scenario shows why QChain may not put the correct binary on the system:

• You install update packages A and B and you do not restart between installations.
• Both packages contain Kernel32.dll, a file that is in the KnownDLLs list. Package A includes Kernel32.dll version 3, package B includes Kernel32.dll version 2, and the computer has Kernel32.dll version 1 installed.
• When package A is installed, GetFileVersionInfo reports that the computer has Kernel32.dll version 1. Because package A includes version 3, the update installer identifies the need for file replacement.
  • The update installer moves the Kernel32.dll version 1 on the computer to a temporary location and creates a Pending File Rename Operation to delete the Kernel32.dll file from the temporary location the next time the computer restarts.
  • Package A's Kernel32.dll version 3 is copied to the computer.
• When package B installs, GetFileVersionInfo still reports that Kernel32.dll version 1 is installed on the computer because GetFileVersionInfo reads the version information from the Kernel32.dll that is loaded in memory. Package B has version 2, and the hotfix therefore identifies the need for file replacement.
  • The update installer moves the Kernel32.dll that is now on the computer (package A's Kernel32.dll version 3) to a temporary location and creates a Pending File Rename Operation to delete the (version 3) Kernel32.dll from the temporary location the next time the computer restarts.
  • Package B's Kernel32.dll version 2 is copied to the computer.
• QChain runs, but there are no Pending File Rename Operations for file replacement and QChain therefore does nothing.
• Because package B installed most recently, the package B Kernel32.dll version 2 is in the correct location on the computer. Therefore, it loads into memory when the computer restarts. The Pending File Rename Operations delete both the original Kernel32.dll version 1 and package A's Kernel32.dll version 3. As a result, the computer now has Kernel32.dll version 2 instead of version 3.

There is a post-SP2 Windows 2000 fix where GetFileVersionInfo is no longer used on the KnownDLLs that are loaded in memory. Instead, the update installer maps the file that is actually present in the target location, and then calls GetFileVersionInfo on the mapped file. Therefore, you can use QChain.exe to chain post-SP2 Windows 2000 updates together. When you do so, the latest version of a file is installed, regardless of the order the updates are installed.

If you replay the previous scenario, and use post-SP2 Windows 2000 updates, the hotfix in package B maps package A's Kernel32.dll and recognizes version 3. Version 3 is later than package B's own Kernel32.dll version 2. Therefore, package B does not replace the Kernel32.dll that is on the system, and package A's Kernel32.dll version 3 is the version that the computer correctly uses after the computer restarts.