Microsoft Baseline Security Analyzer (MBSA) doesn't scan for missing updates to Microsoft Office, which makes keeping up with those updates difficult and leaves us vulnerable to Office-specific exploits on unpatched systems. Are third-party tools available that can scan multiple computers for missing Office updates?

You have two options. Shavlik Technologies' free HFNetChkLT utility includes Office updates when scanning computers and can automatically install missing updates. Microsoft's recently released Office Update Inventory Tool 2.0 shows you which version of Office is installed on each system and identifies both installed and missing updates. You can run this tool from your desktop to obtain the status of all computers on your network. The Office Update Inventory Tool 2.0 is available for free at http://www.microsoft.com/office/ork/xp/journ/offutool.htm.

Another free Microsoft tool, OHotFix (http://www.microsoft.com/office/ork/xp/journ/ohotfix.htm), helps you automate Office update installations on your computers. To use OHotFix, you create a shared folder on your network, then copy OHotFix and all the Office updates you want to install into that folder. (Office updates come in Windows Installer patch packages—.msp files.) Then, have all your computers run OHotFix from the shared folder. The easiest way to run the tool on all your systems is to email a shortcut to all users. To completely automate the process, you can create a batch file, then use Group Policy to designate the batch file as a logon or startup script on your member computers.

All these tools support Office XP and Office 2000. OHotFix automatically handles computers that are at different update levels: Simply supply OHotFix with all the updates you want to install, and the tool will install only the missing updates on each computer.