News

Spending Big Bucks for NT Patches? Shavlik Can Help You Scan

• By Scott Bekker
• July 28, 2005

The Microsoft Custom Support Agreement (CSA) is the official end-around to the Microsoft's support deadlines of June 30, 2004 for Windows NT 4.0 Workstation and Dec. 31, 2004 for Windows NT 4.0 Server. In cases where customers can prove to Microsoft's satisfaction that they're planning migrations to Windows Server 2003, Microsoft will agree to provide custom security patches for "important" and "critical" security vulnerabilities affecting the aging platform. This program is supposed to be available through the end of 2006.

Given the price tag, the program tends to appeal only to huge organizations running important applications on Windows NT.

Shavlik, whose HFNetChkPro patch management application scans the network for systems that need patches, has been working with one CSA customer since the Windows NT 4.0 Workstation deadline a year ago. Shavlik creates patch signatures that allow the customer, a financial institution, to scan the network for systems that require the patch.

"On patch day, that customer will send us their private NT 4 patches that they've received from Microsoft," says Eric Schultze, chief security architect at Shavlik. Schultze adds that the customer had to send Shavlik a letter verifying that Microsoft had granted permission to forward the patches. "We parse open the patches, then we add those patch details to our XML file for that customer. The normal XML files I post [for all Shavlik customers] would be absent this patch." Shavlik distributes its patch signatures and other patch information in public XML files that can be read by HFNetChkPro and customized by users.

So far, Shavlik's customer base for the specialized service has grown to eight organizations, with customers ranging from global system integrators to financial institutions to commercial companies.

"Without doing anything, we've had these eight customers. Now that we're promoting this program, this thing could grow larger," Schultze said.

Schultze hastens to add that Shavlik's program doesn't offer a back-door way to obtain Microsoft's pricey NT 4.0 patches. Once Shavlik extracts the details needed to scan for the patches, Shavlik deletes the patches and does not redistribute them.

To be eligible for the Shavlik program, customers must be up to date on their Shavlik maintenance fees and must prove they have entered a CSA with Microsoft. Shavlik charges an additional $25,000 to its customers for the service. Alternatively, Shavlik customers can buy the service on a patch-by-patch basis for $1,000 each.