Microsoft Baseline Security Analyzer 1.2.1 Frequently Asked Questions

You can manually download the signed English mssecure.cab file used for the security updates check in MBSA V1.2.1 from the following Microsoft Web site: https://go.microsoft.com/fwlink/?LinkId=18922. Place the downloaded CAB file in the MBSA installation folder.

The localized mssecure.cab files can be manually downloaded from the following locations:

• German mssecure.cab file: https://go.microsoft.com/fwlink/?LinkId=18121.
• Japanese mssecure.cab file: https://go.microsoft.com/fwlink/?LinkId=18120.
• French mssecure.cab file: https://go.microsoft.com/fwlink/?LinkId=18122.

These are the only supported locations where the signed mssecure.cab files can be downloaded for offline use.

Scanning for Microsoft Office product updates (local computer scans only) uses a somewhat different procedure in order to download the needed files:

• Download INVCIF.EXE from https://go.microsoft.com/fwlink/?linkid=18842 and
  Download INVCM.EXE from https://go.microsoft.com/fwlink/?linkid=18452
• Run INVCIF.EXE, and answer Yes to install the Office Update Inventory Tool, read the EULA and agree to its terms, and specify a local directory to expand the contents into, for example C:\TEMP\OfficeUpd). This will create multiple files including PatchData.XML and InventoryCatalog.HTML, as well as a directory named CIFS. A file called PUIDS.CIF will be extracted into the CIFS directory.
• Run INVCM.EXE, and answer Yes to install the Office Update Inventory Tool, read the EULA and agree to its terms, and specify a local directory to expand the contents into, for example C:\TEMP\OfficeUpd). This will create multiple files including inventory.exe, convert.exe, OUDetect.dll required for scanning.
• Copy all the files and directories in C:\TEMP\OfficeUpd into the C:\Microsoft Baseline Security Analyzer\OfficeUpd directory on the scanning machine. If you are prompted to overwrite existing files click “Yes”.

At this point run MBSA from the desktop icon or Start menu, or open a command prompt in the C:\Microsoft Baseline Security Analyzer folder and use mbsacli.exe. The files you just obtained will be used, although the tool will attempt to obtain them from the Internet and may lead to a timeout before the scan takes place using the local files.

  <div></div>
  <p>
    <br />
  </p>
</td>

This is addressed in the "readme.html" file in the "Help" directory under the "#firewall" section. If you require remote scanning of Windows XP Service Pack 2 machines, these conditions must be met :

• The Server service, Remote Registry service, and File & Print Sharing services must be enabled.
• Remote machine scans are performed using TCP ports 139 and 445. In a multi-domain environment, where a firewall or filtering router separates the two networks, TCP ports 139 and 445 and UDP ports 137 and 138 must be open in order for MBSA to connect and authenticate to the remote network being scanned. You must allow these ports on the remote Windows Firewall.

MBSA V1.2.1 scans for security misconfigurations in Windows 2000, Windows XP, Windows Server 2003, Microsoft Internet Information Services (IIS) 4.0, 5.0, and 6.0, Microsoft Internet Explorer (IE) 5.01 and 6.0, Microsoft SQL Server 7.0 and 2000, and Microsoft Office 2000, XP, and 2003.

  <p>
    <br />
  </p>
  <table border="1" bordercolor="#eaeaea" cellpadding="0" cellspacing="0" id="ENDAC">
    <tbody>
      <tr valign="top">
        <td>
          <p>
            <strong>Note:</strong> For products that are not installed on a scanned machine, MBSA V1.2.1 will not perform the security updates check for those products and will not list them in the Security Update Scan Results table in the report.</p>
        </td>
      </tr>
    </tbody>
  </table>

  <p>
    <br />
  </p>
  <p>MBSA currently does not detect security updates for products that are not included in the list above, including Front Page Server Extensions, Outlook Express, .NET Framework, Internet Explorer 7, and others (see <a runat="server" href="https://support.microsoft.com/kb/895660">KB 895660</a> for a complete list). MBSA also does not support being installed on or scanning against the Windows Embedded family of products or 64-bit systems.</p>
  <p>
    <br />
  </p>
</td>