MBSA: Revisiting an old friend

I've noticed over the years that there's a really funny trend when it comes to Microsoft add-ons and utilities: the most useful members of the bunch tend to be [a] free, and [b] entirely under-utilized because nobody realizes that they're there. With the release of a new version of the Microsoft Baseline Security Analyzer (MBSA), it's a good time to introduce this neat little tool to those of you who aren't familiar with it, and perhaps re-introduce it to those of you who've relegated it to a closet.

MBSA is a free utility that allows you to scan anywhere from one to 10,000 computers for patch levels and various potential security "gotchas." (Unlike Windows Update, though, it does not automatically download any missing patches that it finds.) The utility runs on any machine running Windows 2000 or better, and has been localized for English, German, Japanese and French.

In addition to providing support for XP SP2, the new version of MBSA (1.2.1) has greatly improved the "help" function that provides detailed information about the issues it finds. No really, I mean it. Rather than being the stereotypical "no-help" help system, the new MBSA actually offers useful and clearly written guidance concerning where to find security patches and how to correct potential security issues. MBSA

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Microsoft Windows patches and critical updates Troubleshooting Microsoft WSUS connectivity issues Windows security tools for the busy desktop administrator Why should Windows shops use Microsoft Baseline Security Analyzer? Enhancing patch management with NAP The 10 most common Windows security vulnerabilities Windows security in the enterprise: Tutorials Microsoft will release three critical patches in May Critical patches for IE and Office released Have my Windows patches actually been installed? PatchLink Update 6.4

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

can scan for updates for Windows, SQL, IIS, Office, Exchange 2003, Content Management Server and a number of other Microsoft products. The newest version will also perform a configuration check on your Windows Firewall/ICF configuration and your Windows Update settings.

And MBSA will scan for some of the most common -- and dangerous -- security misconfigurations on Windows machines, including:

The one possible shortcoming to MBSA -- and the reason why I didn't use it all that extensively initially -- is that the MBSA GUI produces a single XML file for each machine that it scans. So if you have a large domain, it would seem that you're forced to sit and click "show next report" until your mouse fingers threaten to sue for carpal tunnel.

However, MBSA also has a command-line component that can be incorporated into any number of scripting solutions. In fact, you'll find several sample scripts on Microsoft's Web site that perform a number of tasks, including my favorite: creating a summary report from an entire MBSA scan. These scripts are freely available for download, and can be customized to suit your environment. This level of flexibility makes MBSA a useful utility in any Windows administrator's tool belt.

Laura E. Hunter is a Microsoft MVP and SearchWin2000.com site expert.