MBSA 1.2 incomplete scan

[Peter Bauer]

Hi all,

I have a problem with the mbsa scanner version 1.2.
If I start an ip range scan, I get only incomplete scans with the error
message "could not access the security update XML file" in all categories.
If I try a single scan to only one machine, it works fine.

After I have checked my software, if I have the latest service releases, I
have given up.

Hope you can help me or mybe you can tell me where I can find this file.

Thank you
Peter

[Nelson Araujo [MSFT]]

That means MBSA cannot contact the internet to download the security
database. You can allow MBSA to access the internet to download it, or
download yourself the file (a single CAB file per language) and put in MBSA
folder.

Run mbsacli and it will tell you what file it is trying to download. It will
show the full URL. Just copy it to a browser and download the file. Or check
your firewall for blockings in that specific address.

Hope this helps,
--
Nelson Araujo, CISSP [MSFT]
nel...@online.microsoft.com

If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for the Microsoft Baseline
Security Analyzer (MBSA) at the following link:
http://support.microsoft.com/default.aspx?scid=fh;en-us;Prodoffer20a

This e-mail address does not receive e-mail, but is used for newsgroup
postings only.

"Peter Bauer" <peter_b...@hotmail.com> wrote in message
news:opr767um...@news.austria.eu.net...

[Peter Bauer]

is it possible to view a logfile from MBSA, to locate the problem ?

[Nelson Araujo [MSFT]]

MBSA depends on the security database it downloads from the internet to
perform patch (updates) check. All other checks (IIS, password, etc) can be
done without network connectivity or file drop.

To better understand what's going on, please try to use the command-line
version (mbsacli) located in the same folder you installed MBSA. Open a
Command Prompt window, go that folder and run mbsacli <options>. You can get
complete help about mbsacli parameters by issuing "mbsacli -?"

Let me know the results,

--
Nelson Araujo, CISSP [MSFT]
nel...@online.microsoft.com

If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for the Microsoft Baseline
Security Analyzer (MBSA) at the following link:
http://support.microsoft.com/default.aspx?scid=fh;en-us;Prodoffer20a

This e-mail address does not receive e-mail, but is used for newsgroup
postings only.

"Peter Bauer" <peter_b...@hotmail.com> wrote in message

news:opr78k0f...@news.austria.eu.net...
> Hi Nelson Araujo,
>
> thank you for your answer, but i don`t understand why I can try a single
> scan without errors.
> If MBSA can`t connect to the internet, to download the security database,
> how it can perform a single scan ?
>
> Now I have tried it to download the cab file seperatly but the range scan
> finished with the same error message.
>
> Ciao Peter

>
>
>
>
> On Tue, 18 May 2004 15:19:21 -0700, Nelson Araujo [MSFT]
> <Nel...@online.microsoft.com> wrote:
>

>> That means MBSA cannot contact the internet to download the security
>> database. You can allow MBSA to access the internet to download it, or
>> download yourself the file (a single CAB file per language) and put in
>> MBSA
>> folder.
>>
>> Run mbsacli and it will tell you what file it is trying to download. It
>> will
>> show the full URL. Just copy it to a browser and download the file. Or
>> check
>> your firewall for blockings in that specific address.
>>
>> Hope this helps,
>
>
>
> --

> Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/

[Christophe]

I'm running MBSA 1.2 on Windows 2000 SP3
On 99% of our PCs, it's work greatly

But on the other, we've got incomplete scan
I find that inventory.exe generate an error 30010 in the log file
This EXE is in the folder C:\Program Files\Microsoft Baseline Security
Analyzer\OfficeUpd
MBSA generate an error 002322

I haven't found any documentation about this errors on Microsoft's web
site

Inventory use Windows Installer.
Service Windows Installer work correctly on this machine.

I've found when I delete all files in c:\winnt\installer,
inventory.exe makes the same error. But on the machine in problem,
that folder is "good"

Is someone know where to find a list of error codes ?
Or Is someone have an idea to clear that error ?

Thanks

[Bruce Leban [MSFT]]

It seems likely that the error you're seeing is

Office Update Inventory Tool did not complete processing.

which is associated with error code 2322. If you're not seeing that error
message, then please provide more detail. (It's helpful to include the full
detail, rather than just the number.)

Assuming that is the error you're getting... MBSA uses the Office Update
Inventory Tool to detect Office updates and that error indicates that the
tool didn't finish. As far as MBSA is concerned, the tool is pretty much a
black box and MBSA simply takes the results and embeds them in the report.
You can try running the tool directly and see what happens. Most likely it
will still fail, but there might be some more detail why. The following
steps duplicate what mbsa does:

cd C:\Program Files\Microsoft Baseline Security Analyzer
mkdir officeresults
officeupd\inventory.exe /s officeupd\cifs /o officeresults
officeupd\convert.exe /d officeresults /o officeresults.xml /xml
officeupd\patchdata.xml

If you can confirm that it fails even when run directly, then this will
provide the information you need to ask the Office team about the problem.
If it succeeds when you run it manually and only fails when run by MBSA for
you, then let us know. Hope this helps.

--- Bruce Leban [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

"Christophe" <gehin.ch...@free.fr> wrote in message
news:a4028788.04052...@posting.google.com...

[Christophe]

Thanks for replying Bruce

when I ran inventory, I get error 30010 in the log file

I will post a message on office newsgroup

Thanks again

"Bruce Leban [MSFT]" <bruc...@online.microsoft.com> wrote in message news:<uxwlZKsP...@tk2msftngp13.phx.gbl>...

[Earl F. Parrish]

"Peter Bauer" <peter_b...@hotmail.com> wrote in message

news:opr767um...@news.austria.eu.net...

If you recently uninstalled a Symantec program, its Event Manager
caused the Workstation Service to lose a dependent service. If you
remove Client for Microsoft Networks from the NIC and reinstall it,
the problem may be solved.

--
Earl F. Parrish