MBSA2 Failed to Download Security Update Databases
geekseeker
Scanning efforts quickly lead to: "Failed to download security update
databases" followed by "The catalog file is damaged or an invalid catalog"?
FAQ
{http://www.microsoft.com/technet/security/tools/mbsa2/qa.mspx#EAAAA}suggests:
"These errors may also appear if Internet Explorer is running with the
offline setting, which will prevent MBSA from being able to download the
catalog file."
BUT ... what and where is the offline setting?
What else might I do to correct this problem?
Thanks.
Nelson Araujo [MSFT], CISSP, MCAD
the catalog is http://go.microsoft.com/fwlink?linkid=39043. If you are able
to download it from the computer you are getting the error, can you put it
into C:\Document and Settings\<youruser>\Local Settings\Application
Data\Microsoft\MBSA\2.0\Cache and try to scan again?
If you can inspect the contents of that same folder (making a copy maybe)
for us to look at later it would be great!
Thanks,
--
Regards,
Nelson Araujo, CISSP, MCAD
Software Development Engineer
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"geekseeker" <geeks...@discussions.microsoft.com> wrote in message
news:8E26BB12-25ED-4345...@microsoft.com...
Rob Wickham [msft]
"Work offline" item in the list.
--
Rob Wickham [msft]
This posting is provided "as is" with no warranties, and confers no rights.
"geekseeker" <geeks...@discussions.microsoft.com> wrote in message
news:8E26BB12-25ED-4345...@microsoft.com...
geekseeker
package 3,857 KB Cabinet File
wsusscan 2,797 KB Cabimet File
wsusscan.cab 1 KB DAT File
Contents of the wsusscan.cab file is:
<Document><A L="-110091670" H="29721394"/><B L="177095830" H="29721395"/><C
L="2863784" H="0"/><D V=""/><E V="2005-07-02T00:35:38Z"/><F
V="5.8.0.2469"/></Document>
Current status: When launching MBSA2, I continue to get the failure to
download the updated databases BUT the computer is successfully scanned. The
"Configure computers for Microsoft Update and scanning prerequisites" is
checked. The security report from the scan states" "Error installing the
Microsoft Update Subscriber on the target computer. (0x00000002)."
PS The "offline setting" under the file menu is unselected...no check mark.
Nelson Araujo [MSFT], CISSP, MCAD
reach the internet to get the Windows Update Agent (error 2 = file not
found). Can you please try to access this FWLink, and if you can download
would you put the file in the Cache folder and try to scan again?
http://go.microsoft.com/fwlink?linkid=43264
Can you also check if your system administrator allows downloads of .EXE
files? This is a common blocking on firewalls and that might be impacting on
the agent download, which is an executable.
And please let me know how it goes.
--
Regards,
Nelson Araujo, CISSP, MCAD
Software Development Engineer
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"geekseeker" <geeks...@discussions.microsoft.com> wrote in message
news:A4F24764-1D08-48C4...@microsoft.com...
geekseeker
and reran scan ... no changes. Then attemped to launch
WindowsUpdateAgent20-x86, and install proceeded to the point where I received
this message:"Install is not needed since Windows Update Agent is already
installed."
I compared my problematic destop computer Cache folder with the same one on
my laptop (which downloads updates and scans with no problems) and noticed
that a file named "muauth" (File cabinet icon) and another named
"muauth.cab" (with a DAT file icon) are present in my laptop Cache folder and
both are missing from the desktop Cache folder. Perhaps I should copy them
over into the desktop Cache folder? What do you thinK?
Thanks
Nelson Araujo [MSFT], CISSP, MCAD
can be on the proxy settings on the computer that is not working. All the
files that are on the Cache folder should be automatically
downloaded/created by MBSA. For some reason MBSA is not being able to
download them on your desktop computer. By putting them manually there works
(it is equivalent to our DMZ scenario, and you can run with /nd switch to
disable all internet download for MBSA).
But this will not reveal the problem on the computer and those files might
be out-of-date later. It will be your responsibility to keep them
up-to-date, which will increase the burden on you. I'd suggest you let this
task to MBSA, which will make life much easier. We have just to check why
MBSA cannot reach the internet/downloads from your desktop.
Can you work with your network administrator and check the firewall logs
and/or network monitoring to see what's going on your desktop? He could also
compare what traffic your desktop is generating to the internet against your
laptop that is working
Hope this helps. Let me know if I can help you more.
--
Regards,
Nelson Araujo, CISSP, MCAD
Software Development Engineer
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"geekseeker" <geeks...@discussions.microsoft.com> wrote in message
news:E21C9F81-D7BC-406A...@microsoft.com...
geekseeker
for all.
The bad news .... I am THE administrator of my home network. Perhaps you
might point me to which logs in particular might be revealing. I am familiar
with the Event Viewer logs but they provide nothing of interest. Thanks for
sticking with me on this!
Chris
I've been following the discourse between geekseeker and yourself with the
hopes that it could help me resolve the same problem I am having. I
followed all the steps you suggested to geekseeker, and I was able to ran a
scan on my laptop, BUT I am still getting the same message "Failed to
Download Security Update Databases".
You suggested checking the firewall settings, but even when I turned of the
Windows Firewall I still can't download the security database. The only
firwall left is the firewall on my DSL router and I don't want to take the
chance disabling that since it will leave me too exposed.
Is there anything else you suggest I do ? Your other suggestios have been
quite helpful, since atleast now I could manually download the files and
complete a scan, but this "manual" process is too time consuming and I agree
with you that MBSA should be allowed to perform this task automaically.
Thanks in advance,
"geekseeker" <geeks...@discussions.microsoft.com> wrote in message
news:231FD44B-8057-47A0...@microsoft.com...
geekseeker
Thanks Chris for joining in this discussion ... I too followed the same
steps you described with no success, i.e., turned off firewall (ZoneAlarm
Pro); ensured security setting in IE were all defaut setting; and reran
Windows Update which does seem to download the database with no problems.
The MBSA failure to download remains a mystery.
Chris ...I would also be interested to know if you are experiencing the same
issue with MBSA2 regarding an anomalous administrator that looks something
like S-1-5-21-3779935395-2437969446-162025716-1003? This wierd
administrator only shows up in the MBSA scan ...and not in the user accounts
within the Control Panel. There has never been but two user accounts on this
system... me and the normally expected Administrator account. Perhaps that
has something to do with the download failure although I doubt it. I posted
this as a separate issue and may be it should remain that way ...just
couldn't resist asking you about it.
Nelson ... thanks for all your help and look forward to the next suggestion.
Geekseeker (aka Bob)
Cliff Morrison
Here's another scenario for you...
I don't have Internet access with MBSA because I'm behind a
password-protected proxy server. We also don't have an Update Services
server.
I read the MBSA 2.0 FAQ entry "MBSA uses files that it downloads from the
Internet, but the computer I want to use to scan my network doesn't have
Internet access. How can I use MBSA in this case?"
It says to download Wsusscan.cab, Muauth.cab, and
WindowsUpdateAgent20-x86.exe into the cache directory, then use the command
line utility mbsacli with the /nd option. I did that and it works.
I also figured out the GUI also works for me if I use the /nd /wi options to
prevent downloading of any files and to indicate that Update Services servers
are not available.
Thanks,
Cliff Morrison
Chris
no I didn't encounter a "mystery" admin account when using MBSA2. It could
be possible it was a deleted account that is still associated with the Admin
group. One way you could check the local users on your system (other than
through the User Account in the Control Panel), is by, right clicking on My
Computer --> Manage. This will bring up the Computer Management window.
From there you will see a Local Users and Groups catergory. By clicking on
users you would see user accounts you won't normally see from User Accounts
in the control panel. I hope this helps you find your mystery
administrator.
Regards,
Chris.
"geekseeker" <geeks...@discussions.microsoft.com> wrote in message
news:382E1EAC-C6C9-47DB...@microsoft.com...
geekseeker
I followed your instructions until I reached the Computer Management Window
..but there I saw nothing re Local Users and Groups? [I'm using XP Home]
I did right click on WMI control and selected properties ...from there I
went to the security tab ...select Root then clicked on the security button
to see Group or User Names for the Root ......from there I selected
Administrators and clicked on Advance and in the next window clicked on "Add"
and then Advance and then Find now ...whew ...that reveal me as an
administrator but never did find any reference to the mystery administrator.
I suspect I am over my head :(
While I would like to clear up the case of the mystery administrator, I hope
I am not taking us off track with respect to the main issue, i.e., failure to
download updates...
Perhaps Nelson will return to save the day.
Regards,
Bob
Torgeir Bakken (MVP)
> Thanks Chris ...
> I followed your instructions until I reached the Computer Management Window
> ..but there I saw nothing re Local Users and Groups? [I'm using XP Home]
>
Hi,
The "Local Users and Groups" entry doesn't exist on WinXP Home.
See if this gives you any information:
Click [Start] [Run] and type
control userpasswords2
Click [OK]
--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx
geekseeker
administrators, "Guest" as Guests and "ASPNET" as Users. I was susrprized to
see ASPNET, but it is listed as Users not Administrator and I also see ASPNET
on my laptop as well. Recall only the desktop scan shows the mystery
administrator identified by MBSA2 as
S-1-5-21-3779935395-2437969446-162025716-1003. So the two unresolved issues
remain unresolved: (1) why the failure to download updates and (2) why the
mystery administrator? I could add a third ...why does ASPNET show up as
"users" but that is really not a MBSA2 related issue. Thanks again Torgeir,
and Chris and Nelson.
Dario Betancourt
I have the same problem but... I tried to download with WXP Pro Sp2, WXP
Home, W2K. I have a proxy server without autenthication and when I tried to
download manually the WsusScan.cab i receive an error page on internet (THE
PAGE CANNOT BE DISPLAYED)
But about the automatically download from MBSA may anybody know if there is
necessary any specific port to executed this task?
Regards
Dario Betancourt
TroubleShooter
http://download.windowsupdate.com/microsoftupdate/v6/wsusscan/wsusscan.cab.
The file at go.microsoft.com/fwlink/?LinkId =39043 did not work. I placed the
file in c:\documents and Settings\<youruser>\Local Settings\Application
Data\Microsoft\MBSA\2.0\Cache. I also unchecked the box that says 'Configure
computers for Microsoft Update and Scanning Prerequisites'. I still get the
message 'Failed to download Security Updates', but it runs fine.
Dario Betancourt
http://download.windowsupdate.com/microsoftupdate/v6/wsusscan/wsusscan.cab.
.. Someone may send me the file by email til resolve the problem....
Anybody knows somethings about ports in firewall for MBSA maybe?
Dario
geekseeker
wsusscan 2,797 KB Cabinet File and the wsusscan.cab 1 KB DAT File
BUT ... I am still hoping that we can find and fix the problem with failing
to auto downloading the updates. This seems to be a commonly experienced
issue based on the number of folks joining this thread.
Dario Betancourt
geekseeker
or coworker could download it and send it to yo? I can appreciate the
frustration.
ShaneP
I am an administrator to 30+ customers, Basline v1.2.1 works, v2.0 get the
same complaint as the other guys.
I am attempting to run v2 on both SBS2000 and SBS2003 servers - same
complaint. Swap back to v1.2.1 and this works sweet.
Suggestions?
Khan@discussions.microsoft.com Hasan Khan
I have the same problem.. MBSA 2.0 does not download the cab and I end up
with the error. When I download it manually it works. As per the firewall
issue, I am directly connected to the internet and there are no firewalls. I
am running Windows XP with SP2 on my laptop and the windows firewall is also
disabled. like ShaneP MBSA 1.x works fine for me. The only thing I can think
of is the fact that I had installed the Beta MBSA 2.0 on the same machine. I
had the same problem with the beta version but I was not able to to report it
because for reasons that I have failed to guess the MBSA 2.0 Beta newsgroup
did not accept posting to it.
I have also installed MBSA 2.0 on Windows 2003 Server machines with SP1 and
I have faced the same problem which kind of rules out the Beta installation
as a possible cause. Unfortunately I don't have a MBSA 2.0 installation that
works so I can not do any comparison.
I would appreciate any help. Thanks
Nelson Araujo [MSFT], CISSP, MCAD
networking setting is not correct on your system/network. Unfortunately I
cannot help you to diagnose that problem without live intervention. Maybe
you can get some network expert to take a look at your environment to figure
out the cause.
From MBSA point-of-view, you don't need any special port or system enabled.
Just these: (1) internet access; (2) ability to download CAB and EXE files;
(3) ability to reach and download from links like this one:
http://go.microsoft.com/fwlink?linkid=39043.
Hope this helps,
--
Regards,
Nelson Araujo, CISSP, MCAD
Software Development Engineer
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"Dario Betancourt" <DarioBe...@discussions.microsoft.com> wrote in
message news:3F0B9D9D-ED8F-44A2...@microsoft.com...
Nelson Araujo [MSFT], CISSP, MCAD
simply ignoring the flags. The default behavior in the GUI is to ignore the
download errors and fallback to the existing files, if they exist. If they
do not exist and MBSA cannot download, only then the scan fails.
--
Regards,
Nelson Araujo, CISSP, MCAD
Software Development Engineer
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"Cliff Morrison" <CliffM...@discussions.microsoft.com> wrote in message
news:665450BE-8477-4EDB...@microsoft.com...
JasonH
2 PCs total. The Win2k PC and another running XP Home Edition with SP2.
Both PCs are connected via a network to a DSL router. Both have the same
network configurations, and neither have firewalls enabled. The MBSA on the
XP machine works perfectly. The Win2k machine always gets the "failed to
download security update database" message. I am able to do the manual
download and get the scan to work, like most people here are. My question
is, why the difference between the 2 machines? Any suggestions on what I can
check on the Win2K machine? It's really odd to have one work and another
not, when the only real difference is one is XP and the other is Win2k.
Nelson Araujo [MSFT], CISSP, MCAD
We saw that happen on Win2K systems when they were missing the MS04-011
patch. Can you take a quick look and make sure you have such patch
installed? The link is this:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
Please let me know if that did not solve the issue.
--
Regards,
Nelson Araujo, CISSP, MCAD
Software Development Engineer
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"JasonH" <Jas...@discussions.microsoft.com> wrote in message
news:6CCD17B5-F43F-485B...@microsoft.com...
JasonH
reinstalling it, but I still have the problem.
@discussions.microsoft.com Chuck
Two customers I have are experiencing this problem. One is on an XP-SP3
system and another vista. Solutions provided to this point have not been
successful. Please provide other options.
Doug Neal [MSFT]
and the three likely causes are the presence of a proxy server between the
client and the internet that's preventing the target client from accessing
the needed catalog files from Microsoft.com (this can be resolved by making
a direct connection to the web - not through a proxy, or open Internet
Explorer and choose FILE | WORK OFFLINE to un-check the 'work offline'
selection if its checked).
You also may need to update the Windows Update Agent on the target machines.
This is the most likely cause and can be resolved by either installing the
latest WUA client as indicated in the FAQ or selecting the option in MBSA to
'Configure computers for Microsoft Update and scanning prerequisites' which
will allow MBSA to push and install an update WUA client on each target
machine.
If you're completely offline (meaning, you have no connectivity to the
internet), you can resolve this from another item in the FAQ titled, “MBSA
uses files that it downloads from the Internet, but the computer I want to
use to scan my network doesn't have Internet access. How can I use MBSA in
an offline and secure environment?”
You can either perform the scan using the mbsacli command-line utility with
the /nd (do not download) parameter, or you can perform the scan using the
GUI. Before scanning you must copy the necessary files to the computer
performing the scan. Four types of files are required:
• Security update catalog (wsusscn2.cab), available from the Microsoft Web
site
• Windows Update Redistribution Catalog (wuredist.cab) located at
http://update.microsoft.com/redist/wuredist.cab
• Authorization catalog (muauth.cab) for Windows Update site access,
available from the Microsoft Web site or by examining the contents of the
wuredist.cab file located at http://update.microsoft.com/redist/wuredist.cab
• Windows Update Agent standalone installers (if not already installed):
• For x86-based computers (WindowsUpdateAgent30-x86.exe) or
• For x64-based computers (WindowsUpdateAgent30-x64.exe) or
• For ia64-based computers (WindowsUpdateAgent30-ia64.exe), the latest
versions are available by examining the contents of the wuredist.cab file
located at http://update.microsoft.com/redist/wuredist.cab
After downloading the files from the Microsoft Web site, copy all files
listed above to the following folder on the computer performing the security
update scan:
C:\Documents and Settings\<username>\Local Settings\Application
Data\Microsoft\MBSA\2.1\Cache
I hope that helps.
--
--
Doug Neal [MSFT]
du...@online.microsoft.com
This posting is provided "AS IS" with no warranties, and confers no rights.
If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for support on the Microsoft
Baseline Security Analyzer (MBSA). Information is available at the following
link:
http://support.microsoft.com/default.aspx
This e-mail address does not receive e-mail, but is used for newsgroup
postings only.
"Chuck" <Chuck @discussions.microsoft.com> wrote in message
news:2E6C2FC3-7CD3-4531...@microsoft.com...
raml...@gmail.com
> Thank you for posting this, Chuck. You're in the right place in the FAQ -
> and the three likely causes are the presence of a proxy server between the
> client and the internet that's preventing the target client from accessing
> the needed catalog files from Microsoft.com (this can be resolved by making
> a direct connection to the web - not through a proxy, or open Internet
> Explorer and choose FILE | WORK OFFLINE to un-check the 'work offline'
> selection if its checked).
>
> You also may need to update the Windows Update Agent on the target machines.
> This is the most likely cause and can be resolved by either installing the
> latest WUA client as indicated in the FAQ or selecting the option in MBSA to
> 'Configure computers for Microsoft Update and scanning prerequisites' which
> will allow MBSA to push and install an update WUA client on each target
> machine.
>
> If you're completely offline (meaning, you have no connectivity to the
> internet), you can resolve this from another item in the FAQ titled, "MBSA
> uses files that it downloads from the Internet, but the computer I want to
> use to scan my network doesn't have Internet access. How can I use MBSA in
> an offline and secure environment?"
>
> You can either perform the scan using the mbsacli command-line utility with
> the /nd (do not download) parameter, or you can perform the scan using the
> GUI. Before scanning you must copy the necessary files to the computer
> performing the scan. Four types of files are required:
>
> site
> * Windows Update Redistribution Catalog (wuredist.cab) located at
> http://update.microsoft.com/redist/wuredist.cab
> * Authorization catalog (muauth.cab) for Windows Update site access,
> wuredist.cab file located at http://update.microsoft.com/redist/wuredist.cab
> * For x86-based computers (WindowsUpdateAgent30-x86.exe) or
> * For x64-based computers (WindowsUpdateAgent30-x64.exe) or
> * For ia64-based computers (WindowsUpdateAgent30-ia64.exe), the latest
Could you please confirm the path where to place offline files for this scan on win 2012 server as C:\Document and Setting\<username>\ folder is not on win 2012 server.