Using the Microsoft Baseline Security Analyzer (MBSA)

To download MBSA from the SecureU SharePoint site, complete the following steps.

1. Click the Download Now button on the Run Security Scans page for Windows.
2. You may see a File Download – Security Warning window. If this window displays, click Run to download MBSA. It is safe to run or save this file.
3. You may see an Internet Explorer – Security Warning window. If this window displays, click Run to install MBSA. It is safe to run this file.
4. The MBS Setup window displays. Click Next.
5. Select the button next to I accept the license agreement and click Next.
6. Select a destination for the installation and click Next.
7. Click the Install button to start the installation.
8. A window will display when the installation has been successfully completed. Click OK.

1. On the Programs menu, click Microsoft Baseline Security Analyzer.
2.  Click Scan a computer.
3. Leave all options set to default and click Start Scan.
4. MBSA will download the list of latest security catalogue from Microsoft and begin the scan. Once the scan is complete, the scan results are shown in an organized report with several sections. Each section may require you to take different actions in order to remediate any problems that have been detected. On the left you will see a column labeled Score. Scan this list for any Red Xs. A red X represents an item that needs to be fixed.
5. Note: Most computers will have results for Security Updates, Windows, and Desktop Applications. If you are running Windows Server, contact the Technology Help Desk for more information about these services.​​​​​​

MBSA generates a report file in the profile directory of the logged in user (%userprofile%). This report file is stored on the computer from which you ran the MBSA tool. MBSA displays different icons in the report score columns depending upon whether a vulnerability was found on the scanned machine.
For the administrative vulnerability checks, a red X is used when a critical check failed (for example, a user has a blank password).

A yellow ! is used when a non-critical check failed (for example, an account has a password that does not expire).

A green checkmark is used when a check passes (that is, no issue was found for that particular check).

A blue asterisk is used for best practice checks (for example, checking if auditing is enabled).

A blue informational icon is used for checks that simply provide information about the computer being scanned (for example, the operating system version of the scanned computer).

For the security update checks, a red ! is used when a security update is missing or a security check could not be performed from the scanned computer.

A yellow X is used for warning messages (for example, the computer does not have the latest service pack or update rollup).

A blue star is used for informational messages indicating that an update is not available to the computer because it has not been approved on the Update Services server. Scores cannot be changed or reassigned for system configuration checks.

The MBSA scan summary is organized into sections. It also contains links that provide more detailed information, such as What was scanned, Result Details, and How to Correct this. The more often you run the scan, the less often you will be prompted to fix something.

Security Update Checks

The Security Updates section determines which available service packs and security updates for predetermined MS products match the state of your computer. If it has been a while since you last updated your computer, this will most likely be marked with a red X. Running updates on your computer will fix these problems.

Windows Checks

The Windows and Desktop Applications check determines if your current configuration leaves your computer vulnerable to easy attacks. Potential problems include weak passwords, Automatic Updates that are not turned on, Firewalls that are not turned on, or applications that need to be updated. If any of these items are marked with a red X, then a How to correct this link will display. Click this link to open a page with instructions for correcting the problem.

Additional System Information

The MBSA also provides additional information about the system that was scanned in a separate section.

1. For each vulnerability, MBSA provides additional details about the scan via the What was scanned link, the Result details link, and the How to correct this link.
2. The screen shot below displays the window that appears after you click on the Result details link. The Result details window contains details about the vulnerability (in this case, weak passwords).
3. The screen shot below displays the window that appears after you click on the How to correct this link. The How to correct this window displays the recommended solution with step-by-step instructions.
4. Once you have reviewed the report and corrected all the vulnerabilities, rerun MBSA to check that there are no more additional vulnerabilities that exist on your system.