Nelson Araujo's WebLog : Microsoft Baseline Security Analyzer (MBSA)

Determining missing updates from command-line output

Nelson Araujo — Tue, 16 Aug 2005 08:30:00 GMT

Here is a quick tip on how to quickly script MBSA 2.0 to filter and show only the missing updates. But before start using it, note that using a script to parse the <UpdateData> nodes is a far better idea because of the richness of the information it is there. Refer to other posts in my blog for samples on how to achieve that (for example, this one). Now the quick filter:

mbsacli /n password+os+iis+sql | findstr "|| Missing ||"

By using the /n switch, you will be disabling all other checks but security update compliance, so be careful when using such option. Also notice that the word "Missing" is localized (it changes depending on the language of MBSA you installed). The example above only works for English MBSA 2.0 installations. You need to update the term to other languages as appropriate.

Converting a MBSA 2.0 report into text format (updates check)

Nelson Araujo — Fri, 29 Jul 2005 23:36:00 GMT

Before you start relying on this sample, I'd like to say that: If you still uses MBSA 1.2.1 and this script would help you keep your automation, I strongly encourage you to upgrade your scripts to support MBSA 2.0. MBSA 2.0 provides more data, in a more structured and organized format, making the parsing easier, more precise and more robust. Now let's get to the sample...

Usage: cscript /nologo mbsa2lr.vbs <your-report-file>

Example: cscript /nologo mbsa2lr.vbs "%USERPROFILE%\SecurityScans\REDMOND - NELSONA (7-25-2005 2-53 PM).mbsa"

File: MBSA2LR.XSL - Rules to convert the report

<?xml version="1.0"?>

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:variable name="CR" select="'
'"/>
<xsl:variable name="TAB" select="' | '"/>
<xsl:template match="/">
Machine Name<xsl:value-of select="$TAB"/>Product<xsl:value-of select="$TAB"/>Bulletin<xsl:value-of select="$TAB"/>Q Number<xsl:value-of select="$TAB"/>Reason<xsl:value-of select="$TAB"/>Status
<xsl:apply-templates select="//UpdateData"/>
</xsl:template>
<xsl:template match="UpdateData">
<xsl:value-of select="../../../@DisplayName"/>
<xsl:value-of select="$TAB"/>
<xsl:value-of select="../../@GroupName"/>
<xsl:value-of select="$TAB"/>
<xsl:value-of select="@BulletinID"/>
<xsl:value-of select="$TAB"/>
<xsl:value-of select="@KBID"/>
<xsl:value-of select="$TAB"/>
<xsl:text>N/A</xsl:text>
<xsl:value-of select="$TAB"/>
<xsl:if test="@IsInstalled = 'true'"><xsl:text>Installed</xsl:text> </xsl:if>
<xsl:if test="@IsInstalled = 'false'"><xsl:text>Missing</xsl:text></xsl:if>
<xsl:value-of select="$CR"/>
</xsl:template>
</xsl:stylesheet>

File: MBSA2LR.VBS - XSL rules processor

'------------------------------------------------------------------------------
'
' mbsa2text.vbs - Converts the missing updates into text-delimited format
' Requires: MBSA 2.0
' Author: Nelson Araujo
' Download: http://blogs.msdn.com/nelson_araujo/archive/2005/07/29/mbsa_automation_sample2.aspx
'
' Copyright (C) 2005 Microsoft Corporation. All rights reserved.
'
' Microsoft provides programming examples for illustration only, without
' warranty either expressed or implied, including, but not limited to, the
' implied warranties of merchantability or fitness for a particular purpose.
' This example assumes that you are familiar with the programming language
' that is being demonstrated and the tools that are used to create and debug
' procedures. Microsoft support professionals can help explain the
' functionality of a particular procedure, but they will not modify these
' examples to provide added functionality or construct procedures to meet your
' specific requirements. If you have limited programming experience, you may
' want to contact a Microsoft Certified Partner or the Microsoft fee-based
' consulting line at 1-800-936-5200. For more information about Microsoft
' Certified Partners, see the following Microsoft Web site:
'
' http://directory.microsoft.com/resourcedirectory/Solutions.aspx
'
' For additional information about the support options available from
' Microsoft, visit the following Microsoft Web site:
'
' http://support.microsoft.com/default.aspx?scid=fh;[LN];CNTACTMS
'
'------------------------------------------------------------------------------

Option Explicit

Dim xml
Dim xsl
Dim output

Set xsl = CreateObject("MSXML2.DOMDocument")
Set xml = CreateObject("MSXML2.DOMDocument")

If Not xsl.load("mbsa2lr.xsl") Then
   WScript.Echo "Cannot load XSL file"
   WScript.Quit(2)
End If

If Not xml.load(WScript.Arguments(0)) Then
   WScript.Echo "Cannot load MBSA report file"
   WScript.Quit(3)
End If

' Process the report
WScript.Echo xml.transformNode(xsl)

Sample output:

<?xml version="1.0" encoding="UTF-16"?>
Machine Name | Product | Bulletin | Q Number | Reason | Status
REDMOND\NELSONA | Office | | 842774 | N/A | Installed
REDMOND\NELSONA | Office | | 842532 | N/A | Installed
REDMOND\NELSONA | Office | | 840663 | N/A | Installed
REDMOND\NELSONA | Office | MS05-023 | 887979 | N/A | Installed
REDMOND\NELSONA | Windows | | 867460 | N/A | Installed
REDMOND\NELSONA | Windows | MS04-043 | 873339 | N/A | Installed
REDMOND\NELSONA | Windows | MS04-041 | 885836 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-001 | 890175 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-004 | 886903 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-007 | 888302 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-009 | 887472 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-013 | 891781 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-015 | 888113 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-012 | 873333 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-016 | 893086 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-018 | 890859 | N/A | Installed
REDMOND\NELSONA | Windows | MS04-044 | 885835 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-011 | 885250 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-026 | 896358 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-032 | 890046 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-027 | 896422 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-033 | 896428 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-025 | 883939 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-019 | 893066 | N/A | Installed
REDMOND\NELSONA | Windows | | 890830 | N/A | Installed
REDMOND\NELSONA | Windows | MS05-037 | 903235 | N/A | Installed
REDMOND\NELSONA | Windows | | 890830 | N/A | Missing
REDMOND\NELSONA | Windows | MS05-036 | 901214 | N/A | Installed

Determining if a patch/update is installed with MBSA 2.0

Nelson Araujo — Thu, 28 Jul 2005 23:44:00 GMT

In the 2.0 version of MBSA there are structured information about patches and updates. To verify if a patch is missing or installed, simple XML queries can be issued for that purpose. The 2 small programs below accomplish that task. You can use them as a start for your integration scripts and/or to get an idea where to start.

Usage: CheckIsInstalled <REPORT-FILE> <PATCH-TO-SEARCH>

Example: CheckIsInstalled "%USERPROFILE%\SecurityScans\REDMOND - NELSONA (7-25-2005 2-53 PM).mbsa" MS05-001

CheckIsInstalled.cmd - Command script to verify if a patch is missing

@echo off
REM
REM CheckIsInstalled.cmd - Verifies if a patch is missing on the system
REM Requires: MBSA 2.0
REM Author: Nelson Araujo
REM Download: http://blogs.msdn.com/nelson_araujo/archive/2005/07/28/mbsa_automation_sample1.aspx
REM
REM Copyright (C) 2005 Microsoft Corporation. All rights reserved.
REM
REM Microsoft provides programming examples for illustration only, without
REM warranty either expressed or implied, including, but not limited to, the
REM implied warranties of merchantability or fitness for a particular purpose.
REM This example assumes that you are familiar with the programming language
REM that is being demonstrated and the tools that are used to create and debug
REM procedures. Microsoft support professionals can help explain the
REM functionality of a particular procedure, but they will not modify these
REM examples to provide added functionality or construct procedures to meet your
REM specific requirements. If you have limited programming experience, you may
REM want to contact a Microsoft Certified Partner or the Microsoft fee-based
REM consulting line at 1-800-936-5200. For more information about Microsoft
REM Certified Partners, see the following Microsoft Web site:
REM
REM http://directory.microsoft.com/resourcedirectory/Solutions.aspx
REM
REM For additional information about the support options available from
REM Microsoft, visit the following Microsoft Web site:
REM
REM http://support.microsoft.com/default.aspx?scid=fh;[LN];CNTACTMS
REM
REM ------------------------------------------------------------------------------
REM
REM Usage: CheckIsInstalled "%USERPROFILE%\SecurityScans\MyReportFile.mbsa" PATCH
REM MyReportFile = modify to represent your MBSA report name
REM PATCH = modify to represent the patch you want to find, e.g. MS05-023
REM
REM ------------------------------------------------------------------------------

echo Checking for update...

cscript IsPatchMissing.vbs %1 %2
if errorlevel 3 goto reportfail
if errorlevel 2 goto updatenotfound
if errorlevel 1 goto not_installed
if errorlevel 0 goto installed
goto EOF

:reportfail
echo ERROR: Cannot load report from %1
goto EOF

:updatenotfound
echo ERROR: Cannot find information for %2
goto EOF

:not_installed
echo WARNING: Update %2 is NOT installed
goto EOF

:installed
echo OK: Update %2 is installed
goto EOF

:EOF

IsPatchMissing.vbs - Helper VB Script to verify the presence of a specific patch/update by ID

'------------------------------------------------------------------------------
'
' IsPatchMissing.vbs - Verifies if a patch is missing on the system
' Requires: MBSA 2.0
' Author: Nelson Araujo
' Download: http://blogs.msdn.com/nelson_araujo/archive/2005/07/28/mbsa_automation_sample1.aspx
'
' Copyright (C) 2005 Microsoft Corporation. All rights reserved.
'
' Microsoft provides programming examples for illustration only, without
' warranty either expressed or implied, including, but not limited to, the
' implied warranties of merchantability or fitness for a particular purpose.
' This example assumes that you are familiar with the programming language
' that is being demonstrated and the tools that are used to create and debug
' procedures. Microsoft support professionals can help explain the
' functionality of a particular procedure, but they will not modify these
' examples to provide added functionality or construct procedures to meet your
' specific requirements. If you have limited programming experience, you may
' want to contact a Microsoft Certified Partner or the Microsoft fee-based
' consulting line at 1-800-936-5200. For more information about Microsoft
' Certified Partners, see the following Microsoft Web site:
'
' http://directory.microsoft.com/resourcedirectory/Solutions.aspx
'
' For additional information about the support options available from
' Microsoft, visit the following Microsoft Web site:
'
' http://support.microsoft.com/default.aspx?scid=fh;[LN];CNTACTMS
'
'------------------------------------------------------------------------------

Option Explicit

Dim xml
Dim update
Dim isInstalled
Dim report
Dim updID

report = WScript.Arguments(0)
updID = WScript.Arguments(1)

Set xml = CreateObject("MSXML2.DOMDocument")

xml.Load report

If Len(xml.xml) = 0 Then
   WScript.Echo "Cannot load MBSA XML report: " & report
   WScript.Quit(3)
End If

' Searches for the patch ID
Set update = xml.SelectSingleNode("//UpdateData[@ID='" & updID & "']")
If update Is Nothing Then
   WScript.Echo "Update information not found"
   WScript.Quit(2)
End If

' Verifies if patch is installed
Set isInstalled = update.SelectSingleNode("@IsInstalled")
If isInstalled Is Nothing Then
   WScript.Echo "Update information corrupted or missing"
   WScript.Quit(2)
End If

If isInstalled.Value = "true" Then
   WScript.Echo "Update " & updID & " is installed"
   WScript.Quit(0)
Else
   WScript.Echo "Update " & updID & " is NOT installed"
   WScript.Quit(1)
End If

Microsoft Baseline Security Analyzer 2.0 (MBSA 2.0) shipped

Nelson Araujo — Tue, 05 Jul 2005 07:10:00 GMT

I'd like to let you all know that Microsoft Baseline Security Analyzer 2.0 (aka MBSA 2.0) has shipped. To get the new application, also available in other languages, please visit the product download page at http://www.microsoft.com/mbsa. The download is free and it is very simple to use.

Visio Connector for MBSA available

Nelson Araujo — Fri, 06 May 2005 02:16:00 GMT

This add-on to Visio is very cool. It integrates Visio and MBSA. With this tool you can: (1) perform scans directly from Visio and (2) view the results of the output directly on your network topology chart.

http://www.microsoft.com/technet/security/tools/mbsavisio.mspx

It is pretty simple to use and the instructions are clear. If you have trouble using it, add a comment to this blog and I'll try help you out.

Thanks to Michael Howard to remembering me to post this ;-) (http://blogs.msdn.com/michael_howard/archive/2005/05/05/415046.aspx)

SPPT (System Protection Products Team) is hiring

Nelson Araujo — Thu, 14 Apr 2005 03:22:00 GMT

Job opportunities on the System Protection Team (Security)....(read more)