Lesson 4: Using Microsoft Baseline Security Analyzer

Microsoft Baseline Security Analyzer (MBSA) is one more way that you can protect a computer. MBSA scans computers for common security lapses and then generates individual security reports for each computer it scans. You can use these reports to determine what steps you should take to further secure the computer or computers on the network.

After this lesson, you will be able to

• Download MBSA.

• Use MBSA to scan a system for vulnerabilities.

Estimated lesson time: 15 minutes

Downloading MBSA

You can run MBSA on computers running Microsoft Windows 2000 and Windows XP, as well as Microsoft Windows Server 2003. MBSA can scan the local computer or remote computers. If you are scanning a remote computer, you can use MBSA to scan for security problems on computers running Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003.

You must download the MBSA tool before you can use it; it does not come with any computer operating system. You can find MBSA version 1.2 in the Tools folder on the CD that is included with this book; the filename is MBSASetup-en.msi. Install it by double-clicking the file and following the prompts in the setup wizard. After you install MBSA, you can use it to check for security vulnerabilities by following these steps:

1. Click Start, point to All Programs, and select Microsoft Baseline Security Analyzer 1.2.

2. When prompted by MBSA, select Scan A Computer or Scan More Than One Computer.

3. Select the computer or computers to scan, and set the options for scanning. Options include the following:

   • Windows Vulnerabilities

   • Weak Passwords

   • IIS Vulnerabilities

   • SQL Vulnerabilities

   • Security Updates

4. Click Start Scan.

5. Wait while the computer is scanned, and then view the report. Part of a sample report is shown in Figure 10-10.

   
   Figure 10-10: The MBSA report lists security lapses and vulnerabilities.

In this example, some of the Internet Explorer zones do not have secure settings, one Microsoft product has an issue with macro security, and multiple administrators exist. These are all security vulnerabilities that can be easily corrected. Notice that for each security issue listed, options are given for resolution. To resolve any issue, select the How To Correct This link shown next to the issue description.

Practice: Install and Run MBSA

In this practice, you will install and configure MBSA. This practice requires that you install the MBSASetup-en.msi file that is in the Tools folder on the CD that comes with this book.

Exercise 1: Install MBSA

1. Log on to Windows XP using an account with administrator privileges.

2. Locate the MBSASetup-en.msi file in the Tools folder on the CD that comes with the book. Double-click the file to start the installation.

3. In the Microsoft Baseline Security Analyzer Setup Wizard, on the Welcome To The Microsoft Baseline Security Analyzer Wizard page, click Next.

4. On the License Agreement page, select I Accept The License Agreement and click Next.

5. On the Destination Folder page, click Next to accept the default installation location and proceed.

6. On the Start Installation page, click Install.

7. The Installation Progress page displays the installation progress.

8. On the MBSA Setup page, click OK.

Exercise 2: Run MBSA

1. From the Start menu, point to All Programs and select Microsoft Baseline Security Analyzer 1.2.

2. In the Microsoft Baseline Security Analyzer Wizard, click Scan A Computer.

3. Ensure that the computer selected is the local computer, and then click Start Scan.

4. The Scanning page appears and indicates progress.

5. On the Pick A Security Report To Review page, in the Computer Name column, select the name of your computer.

6. On the View Security Report screen, take a moment to browse the results.

Lesson Review

The following question is intended to reinforce key information presented in this lesson. If you are unable to answer the question, review the lesson materials and try the question again. You can find answers to the question in the “Questions and Answers” section at the end of this chapter.

1. List the types of vulnerabilities for which MBSA can scan.

Lesson Summary

• MBSA runs on Windows 2000, Windows XP, and Windows Server 2003. You can scan remote systems running any of those operating systems, as well as Windows NT 4.0.

• MBSA scans for several types of vulnerabilities, including missing updates, weak passwords, and insecure operating system configurations.