Microsoft Baseline Security Analyzer

Microsoft Baseline Security Analyzer (MBSA) is a Microsoft tool that allows you to analyze your computers security. Accessible either from a graphical or command line interface, this program is capable of not only analyzing your computer but also a range of IP addresses or an entire Active Directory domain.

This program will allow you to analyze operating systems from Windows 2000 onwards, such as 2003 and XP as well as office products, Exchange server etc. The complete list of compatible programs is available on this page.

Main windows of MBSA

Once you have installed MBSA, it will be accessible from the desktop or from the programs folder on the start menu.

The program will start and you will be offered a range of options:

• Analyze a computer

This can either be your computer or another that is located on the network or in the same domain.

Analyze a computer

• Analyze numerous computers

This option allows you to analyze numerous computers at the same time by specifying a range of IP addresses or the computer names in the Active Directory domain. It is not possible to analyze multiple domains at the same time.

• Choose the security report to view

When each analysis has been completed a security report will be generated on the computer that has MSBA installed. In the event that you analyze multiple computers all the reports will be located on the same computer.

Extract of an analysis report

To access the program from the command line, go to the folder where the MBSA files have been installed (by default “C:\Program Files\Microsoft Baseline Security Analyzer 2”) and type “mbsacli.exe”. The program will start and will analyze the local computer with the report being shown on the command line.

To analyse a remote IP address from the command line you can use the /target command followed by the IP address of the remote computer. If it is a range of IP addresses that you want to analyse then you will need to use the /r command followed by the “first IP address – last IP address” (e.g. “mbsacli.exe /r 192.168.0.1-192.168.0.50”).

Of course to perform an analysis you will need to have administration rights both on your local machine and any remote machines that you want to analyse.

Download MBSA (WGA necessary).