How to troubleshoot catalog file downloads for Microsoft Baseline Security Analyzer 1.2

The Microsoft Baseline Security Analyzer (MBSA) 1.2 is the scan engine for the Microsoft Systems Management Server (SMS) 2003 Software Update Scanning Tools and the SMS 2.0 Software Update Services Feature Pack. However, you can also use the MBSA as a stand-alone tool.

The MBSA uses an XML-based catalog file, mssecure.xml, to determine the security updates that are available. The catalog file is compressed and is stored in the mssecure.cab file.

Microsoft updates and posts the catalog file to the Microsoft Download Center after a new security bulletin is released. In some circumstances, the updated catalog file may not be downloaded by SMS or by the MBSA.

You can use the following information to help you determine if the catalog was updated. You can also use the following information to help troubleshoot if the latest version was not downloaded. You can determine if Microsoft has released an updated catalog file by visiting the following Microsoft Web sites.

The following files are available for download from the Microsoft Download Center:

English
Download the SMS 2003 .cab file package now. (http://go.microsoft.com/fwlink/?LinkId=23190)

Download the SMS 2.0 .cab file package now. (http://go.microsoft.com/fwlink/?LinkId=23130)
Japanese
Download the SMS 2003 .cab file package now. (http://go.microsoft.com/fwlink/?LinkId=26834)


German
Download the SMS 2003 .cab file package now. (http://go.microsoft.com/fwlink/?LinkId=26836)


French
Download the SMS 2003 .cab file package now. (http://go.microsoft.com/fwlink/?LinkId=26835)


For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Note The localized versions of the .cab file for SMS 2.0 version require that the Internet Explorer locale match the language of the download. Otherwise, you may be redirected to a Microsoft Search Web page. To add a different language to Internet Explorer, follow these steps:

1. On the Tools menu in Internet Explorer, click Internet Options.
2. On the General tab, click Languages.
3. Click Add, and then click the language that you want to add.

After you download the .cab file, double-click the .cab file, double-click the .xml file, and then specify a location to extract the mssecure.xml file. Double-click the mssecure.xml file to view the version information. The catalog version information is located at the top of the mssecure.xml file. An example of the catalog version information is:If the file is current, but an older version of the catalog is still used by SMS, a cached older version of the file may have been copied from a corporate or Internet Service Provider (ISP) proxy server. We do not recommend that you cache the catalog file. However, individual proxy servers may be configured to cache the catalog file.

To determine if SMS is using a cached catalog file, use Microsoft Network Monitor or another network capture tool to view the download process. Start the trace immediately before you download the file. Stop the network trace immediately after the MSSecure.cab file is saved to the computer. You can filter the trace to show only HTTP traffic. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: You can confirm that the catalog file is cached by viewing the frames that contain the HTTP responses to the client. A sample trace may appear similar to the following example.

Note This example has been edited for brevity and contains only the relevant information from the response packet.The key indicator that this file is being cached is the "HTTP: Proxy-connection" entry. This entry points to a proxy server. The data near the bottom of the frame shows the full path of the .cab file, including its file name.

Note The URL may be different depending on the version and release date of the .cab file.

If, by viewing the network trace, you verify that the .cab file is being cached, contact your network administrator or your ISP and request that the MSSecure.cab file not be cached.

If you have another computer that is available on another network, you can try to download the .cab file from the second computer. Then, you can manually copy the .cab file to the first computer. By default, the stand-alone version of MBSA stores the catalog file in the \Program Files\Microsoft Baseline Security Analyzer folder.

The SMS 2003 Synchronization component (Syncxml.exe) downloads the latest version of MBSA and downloads the Security Update Bulletin Catalog (mssecure.xml), which contains a list of the latest hotfixes. Then the Syncxml.exe component copies the latest hotfix list on the SMS distribution points. You can use the contents of the %SystemRoot%\System32\Ccm\Logs\Securitysyncxml.log file to troubleshoot this component.

The Security Hotfix Checker scan tool (S_scan.exe) is part of the Security Update Inventory Tool in the SMS 2.0 Software Update Services Feature Pack. You can run the S_scan.exe tool on client computers to download the mssecure.xml file and scan the computer using the Hardware Inventory Agent. You can use the contents of the %SystemRoot%\System32\Ccm\Logs\Securitypatch.log file to troubleshoot this component. This log file will have a list of applicable hotfixes for a particular computer.

For more information about the Microsoft Baseline Security Analyzer, visit the following Microsoft Web site:For more information about SMS 2003 Software Update Scanning Tools, visit the following Microsoft Web site:For more information about the SMS 2.0 Software Update Services Feature Pack, visit the following Microsoft Web site: For additional information about how to use Network Monitor to capture network traffic, click the following article number to view the article in the Microsoft Knowledge Base: For additional information about how to filter cache entries in Microsoft Internet Security and Acceleration (ISA) Server, click the following article number to view the article in the Microsoft Knowledge Base: For more information about Hypertext Transfer Protocol (HTTP) 1.1, visit the following Internet Engineering Task Force Web site: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

For more information about SMS Feature Packs, visit the following Microsoft Web site:For more information about frequently asked questions about the SMS Software Update Services Feature Pack, visit the following Microsoft Web site:For more information about Software Update Services deployment, visit the following Microsoft Web site: For additional information about how to install multiple Windows updates or hotfixes with only one reboot, click the following article number to view the article in the Microsoft Knowledge Base: For more information about the SMS Feature Pack Sync Tool Teardown A to Z, visit the following Web site:For more information about SMS Feature Pack Scan Tool - Unleashed, visit the following Web site: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.