MBSA doesn't scan 2003 Server to Vista Business 64-bit

Currently, we are trying to scan all the workstations on a network using Microsoft Baseline Security Analyzer 2.1.  All the Vista Business 64-bit and SP1 machines are giving the error incomplete scan.  They can use the MBSA and scan themselves as local machines but anything through the network doesn't work.  I tried disabling Windows Defender, Windows Firewall, and Symantec Endpoint Protection.  I also logged in as a local user and tried to get access to it and had no luck.  Does anybody have any idea's on why this is occurring?
LVL 1
LightningTechAsked:
Who is Participating?
 
LightningTechConnect With a Mentor Author Commented:
Okay, so I looked into it and found the problem.

"Requirements for a Computer to Be Scanned Remotely
The computer must be running Microsoft Windows Server" 2008, Windows Vista, Windows Server" 2003, Windows XP, or Windows 2000 Service Pack 3 or later. Itanium-based computers must be running Windows Server 2003 with SP1 or higher.
Internet Explorer 5.01 or later is required for IE zone checks.
IIS 5.0, 6.0 is required for IIS product and administrative vulnerability checks.
Microsoft SQL Server 7.0 or 2000 or Microsoft Data Engine or Microsoft SQL Server 2000 Desktop Engine (MSDE) is required for SQL product and administrative vulnerability checks.
Windows Update Agent 3.0 is required to scan for updates.
Microsoft Office 2000, Office XP or Office System 2003 is required for Office product and administrative vulnerability checks.
Windows Installer 3.0 or later is required for Office product updates checks.
The following must be enabled:
Server service
Remote Registry service
File and Print Sharing
Distributed COM (DCOM) is required for remote security update scanning.
To run MBSA, you must be logged on with an account that has local administrative privileges on each computer being scanned either locally or remotely."

The "Remote Registry service" was not started on any of the machines.  I started it and was able to scan and everything even without checking, "Configure computers for Microsoft Update and scanning prerequisites".

Thank you kchat for all of your help.  You helped me pinpoint the problem so thank you.  Take care!
0
 
kchatCommented:
Give some more info regarding the machine (OS and version) and the account you use to scan the remote machines. Also, is it a domain or workgroup?
0
 
LightningTechAuthor Commented:
OS: Windows Server 2003 Standard SP2
CPU: Xeon CPU 3.2GHz
RAM: 3GB
In a Domain
Account used to scan: DOMAIN\administrator (It doesn't scan with the logged in account?)
0
Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

 
kchatCommented:
Under the report details in MBSA there is a section that describes what was incomplete,  can you give us the Score, Issue and Result, in order to get the picture?
0
 
LightningTechAuthor Commented:
Here is a screen shot of the page that comes up after I run a MBSA. Just says unable to scan

Thank You,
MBSA.bmp
0
 
kchatCommented:
Microsoft quotes (http://technet.microsoft.com/en-us/security/cc184923.aspx) that:
By customer request, the automatic distribution of the latest Windows Update Agent (WUA) client to client computers scanned by MBSA has been disabled in MBSA 2.1. This may prevent MBSA from successfully scanning computers that do not have the latest WUA client installed. Administrators and security auditors will want to select the option to "Configure computers for Microsoft Update and scanning prerequisites" in order to improve security scan success.
0
 
LightningTechAuthor Commented:
Alright, so I downloaded WUA 3.0 and installed it on one of the Vista machines to test it out.  Immediately after the install I was able to scan the Vista machine via MBSA with that, "Configure computers for Microsoft Update and scanning prerequisites" checked.  But, after that I tried to scan the whole network with the "Configure computers for Microsoft Update and scanning prerequisites" checked and it failed all of them including the one that succeeded previously.  Finally, I scanned that one single machine that passed and now it isn't scanning again with the same problem as before.  One step forward, One step back.
0
 
kchatCommented:
Do you have a WSUS in place?
0
 
LightningTechAuthor Commented:
I do have one installed on the server but it isn't currently configured all the way. (Workstations are not set to go to the server for updates)
0
 
kchatCommented:
No pro bro, thank you too for the solution ...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.