Microsoft Baseline Security Analyzer

Some useful pointers (the pre-requisites which the newer OS may have disabled by default for higher security configuration):

MBSA and the Windows Update Agent require Windows 2000 Service Pack 3 or later. The version check performed by MBSA uses the system registry, so if a remote computer being scanned has the Remote Registry Service disabled, this error will appear. To correct this, ensure the Remote Registry Service is running on the target computer.

Windows Server 2003 Service Pack 1 provides an added level of security that prevents multiple connections to the same remote computer from using alternate credentials when the scanning computer is joined to a domain. When scanning a remote target computer and you want to use different credentials than your logged-in credentials, use the following command instead of the mbsacli /u and /p (user name and password) command-line options to specify the account to be used in the remote connection:

C:\> runas /netonly /user:<domain\username> "cmd.exe" (followed by one or more MBSA commands after the new command prompt window opens).

Or

C:\> runas /netonly /user:<domain\username> "C:\Program Files\Microsoft Baseline Security Analyzer 2\mbsacli.exe <add any MBSA command-line options here>"


@ http://technet.microsoft.com/en-us/security/cc184922#EIHAE

I also understand that MBSA does not run on Windows XP Embedded and Windows IA64 platforms, but remote scans against these platforms are fully supported. Hope it is not the hardaware platform causing this issue.


==========More info ====================
What are the services and ports required to run MBSA?

The required services are listed in the MBSA Help file (linked to in the left-hand pane of MBSA user interface). These requirements include Remote Registry service, Server service, Workstation service, File and Printer Sharing service, and Automatic Updates service. The wsusscn2.cab file is downloaded from the Microsoft Web site over HTTP based on your Internet Explorer settings. Remote computer scans are performed by using TCP ports 135, 139, and 445. Where a firewall or filtering router separates two networks, TCP ports 135, 139, and 445, and UDP ports 137 and 138 must be open in order for MBSA to connect and authenticate to the remote computer being scanned.

MBSA cannot scan a remote computer protected by a firewall unless the firewall is configured to open the ports that MBSA uses to communicate with the computer. The Windows Update Agent implements a remote scanning interface based on DCOM. The account being used to scan must possess local administrator rights. The computer must also be configured to meet the following conditions:

    The Server service, Remote Registry service, and File and Print Sharing service must be running on the remote computer.
    The required ports must be open on the firewall.
    The Windows Update Agent must be installed and the Automatic Updates service must not be disabled.

Remote computer scans are performed using TCP port 135, a dynamic or static DCOM port, and ports 139 and 445. Where a firewall or filtering router separates two networks, TCP ports 135, 139, and 445, and UDP ports 137 and 138 must be open in order for MBSA to connect and authenticate to the remote computer being scanned. You must allow these ports to be open on the remote firewall if a personal firewall is being used.