Windows 7 / Getting Started

---

MBSACLI

Scanning a large network should be done on a regular basis to find computers that have not been properly updated. However, scanning a large network is a time-consuming process. Although the MBSA console is the most efficient way to scan a network interactively, the MBSACLI command-line tool provides a way to script an analysis. By using scripts, you can schedule scanning to occur automatically, without your intervention. This way, you can have MBSACLI generate a report that you can refer to on demand.

As with the MBSA graphical console, you need administrative access to use MBSACLI to scan a computer. In a domain environment, simply log on to your computer using an account that has sufficient privileges. Otherwise, you can provide credentials at the command line by using the /u and /p parameters. However, you should avoid typing credentials in a script because the script can be compromised, allowing an attacker to gain privileges on remote computers.

Table lists the parameters available in MBSACLI's MBSA mode.

MBSA Mode Parameters in MBSACLI

/target domain\computername | ipaddress	Scans the host with the specified computer name or IP address.
/r ipaddress1-ipaddress2	Specifies an IP address range to be scanned, beginning with ipaddress1 and ending with ipaddress2, inclusive.
/listfile filename	Scans hosts specified in a text file.
/d domain_name	Scans all computers in a specified domain. Of course, your computer must be able to identify those computers. It uses the same mechanism as Network Neighborhood, so if you can browse computers in Network Neighborhood, this switch will work.
/u username /p password	Scans using the specified user name and password.
/n scans	Skips specific scans. You can choose OS, SQL, IIS, Updates, and Password. If you want to suppress multiple scans, separate them with a + sign. For example, to scan only for updates, use the command Mbsacli /n OS+SQL+IIS+Password.
/wa	Show only updates approved on the WSUS server.
/wi	Show all updates, even if they haven't been approved on the WSUS server.
/catalog filename	Specifies the MBSA detection catalog, Wsusscan.cab. You can download this file from http://go.microsoft.com/fwlink/?LinkId=39043.
/qp, /qe, /qr, /qt, /q	Does not display the scan progress, error list, and report list; the report following a singlecomputer scan; or any of these items, respectively.
/l, /ls	Lists all available reports or just the reports created in the latest scan, respectively.
/lr "reportname", /ld "reportname"	Displays an overview or detailed report summary when given the filename of the report. You do not need to specify the full filename- only the name of the report. For example, the following command shows a report for Computer1: mbsacli /ld "Cohowinery.com - Computer1 (11-11-2003 07-46 AM)"
/nai, nm, nd	Prevents MBSACLI from updating the Windows Update features, configuring computers to use the Microsoft Update Web site, or downloading files from the Microsoft Web site, respectively.
/nvc	Prevents MBSACLI from checking for a new version of MBSA.
/xmlout	Provides XML-based output, which is more difficult to read as a text file but easier to parse programmatically.
/o "template"	Uses a different template for the report filename. By default, the name is %domain% - %computername% (%date%). If you put one or more spaces in the template, be sure to enclose it in quotation marks.

When scanning a single computer, MBSACLI outputs information about vulnerabilities directly to the console. To save the output to a file, redirect it using the standard > notation. For example, this command saves the report output to a file named Output.txt.

Mbsacli > output.txt

When scanning multiple computers, MBSACLI displays only the computers scanned and the overall assessment. The details of the scan are stored in an XML report that is saved in your %UserProfile%\SecurityScans\ folder. By default, the filename for each report is set to domain - computername (date).mbsa.

You can view the reports by using the graphical MBSA console, however, by simply starting MBSA and then clicking View Existing Security Reports. MBSA will show the Pick A Security Report To View page, listing all of the available reports. You can also view them from the command line by using the /ld parameter and specifying the report's filename.