Running in an Isolated Environment

It is possible to run MBSACLI in an isolated environment that doesn't have access to the Internet. For example, you may be running Windows 7 in a VPC machine used for testing, or you may have an entire network that is completely isolated from the Internet for security reasons. When running MBSACLI in an isolated environment, you'll need to take a couple of extra steps:

• Download an up-to-date version of the wsusscn2.cab file from
  http://go.microsoft.com/fwlink/?linkid=76054.
• Download an up-to-date version of the wuredist.cab file from
  go.microsoft.com/fwlink/?LinkId=84399.
• Copy the wuredist.cab file to the %systemroot%\Users\username\AppData\Local\
  Microsoft\MBSA\2.1.1\Cache folder.

If the wuredist.cab file is not copied to the appropriate folder, MBSACLI will return the following error: The catalog file (Wuredist.Cab) is damaged or an invalid catalog. Once these steps are taken, you can then run MBSACLI with the /catalog switch to point to the location of the file. It's also common to include the /nvc, /nd, and /ia switches. Assuming the wsusscn2.cab file is located in the c:\mbsa folder, you could use the following commands. The first command changes the directory to where MBSACLI is located, and the second runs it with the appropriate switches for an isolated environment.

CD "C:\Program files\Microsoft Baseline Security Analyzer 2\mbsacli"
Mbsacli /catalog C:\mbsa\wsusscn2.cab /ia /nvc /nd