Here's the command that I'm running on Windows 2003 R2:
O:\mbsacli.exe /xmlout /catalog O:\wsusscn2.cab /unicode /nvc >O:\results\%COMPUTERNAME%_MBSA_Scan_Results.xml
O:\ is a network mapped drive (share/security all Full Control, "Automatic Updates" service is running), running it with Admin permissions in the domain. On the server latest Windows Update Agent is installed.
I'm getting the following error:
Microsoft Baseline Security Analyzer
Version 2.2 (2.2.2170.0)
(C) Copyright 2002-2010 Microsoft Corporation. All rights reserved.
Cannot load security CAB file.
- Edited by Vick Vega Wednesday, March 20, 2013 7:49 PM
It seems that I found a solution for this issue. Even when the drive is mapped with all the required permission, as much as I can tell, the scan process failing. However, if the cab file - wsusscn2.cab is copied to LOCAL disk on the system, such as %temp% it works ok.
Strangely, the scan process when it run "expands/extracts" the content of the cab file and creates 2 files: package-7352.cab and package-7352.xml. Perhaps that's unique per system, will test it more later. So, when I run the executable - mbsacli from the mapped drive but the cab file - wsusscn2.cab is located in temp, the process works and the required XML output is created to the same mapped drive (as indicated in the original post). After the report is provided, additional file needs to be cleaned up from the %temp% directory (or any directory you choose to put wsusscn2.cab at), the file name is wsusscn2.cab.dat. So, the clean up process should delete both wsusscn2.cab and wsusscn2.cab.dat
What really annoying here is that AS USUAL the lack of proper description and documentation of the scanning process which could assist in resolving the issue. The MBSA software is what, 14 years old?
I would love to hear comments from the Microsoft on this.
Thank you for wasting my time, again, figuring out issues that could be easily solved by adding simple process description to the appropriate documents.
- Marked as answer by Vick Vega Thursday, March 21, 2013 6:27 PM