How to Use

ManualsBrandsHP ManualsMobile Thin ClientsHP 4320t Mobile Thin Client

Using Microsoft

Baseline Security

Analyzer 2.2 and Windows

Update

For HP Thin Clients running Microsoft Windows Embedded Standard 7

Table of contents

Microsoft Baseline Security Analyzer 2.2 ................................................................................................ 2

Preface ........................................................................................................................................... 2

Introduction ..................................................................................................................................... 2

Installation on WES 7 ....................................................................................................................... 3

Scanning Options ............................................................................................................................ 6

Features .......................................................................................................................................... 7

Using Microsoft Baseline Security Analyzer 2.2 ................................................................................... 7

Localizations ................................................................................................................................. 17

Issues ............................................................................................................................................ 17

Using Windows Update on WES 7 ...................................................................................................... 17

Introduction ................................................................................................................................... 17

Audience ...................................................................................................................................... 17

Overview ...................................................................................................................................... 17

RAM Drive Considerations .............................................................................................................. 18

Good News about WES 7 Quick Fix Engineering (QFE) Releases ........................................................ 18

Disk Space Concerns ...................................................................................................................... 18

HP Windows Update Perspective ..................................................................................................... 19

How to Enable Windows Update ..................................................................................................... 20

Summary of content (21 pages)

PAGE 1
Using Microsoft® Baseline Security Analyzer 2.2 and Windows® Update For HP Thin Clients running Microsoft Windows Embedded Standard 7 Table of contents Microsoft Baseline Security Analyzer 2.2 ................................................................................................ 2 Preface ........................................................................................................................................... 2 Introduction ........................................................
PAGE 2
Microsoft Baseline Security Analyzer 2.2 Preface The scope of this document is focused on how customers can identify the most current Microsoft Quick Fix Engineering (QFE) releases and Security Updates that are applicable to their Golden Master image and is not concerned with the process of downloading and deploying these items.
PAGE 3
Installation on WES 7 The MBSA graphical user interface (GUI) is a simple and seamless installation process for WES 7 that only takes approximately 2 Mb of disk space. Windows Update must be enabled first, go to Control Panel and open Windows Update: 1. Click Change Settings.
PAGE 4
2. Under Important Updates, choose Never check for updates..., then click OK. Windows Update is now active: 3. Install MBSA 2.2. Note The Microsoft Baseline Security Analyzer 2.2 is available from the Microsoft website: http://www.microsoft.com.
PAGE 5
PAGE 6
Scanning Options Key Options for Thin Clients: Check for Security Updates Select this option to check the target computer for missing Microsoft Windows updates.
PAGE 7
Features Enhanced Reporting: • Current Update Compliance appears in the report; installed and needed updates are reported together in a single scan report. • Maximum bulletin severity and update package download links are now available in report details. • Access to the live Microsoft Update site for published content for live (online) security update assessment, as well as an off line catalog for customers with limited or secure internet access are provided.
PAGE 8
2. Select options and click Start Scan. MBSA downloads the current Security Update Database and scans the target system.
PAGE 9
After scanning is complete, the report is immediately generated. 3. In the Security Update Scan Results, select the top Security Update listed (MS1 0-046).
PAGE 10
The Microsoft webpage for the Security Update (MS1 0-046) appears. 4. Scroll down and select the applicable operating system. For WES 7, it is Windows 7 for 32-bit Systems.
PAGE 11
You can then download the Security Update in .msu or .exe format for later use. Using MBSA Command-line with WES 7 Having completed the process for installing the MBSA GUI, the Command-line utility can also be used to scan a target system or systems for security updates, generating a report in .mbsa (rich format report viewable in MBSA), .xml or .txt format as needed to then be used on Microsoft Security Bulletin Search website: http://www.microsoft.com/technet/security/current.
PAGE 12
PAGE 13
Using MBSA in OFF-line Mode with WES 7 MBSA uses files that it downloads from the Internet, but the computer I want to use to scan my network doesn't have Internet access. How can I use MBSA in an offline and secure environment? You can either perform the scan using the mbsacli command-line utility with the /nd (do not download) parameter, or you can perform the scan using the GUI. Before scanning you must copy the necessary files to the computer performing the scan.
PAGE 14
• Windows Update Agent standalone installers (if not already installed) The latest versions are available by examining the contents of the wuredist.cab file at http://update.microsoft.com/redist/wuredist.cab. After downloading the files from the Microsoft website, copy all files listed above to the following folder on the computer performing the security update scan: C :\Documents and Settings\\Local Settings\Application Data\Microsoft\MBSA\2.
PAGE 15
And the resulting report sent to C:\Temp: MBSACLI Switches: • MBSACLI [/target | /r | /d domain] [/n option] [/o file] [/qp] [/qe] [/qr] [/qt] [/listfile file] [/xmlout] [/wa | /wi] [/catalog file] [/nvc] [/ia] [/mu] [/nd] [/rd directory] [/?] • MBSACLI [/l] [/ls] [/lr file] [/ld file] [/unicode] [/nvc] [/?] Description: This is a command line interface for Microsoft Baseline Security Analyzer Parameter List: /target domain\computer Scan named computer. /target IP Scan named IP address.
PAGE 16
/qt Do not display the report by default following a single-computer scan. /qe Do not display error list. /qr Do not display report list. /q Do not display any of the preceding items. /unicode Output Unicode. /u username Scan using the specified username. /p password Scan using the specified password. /catalog filename Specify the data source that contains the available security update information. /ia Update the prerequisite Windows Update Agent components during a scan.
PAGE 17
Localizations MBSA releases are available for German, Japanese, and French. The WSUSSCN2.CAB file is localized to all supported languages and is automatically downloaded and used by the tool for any client language or locale being scanned. Results are stored in the report based on the MBSA installation language. Issues Problems discovered during the scoping of this project: • Microsoft is not supporting the Nobackup feature for WES 7 Security Updates.
PAGE 18
This presents a serious challenge for HP thin client users that wish to take advantage of Windows Update support for QFE servicing. Microsoft provides no native solution or workaround for this situation, which leaves it up to the users to implement an end-to-end solution. RAM Drive Considerations A possible blocking issue for HP thin client users is the RAM Drive. Implemented as a performance enhancement, HP redirects the TEMP, TMP, and Temporary Internet Files environment variables to the Z:\ RAM Drive.
PAGE 19
HP Windows Update Perspective HP officially discourages customers from using Windows Update because of the known limitations with the Microsoft implementation. The client pull servicing schema that Windows Update offers is not consistent with the way thin clients are typically serviced industry wide. A server push schema is the more deterministic and successful way to manage thin clients in the enterprise environment.
PAGE 20
How to Enable Windows Update The following section explains how to enable Windows Update on HP WES 7 images. Two OS policies need to be disabled before Windows Update website will recognize and communicate with the client system. One policy is a global system policy in HKEY Local Machine and the other is user profile-specific that needs to be disabled on each user profile on the system: HKEY Local Machine HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Win dowsUpdate 1.
PAGE 21
Share with colleagues © Copyright 2011 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.