Announcement

Collapse
No announcement yet.

MBSA causes huge number of events

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • MBSA causes huge number of events

    Hi all

    I am very new to this forum, so excuse me if I am posting incorrect.

    My current problem is following: I ran MBSA on around 450 clients to check the patch status. The check went for about two hours (1pm-3pm) and terminated successfully for most clients. However, thereafter the nightmare started: users complained about very slow network and tons of login events (200+) on their machines with my username (I assume this happened cos I was running MBSA under my username). Additionally the scan stopped around 3pm, but on certain machines it shows that I was login in till 6pm!?!?!?!?!?!?!

    Can somebody please explain me why this was happening?! I was google-ing around but couldn't find any fix.

    Cheers

    RS

  • #2
    Re: MBSA causes huge number of events

    chances are you selected the password test... its not listed as one of the Windows vulnerability tests, and you have to select it separately from the other tests.

    if you have user stations where people hop around and there are a few profiles already on that box, then the test takes forever to complete.

    also, the auto-logon test stores a password and username to use for the purpose of this test. did you choose to encrypt the password stored? if not, windows will bitch and flags it as a sever security risk... encryted pwords will be flagged as a potential vulnerability... it seems like there is no way to run that test without a complaint from Windows...

    thats the two that i can think of that would be slowing down your org, but it could be other things also. the client stations could be slow, the network could be slow, maybe half the computers were installing updates while the request from the MBSA came in... do you run a gig LAN or is it a mixed 10/100-10/100/1000?

    ive only used the MBSA a few times and i was not impressed. i have found third party software to do the same thing, but with far less impact on my org, like LANdesk and GFI products.

    good luck,
    James
    its easier to beg forgiveness than ask permission.
    Give karma where karma is due...

    Comment


    • #3
      Re: MBSA causes huge number of events

      Thanks James. That is exactly what happened. I had the password check on and on every box we have several profiles.

      Your post really helps. Appreciate it mate

      Cheers

      RS

      Comment


      • #4
        Re: MBSA causes huge number of events

        hey, glad i could help.
        its easier to beg forgiveness than ask permission.
        Give karma where karma is due...

        Comment

        Working...
        X