This article describes how to obtain this tool. This article also provides an operational overview of the tool. This overview includes system requirements and command-line parameters. Finally, this article describes the most common problems that you may encounter when you use the tool.

Back to the top

How to obtain the BitLocker Drive Preparation Tool

Windows Vista Ultimate

If you are using Windows Vista Ultimate, follow these steps to obtain the tool:

1.	Click Start, type Windows Update in the Start Search box, and then press ENTER.
2.	Click Check for updates.
3.	Click View available Extras.
4.	Click to select the BitLocker and EFS enhancements check box, and then click Install.

Windows Vista Enterprise

If you are using Windows Vista Enterprise, use the following services to obtain this tool:

•

Microsoft Customer Support Services For a complete list of Microsoft Customer Support Services telephone numbers, visit the following Microsoft Web site:For more information, visit the following Microsoft Web page: http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)

Back to the top

After the tool finishes preparing the drive, you must restart the computer. Then, you can use the Security item in Control Panel to enable BitLocker.

Back to the top

How to prepare the hard disk for BitLocker Drive Encryption

To encrypt drives and to verify boot integrity, BitLocker requires at least two partitions. These two partitions make up a split-load configuration. A split-load configuration separates the main operating system partition from the active system partition from which the computer starts.

The BitLocker Drive Preparation Tool automates the following processes to make the computer ready for BitLocker:

•	Creating the second volume that BitLocker requires
•	Migrating the boot files to the new volume
•	Making the volume an active volume

When the tool finishes, you must restart the computer to change the system volume to the newly created volume. After you restart the computer, the drive will be configured correctly for BitLocker. You may also have to initialize the Trusted Platform Module (TPM) before you turn BitLocker on.

Back to the top

System requirements

To create a new partition or to merge unallocated space with an existing partition, the target system must meet the following requirements:

•	A genuine version of Windows Vista Ultimate or Windows Vista Enterprise must be installed.
•	The active partition must contain boot configuration data and boot files.
•	The target partition must meet the following requirements: • The partition must be on a simple disk that is initialized for basic storage. • The partition must be a primary partition. Extended drives and logical drives are not supported. • The partition must be formatted by using the NTFS file system. • The partition must not be compressed. • The cluster size of the partition must be less than 4 KB or equal to 4 KB. • The partition is not using software spanning, software mirroring, or software RAID. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 314343 (/Feedback.aspx?kbNumber=314343/) Basic storage versus dynamic storage in Windows XP Note This tool works correctly in hardware RAID configurations. • For a split operation, at least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). • For a merge operation, the partition’s total capacity must be at least 1.5 GB. Also, the partition must have at least 800 MB of free disk space.

The following chart shows the target system requirements.

Back to the top

Operational overview

Target system configurations

The BitLocker Drive Preparation Tool supports Windows Vista Ultimate and Windows Vista Ultimate Enterprise. This tool successfully creates a split-load configuration when the active state, the system state and the boot state are all assigned to the same simple volume.

Default operational procedure

When the BitLocker Drive Preparation Tool starts, it tries to create a split-load configuration by using the following methods, in order of preference:

•	Merge unallocated space with a type 0×7 Windows Recovery (WinRE) partition
•	Create a new partition from unallocated space
•	Split an existing partition Note The tool tries to split the current active partition. If this action fails, the tool splits the largest available partition.
•	Merge unallocated space with the smallest suitable partition

Preferred order of operations

The following chart shows the preferred order of operations that the BitLocker Drive Preparation Tool follows.

Back to the top

Command-line parameters

The BitLocker Drive Preparation Tool uses a simple set of command-line parameters. These parameters make integration with enterprise deployment tools more flexible. Enterprise deployment tools include Microsoft Systems Management Server (SMS) and Microsoft Business Desktop Deployment (BDD). The parameters also provide customized deployment options. The following table lists the parameters. The parameters are not case-sensitive.

Parameter	Description	Notes
[-?] [/?]	Help – Provides a brief description of the tool’s purpose and parameters
[-driveinfo]	Displays the drive letter, the total size, the maximum free space, and the partition characteristics	Only valid partitions are listed. Characteristics are noted only for WinRE, operating system, and unallocated partitions.
[-target {unallocated ¦ drive: {shrink ¦ merge}}]	Indicates the desired operation for target partition: create a new partition from unallocated disk space, split the target partition to create a new partition, or merge unallocated space with the target partition	Cannot merge unallocated spaced with the operating system partition. Unallocated space is not listed if four primary or extended partitions already exist.
[-newdriveletter] ¦ DriveLetter:]	Indicates the drive letter for the newly created partition	Letters A, B, and C are excluded. If no letter is indicated, the first available drive letter backward from S is applied.
[-size ¦ SizeInMegabytes]	Indicates the size in megabytes for the new partition	The minimum size is 1500 MB. At least 10 percent of the target partition must be free after the new partition is created.
[-quiet]	Suppresses confirmation text to avoid user interaction
[-restart]	Restarts the system immediately after all operations are complete	Restarts immediately, regardless of open files or other users logged in.

Example scenario 1

The target system has a single partition. To prepare the computer for BitLocker, you want to split the operating system partition. You want the following conditions to be true:

•	The size of the new partition is 1500 MB.
•	The new partition uses X for the drive letter.
•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Example scenario 2

The target system has more than one partition. To prepare the computer for BitLocker, you want to merge unallocated space with an existing partition. You want the following conditions to be true:

•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Back to the top

A common problem

You may receive the following error message when you use the BitLocker Drive Preparation Tool:

This error may occur in one of the following scenarios.

Scenario 1: You do not have sufficient free disk space

At least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). To resolve this error, move files to another partition or delete files.

Scenario 2: The partition contains files that cannot be moved

The BitLocker Drive Preparation Tool may resize partitions to prepare a hard disk for BitLocker. Occasionally, some unmovable files may prevent the tool from defragmenting and resizing partitions. These files may include any of the following items:

•	Page files
•	Hibernation files (Hiberfil.sys)
•	The registry
•	NTFS metadata files. These files include the following files and others: • $mftmirr • $secure • $volume

This issue may occur even if the operating system is newly installed.

To work around this error, use one of the following methods:

•	Temporarily disable hibernation option and hard disk paging. Then, use the Windows Preinstallation Environment to delete the Hiberfil.sys file and the Pagefile.sys file. Restart the computer in Windows Vista. Then, run the BitLocker Drive Preparation Tool again.
•	Reinstall Windows Vista.

Back to the top

You receive an error message when you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer

When you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer that is running Windows Vista, you may receive the following error message:

To resolve this problem, follow these steps.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

1.	Click Start, type regedit in the Start Search box, and then click regedit in the Programs list.
2.	Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management
3.	Verify the data type of the PagingFiles registry entry. If the data type is REG_SZ, follow these steps: a. Note the value data for the PagingFiles registry entry. b. Back up the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management c. Right-click PagingFiles, and then click Delete. d. Click Yes when you are prompted. e. On the Edit menu, point to New, and then click Multi-String Value. f. Type PagingFiles, and then press ENTER. g. On the Edit menu, click Modify. h. In the Value data box, type the value data that you noted in step 3a, and then click OK. i. Exit Registry Editor.
4.	Restart the computer.

For more information about security for portable computers that are running Windows Vista, visit the following Lenovo Web site:

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Back to the top

This guidance contains recommendations that are based on the kinds of scenarios that may exist in various Microsoft operating system environments. This guidance includes how to use tools such as the following tools:

•	Windows Update
•	Microsoft Update
•	Office Update
•	The Microsoft Baseline Security Analyzer (MBSA)
•	Windows Server Update Services (WSUS)
•	Microsoft System Center Configuration Manager
•	Microsoft Systems Management Server (SMS)
•	The Extended Security Update Inventory Tool

This article describes the detection and deployment guidance for the security release that is dated May 13, 2008.

Back to the top

Detection and deployment

Environments that detect and deploy security updates by using Windows Update, Microsoft Update, Office Update, and Mactopia

Security updates that were released on May 13, 2008 are available through the following Web sites. Any exceptions are described in each Web site section. The products that are supported by each Web site are also listed.

NoteNot every update is available on every Web site that is listed here.

Windows Update

The products that are supported by this Web site are as follows:

•	Microsoft Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008

Microsoft Update

The products that are supported by this Web site are as follows:

•	Microsoft Internet Security and Acceleration Server 2004
•	Microsoft Internet Security and Acceleration Server 2006
•	Microsoft Exchange 2000 Server
•	Microsoft Exchange Server 2003
•	Microsoft Exchange Server 2007
•	Microsoft Office 2002
•	Microsoft Office 2003
•	The 2007 Microsoft Office system
•	Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008
•	Microsoft SQL Server 2005
•	Microsoft Forefront Client Security
•	Microsoft Visual Studio 2005

General exceptions

•	Microsoft Update does not support Office 2000 components.
•	Microsoft Update does not support any Apple Macintosh products.

Specific exceptions

•	Security update 952044 (security bulletin MS08-029) Microsoft Update supports only the Forefront Client Security and Windows Defender parts of this update. The other products that use the Malware Protection Engine update provide built-in mechanisms for automatic detection and deployment.

Office Update

The products that are supported by this Web site are as follows:

•	Office 2000
•	Office 2002
•	Office 2003
•	The 2007 Office system

General exceptions

•	Office Update does not support 2007 Office components when they are installed on computers that are running Windows Vista or Windows Server 2008. You must use Microsoft Update instead.
•	Office Update does not support any Macintosh products.

Mactopia

The products that are supported by this Web site are as follows:

•	Microsoft Office 2001 for Mac
•	Microsoft Office 2004 for Mac
•	Microsoft Office X for Mac
•	Microsoft Office 2008 for Mac

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 2.1

You can detect security updates that were released on May 13, 2008 if you use MBSA version 2.1.

Note MBSA version 2.1 is now released and fully supports security and vulnerability assessment scans on Windows Vista and Windows Server 2008.General exceptions

•	MBSA version 2.1 does not support any Office 2000 components.
•	MBSA version 2.1 does not support any Macintosh products.
•	MBSA version 1.2.1 and 2.0.1 are no longer supported.

Specific exceptions

•	Security update 952044 (security bulletin MS08-029) MBSA version 2.1 does not support the Malware Protection Engine update. The products that use the Malware Protection Engine update provide built-in mechanisms for automatic detection and deployment.

Environments that detect and deploy security updates by using Windows Server Update Services (WSUS)

You can detect and deploy security updates that were released on May 13, 2008 if you use any of the following items:

•	WSUS 2.0 Service Pack 1 (SP1)
•	WSUS 3.0
•	WSUS 3.0 Service Pack 1 (SP1)

General exceptions

•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Office 2000 components.
•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Macintosh products.
•	SUS 1.0 Service Pack 1 (SP1) is no longer supported. It will not receive security updates.

Specific exceptions

•	Security update 952044 (security bulletin MS08-029) WSUS 2.0 and WSUS 3.0 support only the Forefront Client Security and Windows Defender parts of this update. The other products that use the Malware Protection Engine update provide built-in mechanisms for automatic detection and deployment.

Environments that detect and deploy security updates by using SMS 2.0, SMS 2003, or System Center Configuration Manager 2007

You can detect and deploy all security updates that were released on May 13, 2008 if you use any of the following items:

•	Systems Management Server (SMS) 2.0 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with Inventory Tool for Microsoft Updates (ITMU)
•	System Center Configuration Manager 2007

General exceptions

•	SMS ITMU and System Center Configuration Manager do not support any Office 2000 components.
•	SMS together with the SUS Feature Pack does not support the following products: • The 2007 Office system • Windows Internet Explorer 7 • Windows Vista • Windows Server 2008 • Any x64-based versions of Windows • Any Itanium-based versions of Windows
•	The SMS SUS Feature Pack, SMS ITMU, and System Center Configuration Manager do not support any Macintosh products.

Specific exceptions

•

Security update 952044 (security bulletin MS08-029) SMS ITMU and SUS Feature Pack do not support the Malware Protection Engine update. System Center Configuration Manager 2007 supports only the Forefront Client Security and Windows Defender parts of this update. The products that use the Malware Protection Engine update provide built-in mechanisms for automatic detection and deployment.

NoteThe SMS SUS Feature Pack requires the Extended Security Update Inventory Tool to detect all the security updates.

To obtain the Extended Security Update Inventory Tool, visit the following Microsoft Web site:

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

NoteTo simplify this table, items that were listed under the general exceptions heading for each detection and deployment technology are not included.

For example, the Microsoft Update column in this table may include a Yes. However, the security bulletin lists an Office 2000 component as affected. Previously, we would have stated in the table that Microsoft Update partly supported deployment of the security update. However, no Office 2000 components are supported by Microsoft Update. Therefore, we no longer account for that product in the table because it is always listed as a general exception.

Security update	Bulletin	Component	Office Update	Windows Update	Microsoft Update	MBSA 2.1	WSUS 2.0 and WSUS 3.0	SMS SUS Feature Pack	SMS Inventory Tool for Microsoft Updates	System Center Configuration Manager 2007
			Detect and deploy	Detect and deploy	Detect and deploy	Detect only	Detect and deploy	Detect and deploy	Detect and deploy	Detect and deploy
951207	MS08-026	Word	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
951208	MS08-027	Publisher	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
950749	MS08-028	Jet	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes	Yes
952044	MS08-029	Malware Protection Engine	Not applicable	Not applicable	Yes	No	Partly, see the WSUS section	No	No	Yes

Rereleased security updates

There are no rereleases this month.

Back to the top

Frequently asked questions

What is Microsoft doing to provide guidance about how to deploy these updates?

We encourage system administrators to join the monthly technical Webcast to learn more about security updates. The Webcast for this security update airs on May 14, 2008 at 11:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

What other information should I know about MBSA?

For more information about the programs that MBSA currently supports, visit the following Microsoft TechNet Web page:

Can I use SMS or System Center Configuration Manager to determine whether the updates are required?

Yes. SMS helps detect and deploy these security updates. SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with SUSFP use MBSA version 1.2.1 technology for detection. Therefore, SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack have limitations that resemble the limitations of MBSA version 1.2.1.

For more information about SMS, visit the following Microsoft Web site:

The SUS Feature Pack together with the Extended Security Update Inventory Tool is required to detect all the security updates on Microsoft Windows and on other affected Microsoft products.

For more information about the limitations of the SUS Feature Pack, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use ITMU to detect and to deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Microsoft Web site:

System Center Configuration Manager 2007 uses WSUS 3.0 for detection and deployment of these security updates. Therefore, anything that is supported by WSUS 3.0 is also supported by System Center Configuration Manager 2007.

Back to the top

Back to the top

Back to the top

Detection and deployment

Environments that detect and that deploy security updates by using Windows Update, Microsoft Update, and Office Update

Security updates that were released on June 12, 2007 are available through the following Web sites. Any exceptions are in the following list. The products that are supported by each Web site are also listed.

•	Microsoft Windows Update http://update.microsoft.com/windowsupdate (http://update.microsoft.com/windowsupdate) • Windows 2000, Windows XP, and Windows Server 2003
•	Microsoft Update http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate) • Windows 2000, Windows XP, and Windows Server 2003 • Microsoft Office XP and Office 2003 • Microsoft Exchange 2000 Server and Exchange Server 2003 • Microsoft Internet Security and Acceleration Server 2004 • Microsoft SQL Server 2005
•	Office Update http://officeupdate.microsoft.com (http://officeupdate.microsoft.com) • Office 2000, Office XP, and Office 2003
•	Mactopia http://www.microsoft.com/mac (http://www.microsoft.com/mac/) • Office 2001 for Mac • Office X for Mac • Office 2004 for Mac

Note Not every update is available on every Web site that is listed.

Environments that detect security updates by using MBSA version 1.2.1 or MBSA version 2.0.1

Microsoft Baseline Security Analyzer (MBSA) version 1.2.1 contains an integrated version of the Office Detection Tool (ODT). If you use MBSA 1.2.1 or MBSA version 2.0.1 to detect security updates, you can detect all the security updates that were released on June 12, 2007. Any exceptions are in the following list.

Note The ODT part of MBSA 1.2.1 is limited to local scans only.

Note MBSA 1.2.1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

Note MBSA 2.0.1 is not supported on Windows Vista. However, MBSA 2.0.1 supports remote scans of computers that are running Windows Vista. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that detect and that deploy security updates by using Software Update Services (SUS) or Windows Server Update Services (WSUS)

If you use SUS, WSUS 2.0, or WSUS 3.0 to detect and to deploy security updates, you can detect most security updates that were released on June 12, 2007. Any exceptions are in the following list.

Note SUS 1.0 SP1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

•	Security update 927051 (security bulletin MS07-030) SUS does not support any part of this security update.
•	Security update 931213 (security bulletin MS07-032) SUS does not support any part of this security update.

Environments that detect and that deploy security updates by using SMS 2.0 together with the Security Update Inventory Tool (SUIT) or SMS 2003 together with the Inventory Tool for Microsoft Updates (ITMU)

If you use Microsoft Systems Management Server (SMS) 2.0 together with SUIT, SMS 2003 together with SUIT, or SMS 2003 together with ITMU to detect and to deploy security updates, you can detect and deploy all security updates that were released on June 12, 2007. Any exceptions are in the following list.

Note SMS together with SUIT does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

•	Security update 931213 (security bulletin MS07-032) SMS SUIT does not support any part of this security update.
•	Security update 929123 (security bulletin MS07-034) SMS SUIT supports this update when you use the Extended Security Update Inventory Tool (ESUIT).

To obtain ESUIT, visit the following Microsoft Web site:

Back to the top

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

Security update

Bulletin

Component

Office Update

Windows Update

Microsoft Update

MBSA 1.2 and the Office Detection Tool

MBSA 2.0.1

SUS

WSUS 2.0 and WSUS 3.0

Enterprise Scan Tool

SMS Security Update Inventory Tool

SMS Inventory Tool for Microsoft Updates

Detect and deploy

Detect and deploy

Detect and deploy

Detect only

Detect only

Detect and deploy

Detect and deploy

Detect only

Detect and deploy

Detect and deploy

927051

MS07-030

Microsoft Visio

Yes

Not applicable

Yes

Yes

Yes

Not applicable

Yes

Not applicable

Yes

Yes

935840

MS07-031

Schannel

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

931213

MS07-032

Windows Vista

Not applicable

Yes

Yes

Not applicable

Yes

Not applicable

Yes

Not applicable

Not applicable

Yes

933566

MS07-033

Windows Internet Explorer

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

929123

MS07-034

Microsoft Outlook Express

Not applicable

Yes

Yes

No

Yes

Yes

Yes

Yes

Yes, with ESUIT

Yes

935839

MS07-035

Win32 API

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

Back to the top

Rereleased security updates

Back to the top

Frequently asked questions

Q1: What is Microsoft doing to provide guidance about how to deploy these updates?

A1: Microsoft encourages system administrators to join the monthly technical webcast to learn more about security updates. The webcast for this security update airs on June 13, 2007 at 11:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

Q2: Is the Enterprise Scan Tool (EST) cumulative for SMS like ESUIT is cumulative for SMS?

A2: No, the EST is not cumulative. There are no plans to make the EST cumulative.

Q3: Can I use MBSA to determine whether these updates are required?

A3: Yes, you can use MBSA 1.2.1 and MBSA 2.0.1 to fully detect the need for the following security updates that were released on June 12, 2007.

Microsoft Knowledge Base article number	Bulletin ID	Component	Detection note
931213	MS07-032	Windows Vista	See the MBSA section
929123	MS07-034	Outlook Express	See the MBSA section

For more information about the programs that MBSA currently does not detect, click the following article numbers to view the articles in the Microsoft Knowledge Base:

You may have installed a program that is listed in the Affected software section of a security bulletin that is mentioned in the related article. In this case, you may have to manually determine whether you must install the required security update. For more information about MBSA, visit the following Microsoft Web site:

Q4: Which security updates require that I use the EST together with MBSA 1.2.1 to determine which systems on my network are vulnerable?

A4: The following security update requires that you use the EST together with MBSA to determine which systems on the network are vulnerable.

Microsoft Knowledge Base article number	Bulletin ID	Component
929123	MS07-034	Outlook Express

Q5: Can I use SMS to determine whether the updates are required?

A5: Yes, SMS helps detect and deploy these security updates. SMS 2.0 and SMS 2003 together with SUIT use MBSA 1.2.1 technology for detection. Therefore, SMS 2.0 and SMS 2003 together with SUIT have limitations that resemble the limitations of MBSA 1.2.1. For more information about SMS, visit the following Microsoft Web site:

SUIT together with ESUIT are required for detection of all the security updates on Microsoft Windows and on other affected Microsoft products. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 and SMS 2003 together with SUIT also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word. SMS 2003 customers can also use ITMU to detect and deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Web site:

Back to the top

This guidance contains recommendations that are based on the types of scenarios that may exist in various Microsoft operating system environments. This guidance includes how to use tools such as the following tools:

•	Windows Update
•	Microsoft Update
•	Office Update
•	The Microsoft Baseline Security Analyzer (MBSA)
•	Windows Server Update Services (WSUS)
•	Microsoft System Center Configuration Manager
•	Microsoft Systems Management Server (SMS)
•	The Extended Security Update Inventory Tool

This article describes the detection and deployment guidance for the security release that is dated March 11, 2008.

Back to the top

Detection and deployment

Environments that detect and deploy security updates by using Windows Update, Microsoft Update, Office Update, and Mactopia

Security updates that were released on March 11, 2008 are available through the following Web sites. Any exceptions are described in each Web site section. The products that are supported by each Web site are also listed.

Note Not every update is available on every Web site that is listed here.

Windows Update

The products that are supported by this Web site are as follows:

•	Microsoft Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008

Microsoft Update

The products that are supported by this Web site are as follows:

•	Microsoft Internet Security and Acceleration Server 2004
•	Microsoft Internet Security and Acceleration Server 2006
•	Microsoft Exchange 2000 Server
•	Microsoft Exchange Server 2003
•	Microsoft Exchange Server 2007
•	Microsoft Office 2002
•	Microsoft Office 2003
•	The 2007 Microsoft Office system
•	Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008
•	Microsoft SQL Server 2005
•	Microsoft Forefront Client Security
•	Microsoft Visual Studio 2005

General exceptions

•	Microsoft Update does not support Office 2000 components.
•	Microsoft Update does not support any Apple Macintosh products.

Specific exceptionsMicrosoft Update does not support the part of security update 933103 that involves the following products:

•	Microsoft Visual Studio 2002
•	Microsoft Visual Studio 2003
•	Microsoft BizTalk Server 2000
•	Microsoft BizTalk Server 2002
•	Microsoft Commerce Server 2000
•	Microsoft Internet Security and Acceleration (ISA) Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Office Update

The products that are supported by this Web site are as follows:

•	Office 2000
•	Office 2002
•	Office 2003
•	The 2007 Office system

General Exceptions

•	Office Update does not support 2007 Office components when they are installed on computers that are running Windows Vista or Windows Server 2008. You must use Microsoft Update instead.
•	Office Update does not support any Macintosh products.

Mactopia

The products that are supported by this Web site are as follows:

•	Microsoft Office 2001 for Mac
•	Microsoft Office 2004 for Mac
•	Microsoft Office X for Mac
•	Microsoft Office 2008 for Mac

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 2.0.1

You can detect security updates that were released on March 11, 2008 if you use MBSA version 2.0.1.

General Exceptions

•	MBSA version 2.0.1 does not support any Office 2000 components.
•	MBSA version 2.0.1 does not support any Macintosh products.
•	MBSA version 2.0.1 is not supported on Windows Vista. However, MBSA version 2.0.1 supports remote scans of computers that are running Windows Vista. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 931943 (/Feedback.aspx?kbNumber=931943/)Microsoft Baseline Security Analyzer (MBSA) support for Windows Vista
•	MBSA version 1.2.1 is no longer supported. It will not detect security updates that were released after October 2007.

Specific exceptionsMBSA version 2.0.1 does not support the part of security update 933103 that involves the following products:

•	Visual Studio 2002
•	Visual Studio 2003
•	BizTalk Server 2000
•	BizTalk Server 2002
•	Commerce Server 2000
•	ISA Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that detect and deploy security updates by using Windows Server Update Services (WSUS)

You can detect and deploy security updates that were released on March 11, 2008 if you use any of the following items:

•	WSUS 2.0 Service Pack 1 (SP1)
•	WSUS 3.0
•	WSUS 3.0 Service Pack 1 (SP1)

General Exceptions

•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Office 2000 components.
•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Macintosh products.
•	SUS 1.0 Service Pack 1 (SP1) is no longer supported. It will not receive security updates.

Specific exceptionsWSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support the part of security update 933103 that involves the following products:

•	Visual Studio 2002
•	Visual Studio 2003
•	BizTalk Server 2000
•	BizTalk Server 2002
•	Commerce Server 2000
•	ISA Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that detect and deploy security updates by using SMS 2.0, SMS 2003, or System Center Configuration Manager 2007

You can detect and deploy all security updates that were released on March 11, 2008 if you use any of the following items:

•	Systems Management Server (SMS) 2.0 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with Inventory Tool for Microsoft Updates (ITMU)
•	System Center Configuration Manager 2007

General Exceptions

•	SMS ITMU and System Center Configuration Manager do not support any Office 2000 components.
•	SMS together with the SUS Feature Pack does not support the following products: • The 2007 Office system • Windows Internet Explorer 7 • Windows Vista • Windows Server 2008 • Any x64-based versions of Windows • Any Itanium-based versions of Windows
•	The SMS SUS Feature Pack, SMS ITMU, and System Center Configuration Manager do not support any Macintosh products.

Specific exceptionsWSUS 2.0, WSUS 3.0, and WSUS 3.0 SP1 do not support the part of security update 933103 that involves the following products:

•	Visual Studio 2002
•	Visual Studio 2003
•	BizTalk Server 2000
•	BizTalk Server 2002
•	Commerce Server 2000
•	ISA Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Note The SMS SUS Feature Pack requires the Extended Security Update Inventory Tool to detect all the security updates.

To obtain the Extended Security Update Inventory Tool, visit the following Microsoft Web site:

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

Note To simplify this table, items that were listed under the General Exceptions heading for each detection and deployment technology are not included.

For example, the Microsoft Update column in this table may include a Yes. However, the security bulletin lists an Office 2000 component as affected. Previously, we would have stated in the table that Microsoft Update partially supported deployment of the security update. However, no Office 2000 components are supported by Microsoft Update. Therefore, we no longer account for that product in the table because it is always listed as a general exception.

Security update	Bulletin	Component	Office Update	Windows Update	Microsoft Update	MBSA 2.0.1	WSUS 2.0 and WSUS 3.0	SMS SUS Feature Pack	SMS Inventory Tool for Microsoft Updates	System Center Configuration Manager 2007
			Detect and deploy	Detect and deploy	Detect and deploy	Detect only	Detect and deploy	Detect and deploy	Detect and deploy	Detect and deploy
949029	MS08-014	Microsoft Excel	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
949031	MS08-015	Microsoft Outlook	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
949030	MS08-016	Office	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
933103	MS08-017	Microsoft Office Web Components	Partially. See Office Update section.	Not applicable	Partially. See Microsoft Update section.	Partially. See MBSA section.	Partially. See WSUS section.	Yes	Partially. See SMS section.	Partially. See System Center Configuration Manager section.

Rereleased security updates

There are no rereleases this month.

Back to the top

Frequently asked questions

What is Microsoft doing to provide guidance about how to deploy these updates?

We encourage system administrators to join the monthly technical Webcast to learn more about security updates. The Webcast for this security update airs on Thursday, March 13, 2008 12:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

What other information should I know about MBSA?

For more information about the programs that MBSA currently does not detect, click the following article number to view the article in the Microsoft Knowledge Base:

If you installed a program that is listed in the Affected software section of a security bulletin, you may have to manually determine whether you must install the required security update. For more information about MBSA, visit the following Microsoft Web site:

Can I use SMS or System Center Configuration Manager to determine whether the updates are required?

Yes. SMS helps detect and deploy these security updates. SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with SUSFP use MBSA version 1.2.1 technology for detection. Therefore, SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack have limitations that resemble the limitations of MBSA version 1.2.1.

For more information about SMS, visit the following Microsoft Web site:

The SUS Feature Pack together with the Extended Security Update Inventory Tool is required to detect all the security updates on Microsoft Windows and on other affected Microsoft products.

For more informationabout the limitations of the SUS Feature Pack, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use ITMU to detect and to deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Microsoft Web site:

System Center Configuration Manager 2007 uses WSUS 3.0 for detection and deployment of these security updates. Therefore, anything that is supported by WSUS 3.0 is also supported by System Center Configuration Manager 2007.

Back to the top

Note You can delete multiple local user accounts at the same time by using Computer Management in Microsoft Windows NT Server 4.0 and in Microsoft Windows NT 4.0 Workstation.

Instead of using Computer Management, you can use the AddUsers utility together with the /e switch to delete multiple local user accounts at the same time.

For more information about the AddUsers utility, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Back to the top

Detection and deployment

Environments that detect and that deploy security updates by using Windows Update, Microsoft Update, and Office Update

Security updates that released on April 10, 2007 are available through the following Web sites. Any exceptions are in the following list. The products that are supported by each Web site are also listed.

•	Microsoft Windows Update http://update.microsoft.com/windowsupdate (http://update.microsoft.com/windowsupdate) • Windows 2000, Windows XP, Windows Server 2003 • Security update 925939 (security bulletin MS07-018) Windows Update does not support any part of this security update.
•	Microsoft Update http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate) • Windows 2000, Windows XP, and Windows Server 2003 • Microsoft Office XP and Office 2003 • Microsoft Exchange 2000 and Exchange 2003 • Internet Security and Acceleration Server 2004 • Microsoft SQL Server 2005 • Security update 925939 (security bulletin MS07-018) Microsoft Update does not support the Microsoft Content Management Server (CMS) 2001 part of this security update. The CMS 2001 part of this security update can be detected and deployed from the Office Update site.
•	Office Update http://officeupdate.microsoft.com (http://officeupdate.microsoft.com) • Office 2000, Office XP, and Office 2003
•	Mactopia http://www.microsoft.com/mac (http://www.microsoft.com/mac) • Office 2001 for Mac • Office X for Mac • Office 2004 for Mac

Note Not every update is available on every Web that is site listed.

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 1.2.1 or MBSA version 2.0.1

MBSA version 1.2.1 contains an integrated version of the Office Detection Tool (ODT). If you use MBSA 1.2.1 or MBSA version 2.0.1 to detect security updates, you can detect all the security updates that released on April 10, 2007. Any exceptions are in the following list.

Note The ODT part of MBSA 1.2.1 is limited to local scans only.

Note MBSA 1.2.1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

Note MBSA 2.0.1 is not supported on Windows Vista. However, MBSA 2.0.1 supports remote scans of computers that are running Windows Vista. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

If you use Software Update Services (SUS) or Windows Server Update Services (WSUS) to detect and to deploy security updates, you can detect most security updates that released on April 10, 2007. Any exceptions are in the following list.

Note SUS 1.0 SP1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

•	Security update 925939 (security bulletin MS07-018) SUS does not support any part of this security update. WSUS does not support the CMS 2001 part of this security update.

Environments that detect and that deploy security updates by using SMS 2.0 together with the Security Update Inventory Tool or SMS 2003 together with the Inventory Tool for Microsoft Updates

If you use Microsoft Systems Management Server (SMS) 2.0 together with the Security Update Inventory Tool (SUIT), SMS 2003 together with SUIT, or SMS 2003 together with the Inventory Tool for Microsoft Updates (ITMU), you can detect and deploy all the security updates that were released on April 10, 2007. There are no exceptions this month. Any exceptions are in the following list.

Note SMS together with SUIT does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

•	Security update 925939 (security bulletin MS07-018) SMS ITMU does not support the CMS 2001 part of this security update. The CMS 2001 part of this security update can be detected and deployed from the Office Update site.

To obtain ESUIT, visit the following Microsoft Web site:

Back to the top

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

Security update

Bulletin

Component

Office Update

Windows Update

Microsoft Update

MBSA 1.2 and the Office Detection Tool

MBSA 2.0.1

SUS

WSUS

Enterprise Scan Tool

SMS Security Update Inventory Tool

SMS Inventory Tool for Microsoft Updates

Detect and deploy

Detect and deploy

Detect and deploy

Detect only

Detect only

Detect and deploy

Detect and deploy

Detect only

Detect and deploy

Detect and deploy

925902

MS07-017

GDI

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

925939

MS07-018

CMS

Yes

Not applicable

Partially, see the MU section

Yes

Partially. See the MBSA section

Not applicable

Partially, see the WSUS section

Not applicable

Yes

Partially, see the SMS section

931261

MS07-019

PNP

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

932168

MS07-020

MS Agent

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

930178

MS07-021

CSRSS

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

931784

MS07-022

KERNEL

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

Back to the top

Rereleased security updates

There are no rereleased security updates this month.

Back to the top

Frequently asked questions

Q1: What is Microsoft doing to provide guidance about how to deploy these updates?

A1: Microsoft encourages system administrators to join the monthly technical webcast to learn more about security updates. The webcast for this security update airs on April 11, 2007 at 11:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

Q2: Is the EST cumulative like ESUIT is for SMS?

A2: No, the EST is not cumulative. There are no plans to make EST cumulative.

Q3: Can I use MBSA to determine whether these updates are required?

A3: Yes, you can use MBSA 1.2.1, MBSA 2.0, and MBSA 2.0.1 to fully detect the need for the following security updates that released on April 10, 2007.

Microsoft Knowledge Base number	Bulletin ID	Component	Detection note
925939	MS07-018	CMS	See the MBSA section

For information about the programs that the MBSA currently does not detect, click the following article numbers to view the article in the Microsoft Knowledge Base:

If you installed a program that is listed in the Affected software section of a security bulletin that is mentioned in the related article, you may have to manually determine whether you must install the required security update. For more information about the MBSA, visit the following Microsoft Web site:

Q4: Which security updates require that I use EST together with MBSA to determine which systems on my network are vulnerable?

A4: None of the security updates require that you use the EST together with MBSA to make this determination.

Q5: Can I use SMS to determine whether the updates are required?

A5: Yes, SMS helps detect and deploy these security updates. SMS 2.0 and SMS 2003 together with SUIT use MBSA 1.2.1 technology for detection. Therefore, SMS 2.0 and SMS 2003 with the SUIT have similar limitations to MBSA 1.2.1. For more information about SMS, visit the following Microsoft Web site:

SUIT together with the ESUIT are required for detection of all the security updates on Microsoft Windows and on other affected Microsoft products. For more information about the limitations of SUIT, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 and SMS 2003 together with SUIT also use the Microsoft Office Inventory Tool to detect security updates that are required for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use the Inventory Tool for Microsoft Updates to detect and deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Web site:

Back to the top

This article describes how to use the Mail Merge Manager that is included in Word 2008 for Mac to create mailing labels or envelopes.

Back to the top

Mailing labels

To use the Mail Merge Manager to create mailing labels, follow these steps:

1. On the View menu, click Print Layout.
2. On the Standard toolbar, click New.

   A new, blank Word document opens. This becomes your main document.

3. On the Tools menu, click Mail Merge Manager.
4. In the Mail Merge Manager, click Create New under Select document, and then click Labels.
5. Under Printer information, click the kind of printer that you use.
6. On the Label products pop-up menu, click the manufacturer of your labels.

   Note For more label products, click Other on the Label products pop-up menu.

7. Under Product number, click the kind of label that you want, and then click OK.

   Note For information about the margins and other characteristics of a label, click Details.

8. In the Mail Merge Manager, click Get List under Select Recipients List, and then click Open Data Source.
9. Locate and then double-click the data source file.
10. In the Edit Labels dialog box, click a field name in the list on the Insert Merge Field pop-up menu. For example, click the FirstName field.

    Word 2008 adds the field name to the Sample label box.

11. Repeat step 10 for each field that you want to appear in your labels.
12. If you want to include postal bar codes on your labels, click Insert Postal Bar Code, select the options that you want, and then click OK.

    Note To return to this dialog box later, in the Mail Merge Manager under Select Recipients List, click Add or remove placeholders on labels.

13. After you add all the fields that you want, click OK.

    The field names are copied into all the labels in your main document.

14. In your main document, edit the first label to add spaces, commas, and carriage returns where you want them.
15. In the Mail Merge Manager, under Select Recipients List, click Fill in the items to complete your document.

    Word applies the formatting that you use for the first label to all the labels.

16. To finish your labels, do one of the following:
    • To print your labels immediately, under Complete Merge in the Mail Merge Manager, click Merge to printer.
    • To create a document that contains your merged labels that you can save to print later, under Complete Merge in the Mail Merge Manager, click Merge to New Document.

Back to the top

Envelopes

To use the Mail Merge Manager to create envelopes, follow these steps:

1. On the View menu, click Print Layout.
2. On the Standard toolbar, click New.

   A new, blank Word document opens. This becomes your main document.

3. On the Tools menu, click Mail Merge Manager.
4. In the Mail Merge Manager, click Create New under Select Document Type, and then click Envelopes.
5. In the Envelope dialog box, make any changes to the return address that you want.

   Do not enter anything (including spaces) in the Delivery address box.

6. Under Printing Options, make any changes that you want, and then click OK.
7. In the Mail Merge Manager, click Get List under Select Recipients List, and then click Open Data Source.
8. Locate and double-click the data source file.
9. In the Mail Merge Manager, click Contacts under Insert Placeholders.
10. Drag a field name from the Contacts list. For example, drag the FirstName field to the envelope’s address box.
11. Repeat step 10 for all the fields that you want to appear on your envelopes.
12. If you want to include postal bar codes on your labels, drag the PostalCode field onto the addressee box.
13. In your main document, edit the addressee box to add spaces and carriage returns where you want them.
14. To finish your envelopes, do one of the following:
    • To print your envelopes immediately, under Complete Merge in the Mail Merge Manager, click Merge to printer.
    • To create a document that contains your merged envelopes that you can save to print later, under Complete Merge in the Mail Merge Manager, click Merge to New Document.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Back to the top

This guidance contains recommendations that are based on the kinds of scenarios that may exist in various Microsoft operating system environments. This guidance includes how to use tools such as the following tools:

• Windows Update
• Microsoft Update
• Office Update
• The Microsoft Baseline Security Analyzer (MBSA)
• Windows Server Update Services (WSUS)
• Microsoft System Center Configuration Manager
• Microsoft Systems Management Server (SMS)
• The Extended Security Update Inventory Tool

This article describes the detection and deployment guidance for the security release that is dated November 11, 2008.

Back to the top

Detection and deployment

Environments that detect and deploy security updates by using Windows Update, Microsoft Update, Office Update, and Mactopia

Security updates that were released on November 11, 2008 are available through the following Web sites. Any exceptions are described in each Web site section. The products that are supported by each Web site are also listed.

NoteNot every update is available on every Web site that is listed here.

Windows Update

The products that are supported by this Web site are as follows:

• Microsoft Windows 2000
• Windows XP
• Windows Server 2003
• Windows Vista
• Windows Server 2008

Microsoft Update

You can detect security updates that were released on November 11, 2008 if you use Microsoft Update.

General exceptions
Microsoft Update does not support the following:

• Visual Studio 2002 or Visual Studio 2003
• Digital Image Suite 2006
• SQL 7.0 or Microsoft Data Engine (MSDE) 1.0
• Report Viewer 2005 or Report Viewer 2008
• Visual FoxPro 8.0 Service Pack 1 (SP1), Visual FoxPro 9.0 SP1, or Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
• Platform SDK: GDI+
• Any Office 2000 components
• Any Macintosh products
• MSN Messenger or Windows Live Messenger

Specific exceptions
There are no specific exceptions this month.

Office Update

The products that are supported by this Web site are as follows:

• Office 2000
• Office 2002
• Office 2003
• The 2007 Office system

General exceptions

• Office Update does not support 2007 Office components when they are installed on computers that are running Windows Vista or Windows Server 2008. You must use Microsoft Update instead.
• Office Update does not support any Macintosh products.

Mactopia

The products that are supported by this Web site are as follows:

• Microsoft Office 2001 for Mac
• Microsoft Office 2004 for Mac
• Microsoft Office X for Mac
• Microsoft Office 2008 for Mac

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 2.1

You can detect security updates that were released on November 11, 2008 if you use MBSA version 2.1.

General exceptions
MBSA version 2.1 does not support the following:

• Visual Studio 2002 or Visual Studio 2003
• Digital Image Suite 2006
• SQL 7.0 or Microsoft Data Engine (MSDE) 1.0
• Report Viewer 2005 or Report Viewer 2008
• Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP1, or Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
• Platform SDK: GDI+
• Any Office 2000 components
• Any Macintosh products
• Microsoft Works 8 when you use an offline scan
  Note For more information, see the Offline and Online scans section later in this section.
• MSN Messenger or Windows Live Messenger

Specific exceptions
There are no specific exceptions this month.

Offline and Online scans

• Online scan
  This is when the system that is scanned by MBSA 2.1 has connectivity to Microsoft Update. This is shown in the completed scan report.
• Offline scan
  This is when the system that is scanned by MBSA 2.1 is managed by WSUS or in an offline secure environment that forces the system to use theWSUSSCN2.CAB offline catalog.

Environments that detect and deploy security updates by using Windows Server Update Services (WSUS)

You can detect and deploy security updates that were released on November 11, 2008 if you use any of the following items:

• WSUS 2.0 Service Pack 1 (SP1)
• WSUS 3.0
• WSUS 3.0 SP1

General exceptionsWSUS does not support the following:

• Visual Studio 2002 or Visual Studio 2003
• Digital Image Suite 2006
• SQL 7.0 or Microsoft Data Engine (MSDE) 1.0
• Report Viewer 2005 or Report Viewer 2008
• Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP1, or Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
• Platform SDK: GDI+
• Any Office 2000 components
• Any Macintosh products
• MSN Messenger or Windows Live Messenger

Specific exceptions
There are no specific exceptions this month.

Environments that detect and deploy security updates by using SMS 2.0, SMS 2003, or SCCM 2007

You can detect and deploy all security updates that were released on November 11, 2008 if you use any of the following items:

• Systems Management Server (SMS) 2.0 together with the SUS Feature Pack
• Systems Management Server (SMS) 2003 together with the SUS Feature Pack
• Systems Management Server (SMS) 2003 together with Inventory Tool for Microsoft Updates (ITMU)
• System Center Configuration Manager (SCCM) 2007

General exceptions

• Microsoft Systems Management Server 2003 Service Pack 3 (SP3) includes support for, and is required for, Windows Vista and Windows Server 2008 manageability.
• SMS 2003 together with the ITMU and SCCM 2007 do not support the following products:
  • Visual Studio 2002 or Visual Studio 2003
  • Digital Image Suite 2006
  • SQL 7.0 or Microsoft Data Engine (MSDE) 1.0
  • Report Viewer 2005 or Report Viewer 2008
  • Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP1 or Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
  • Platform SDK: GDI+
  • Any Office 2000 components
  • Any Macintosh products
  • MSN Messenger or Windows Live Messenger
• SMS together with the SUS Feature Pack do not support the following products:
  • Microsoft Expression Web and Microsoft Expression Web 2
  • Host Integration Server 2000, 2004 and 2006
  • Forefront Client Security 1.0 when it is installed on Windows 2000 SP4
  • Report Viewer 2005 or Report Viewer 2008
  • Visual FoxPro 9.0 SP1 and Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
  • The .NET Framework 2.0 and the .NET Framework 2.0 SP1 when it is installed on Windows 2000 SP4
  • Windows Media Player 11
  • Digital Image Suite 2006
  • Microsoft Data Engine (MSDE) 1.0
  • SQL Server 2005
  • SQL Server 2008
  • Visual Studio 2008
  • Exchange 2007
  • Microsoft Works 8
  • The 2007 Office system
  • Windows Internet Explorer 7
  • Windows Vista
  • Windows Server 2008
  • Any x64-based versions of Windows or of SQL Server
  • Any Itanium-based versions of Windows or of SQL Server
• The SMS SUS Feature Pack, SMS ITMU, and SCCM do not support any Macintosh products.

Specific exceptions
There are no specific exceptions this month.

NoteThe SMS SUS Feature Pack requires the Extended Security Update Inventory Tool to detect all the security updates.

To obtain the Extended Security Update Inventory Tool, visit the following Microsoft Web site:

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

NoteTo simplify this table, items that were listed under the general exceptions heading for each detection and deployment technology are not included.

For example, the SMS SUS Feature Pack column in this table may include a Yes. However, the security bulletin lists a Windows Vista component as affected. Previously, we would have stated in the table that the SMS SUS Feature Pack partly supported the deployment of the security update because the SMS SUS Feature Pack does not support Windows Vista components. Currently, we no longer account for that specific exception in the table because the exception is always listed as a general exception.

Rereleased security updates

There are no rereleases this month.

Back to the top

Frequently asked questions

What is Microsoft doing to provide guidance about how to deploy these updates?

We encourage system administrators to join the monthly technical webcast to learn more about security updates.The webcast for this security update airs on November 12 at 11am (Pacific Time). To register, visit the following Microsoft Web site:

What other information should I know about MBSA?

For more information about the programs that MBSA currently supports, visit the following Microsoft TechNet Web page:

Can I use SMS or System Center Configuration Manager to determine whether the updates are required?

Yes. SMS helps detect and deploy these security updates. SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with SUSFP use MBSA version 1.2.1 technology for detection. Therefore, SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack have limitations that resemble the limitations of MBSA version 1.2.1.

For more information about SMS, visit the following Microsoft Web site:

The SUS Feature Pack together with the Extended Security Update Inventory Tool are required to detect all the security updates on Microsoft Windows and on other affected Microsoft products.

For more information about the limitations of the SUS Feature Pack, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use ITMU to detect and deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Microsoft Web site:

System Center Configuration Manager 2007 uses WSUS 3.0 for detection and deployment of these security updates. Therefore, anything that is supported by WSUS 3.0 is also supported by System Center Configuration Manager 2007.

Back to the top

Back to the top

Back to the top

Detection and deployment

Environments that detect and that deploy security updates by using Windows Update, Microsoft Update, and Office Update

Security updates that were released on May 8, 2007 are available through the following Web sites. Any exceptions are in the following list. The products that are supported by each Web site are also listed.

•	Microsoft Windows Update http://update.microsoft.com/windowsupdate (http://update.microsoft.com/windowsupdate) • Windows 2000, Windows XP, Windows Server 2003
•	Microsoft Update http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate) • Windows 2000, Windows XP, and Windows Server 2003 • Microsoft Office XP and Office 2003 • Microsoft Exchange 2000 and Exchange 2003 • Internet Security and Acceleration Server 2004 • Microsoft SQL Server 2005 • Security update 934233 (security bulletin MS07-023) Microsoft Update does not support the Excel 2000 part of this security update. • Security update 934232 (security bulletin MS07-024) Microsoft Update does not support the Word 2000 part of this security update. • Security update 934873 (security bulletin MS07-025) Microsoft Update does not support the Office 2000 part of this security update.
•	Office Update http://officeupdate.microsoft.com (http://officeupdate.microsoft.com) • Office 2000, Office XP, and Office 2003
•	Mactopia http://www.microsoft.com/mac (http://www.microsoft.com/mac) • Office 2001 for Mac • Office X for Mac • Office 2004 for Mac

Note Not every update is available on every Web site that is listed.

Environments that detect security updates by using MBSA version 1.2.1 or MBSA version 2.0.1

Microsoft Baseline Security Analyzer (MBSA) version 1.2.1 contains an integrated version of the Office Detection Tool (ODT). If you use MBSA 1.2.1 or MBSA version 2.0.1 to detect security updates, you can detect all the security updates that were released on May 8, 2007. Any exceptions are in the following list.

Note The ODT part of MBSA 1.2.1 is limited to local scans only.

Note MBSA 1.2.1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

Note MBSA 2.0.1 is not supported on Windows Vista. However, MBSA 2.0.1 supports remote scans of computers that are running Windows Vista. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that detect and that deploy security updates by using Software Update Services (SUS) or Windows Server Update Services (WSUS)

If you use SUS, WSUS 2.0, or WSUS 3.0 to detect and to deploy security updates, you can detect most security updates that were released on May 8, 2007. Any exceptions are in the following list.
Note SUS 1.0 SP1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

•	Security update 934233 (security bulletin MS07-023) SUS does not support any part of this security update. WSUS does not support the Excel 2000 part of this security update.
•	Security update 934232 (security bulletin MS07-024) SUS does not support any part of this security update. WSUS does not support the Word 2000 part of this security update.
•	Security update 934873 (security bulletin MS07-025) SUS does not support any part of this security update. WSUS does not support the Office 2000 part of this security update.
•	Security update 931906 (security bulletin MS07-028) SUS does not support any part of this security update.

Environments that detect and that deploy security updates by using SMS 2.0 together with the Security Update Inventory Tool (SUIT) or SMS 2003 together with the Inventory Tool for Microsoft Updates (ITMU)

If you use Microsoft Systems Management Server (SMS) 2.0 together with SUIT, SMS 2003 together with SUIT, or SMS 2003 together with ITMU to detect and to deploy security updates, you can detect and deploy all security updates that were released on May 8, 2007. Any exceptions are in the following list.
Note SMS together with SUIT does not support Windows Vista, any Windows x64 editions, or Windows Itanium-based systems.

•	Security update 934233 (security bulletin MS07-023) SMS ITMU does not support the Excel 2000 part of this security update.
•	Security update 934232 (security bulletin MS07-024) SMS ITMU does not support the Word 2000 part of this security update.
•	Security update 934873 (security bulletin MS07-025) SMS ITMU does not support the Office 2000 part of this security update.
•	Security update 931832 (security bulletin MS07-026) SMS SUIT does not support the Exchange 2007 part of this security update.
•	Security update 931906 (security bulletin MS07-028) SMS SUIT supports this update when you use the Extended Security Update Inventory Tool (ESUIT).

To obtain ESUIT, visit the following Microsoft Web site:

Back to the top

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

Security update

Bulletin

Component

Office Update

Windows Update

Microsoft Update

MBSA 1.2 and the Office Detection Tool

MBSA 2.0.1

SUS

WSUS 2.0 and WSUS 3.0

Enterprise Scan Tool

SMS Security Update Inventory Tool

SMS Inventory Tool for Microsoft Updates

Detect and deploy

Detect and deploy

Detect and deploy

Detect only

Detect only

Detect and deploy

Detect and deploy

Detect only

Detect and deploy

Detect and deploy

934233

MS07-023

Excel

Yes

Not applicable

Partially, see the MU section

Yes

Partially, see the MBSA section

Not applicable

Partially, see the WSUS section

Not applicable

Yes

Partially, see the SMS section

934232

MS07-024

Word

Yes

Not applicable

Partially, see the MU section

Yes

Partially, see the MBSA section

Not applicable

Partially, see the WSUS section

Not applicable

Yes

Partially, see the SMS section

934873

MS07-025

Office

Yes

Not applicable

Partially, see the MU section

Yes

Partially, see the MBSA section

Not applicable

Partially, see the WSUS section

Not applicable

Yes

Partially, see the SMS section

931832

MS07-026

Exchange

Not applicable

Not applicable

Yes

Partially, see the MBSA section

Yes

Not applicable

Yes

Not applicable

Partially, see the SMS section

Yes

931768

MS07-027

Internet Explorer

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

931906

MS07-028

CAPICOM

Not applicable

Not applicable

Yes

No

Yes

Not applicable

Yes

Yes

Yes, with ESUIT

Yes

935966

MS07-029

DNS

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

Back to the top

Rereleased security updates

There are no rereleases this month.

Back to the top

Frequently asked questions

Q1: What is Microsoft doing to provide guidance about how to deploy these updates?

A1: Microsoft encourages system administrators to join the monthly technical webcast to learn more about security updates. The webcast for this security update airs on May 9, 2007 at 11:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

Q2: Is the Enterprise Scan Tool (EST) cumulative for SMS like ESUIT is cumulative for SMS?

A2: No, the EST is not cumulative. There are no plans to make the EST cumulative.

Q3: Can I use MBSA to determine whether these updates are required?

A3: Yes, you can use MBSA 1.2.1 and MBSA 2.0.1 to fully detect the need for the following security updates that were released on May 8, 2007, except where noted.

Microsoft Knowledge Base article number	Bulletin ID	Component	Detection note
934233	MS07-023	Excel	See the MBSA section
934232	MS07-024	Word	See the MBSA section
934873	MS07-025	Office	See the MBSA section
931832	MS07-026	Exchange	See the MBSA section
931906	MS07-028	CAPICOM	See the MBSA section

For more information about the programs that MBSA currently does not detect, click the following article numbers to view the articles in the Microsoft Knowledge Base:

You may have installed a program that is listed in the Affected software section of a security bulletin that is mentioned in the related article. In this case, you may have to manually determine whether you must install the required security update.. For more information about MBSA, visit the following Microsoft Web site:

Q4: Which security updates require that I use the EST together with MBSA 1.2.1 to determine which systems on my network are vulnerable?

A4: The following security update requires that you use the EST together with MBSA to determine which systems on the network are vulnerable.

Microsoft Knowledge Base article number	Bulletin ID	Component
931906	MS07-028	CAPICOM

Q5: Can I use SMS to determine whether the updates are required?

A5: Yes, SMS helps detect and deploy these security updates. SMS 2.0 and SMS 2003 together with SUIT use MBSA 1.2.1 technology for detection. Therefore, SMS 2.0 and SMS 2003 together with SUIT have limitations that resemble the limitations of MBSA 1.2.1. For more information about SMS, visit the following Microsoft Web site:

SUIT together with ESUIT are required for detection of all the security updates on Microsoft Windows and on other affected Microsoft products. For more information about the limitations of SUIT, click the following article numbers to view the articles in the Microsoft Knowledge Base:

SMS 2.0 and SMS 2003 together with SUIT also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.

Alternatively, SMS 2003 customers can use ITMU to detect and deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Web site:

Back to the top

This article contains download and support information, installation notes, and general usage information about Network Monitor 3. Network Monitor 3.1 is the latest version.

Back to the top

Download and support information

To download Network Monitor 3.1 visit the following Microsoft Web sites:

Support information for Network Monitor 3 is located at the following Microsoft Connect Web site:

You must sign in to the Web site by using a Windows Live ID. After you sign in, you can apply to participate in the program. To do this, in the Options column of the table, click Apply next to Network Monitor 3. After you enroll in the program, you have access to newsgroups, and you can submit bug reports.

Installation notes

Network Monitor 3.1 can co-exist with earlier versions of Network Monitor. By default, Network Monitor 3.1 is installed in the %Program Files% Microsoft Network Monitor 3.0 folder. Therefore, conflicts do not occur if an earlier version is installed in a different folder on the computer. When you install Network Monitor 3.1, Network Monitor 3 is uninstalled.

Network Monitor 3.1 includes a new driver for Windows Vista-based computers. This new driver supports new features of the Network Driver Interface Specification (NDIS) 6.0 driver. If you are using tools that rely on Network Monitor 2.x NPPTools, the tools will no longer work. To capture network data in Windows Vista, you must use Network Monitor 3.1. Network Monitor 2.x does not capture network data correctly in Windows Vista.

Suggested hardware to run Network Monitor 3.1 is listed as follows:

•	1 GHz or faster processor
•	1 GB or more memory
•	25 MB free space on the hard disk, and additional hard disk space to store capture files

Network Monitor 3.1 is supported on the following operating systems:

•	Windows Vista
•	Microsoft Windows XP
•	Microsoft Windows Server 2003

Warnings and cautions

Currently, we do not recommend that you run Network Monitor 3 on production systems. In scenarios where load is something to consider, use the command-line version of Network Monitor 3 to capture network data. The command-line version is Nmcap.exe. For more information about Nmcap.exe, see the Nmcap.exe command-line tool section.

Network Monitor 3 may consume lots of system resources. Some things to consider are listed as follows.

•	Disk space When you start a capture session, Network Monitor 3 stores frames in a sequence of capture files that are located in the Temp folder. By default, the size of each capture file is 20 MB. By default, if you do not stop the capture session, Network Monitor 3 continues to store capture files in the Temp folder until the free hard disk space on the computer is less than 2 percent. Then, Network Monitor 3 stops the capture session. You can configure the capture file size, the location where the capture files are stored, the free hard disk space limit, and other capture options. To do this, on the Tools menu, point to Options, and then click the Capture tab.
•	Memory use In addition to capturing data, Network Monitor 3 assigns properties to frames, and then uses the properties to group the frames into conversations. Network Monitor 3 displays the conversations and the associated frames in a tree structure in the Network Conversations pane. The Conversations feature of Network Monitor 3 significantly increases memory use. This may cause the computer to become unresponsive. By default, the Conversations feature is turned off. Some higher-level protocol filters require conversation properties. To turn on the Conversations feature, click the Start Page tab, and then click to select the Enable Conversations check box.
•	Processor utilization The Conversations feature of Network Monitor 3 may significantly increase processor utilization when lots of frames are processed. By default, the Conversations feature is turned off, as mentioned in the Memory use section.

General usage

General usage information for Network Monitor 3 is listed as follows.

•	Capture network data As mentioned earlier, Network Monitor 3 may consume lots of system resources. Therefore, if you want to minimize the effect on system resources that may occur when you use Network Monitor 3 to capture data, use the Nmcap.exe command-line tool to capture data. Network Monitor 3 enables you to collect network data and to view the network data in real time as the data is captured. To start a capture session in Network Monitor 3, click the Start Page tab, click Create a new capture tab, and then either click the Start Capture button, or press F10.
•	Filters Network Monitor 3 uses a simple syntax that is expression-based to filter frames. All frames that match the expression are displayed to the user. For more information about filters, do any of the following: • View the topics in the Using Filters section of the Network Monitor 3 User’s Guide. To do this, on the Help menu, click Contents, and then double-click Using Filters. • On the Help menu, point to How Do I , and then click Use Filters. • Use the Capture Filter tab or the Display Filter tab to view standard filters.
•	Conversations By default, the Conversations feature is turned off. This is the default setting because the Conversations feature can consume lots of memory, especially in scenarios when you capture data for long periods of time. To turn on the Conversations feature, click the Start Page tab, and then click to select the Enable Conversations check box. When you turn on the Conversations feature, frames are grouped and displayed in the Network Conversations pane in a tree structure according to the conversations to which they belong. For example, TCP data that uses the same source port and the same destination port is organized into a group. When you click a node in the Network Conversations pane, the corresponding conversation filter is automatically applied to the frames in the Frame Summary pane. Only frames that belong to that particular conversation are displayed.
•	Nmcap.exe command-line tool The Nmcap.exe command-line tool enables you to configure when you want to start a capture session or to stop a capture session. You can also use the Nmcap.exe command-line tool to created chained captures. Chained captures enable you to create multiple capture files. However, the size of the capture files remains small.
•	Network Parsing Language (NPL) Network Monitor 3 parsers are written in a language specifically to make parser development more straightforward. This also provides a level of protection against potential exploitation from malicious code that may occur if parsers were created as DLL files. NPL provides access to parsers. You can view or modify the parsers that are included in Network Monitor 3.

Common issues

Common issues include the following:

•

Protocols may not parse correctly. This issue may occur if either of the following conditions is true: • The Conversations feature is turned off. Certain protocols depend on conversation properties to store state values that may be needed in later frames. For example, TCP needs conversations to store information about retransmitted frames. The filter for TCP Retransmits will not work unless the Conversations feature is enabled. Similarly, the Server Message Block (SMB) protocol cannot translate the response to a Transact command, because the response does not contain the original command. The information is saved in conversation properties. • The parser and the associated protocol may be available under the Microsoft Communications Protocol Program (MCPP) and the Microsoft Work Group Server Protocol Program (WSPP). To learn more about how to become a licensee, visit the following Microsoft Web site: http://www.microsoft.com/about/legal/intellectualproperty/protocols/mcpp.mspx (http://www.microsoft.com/about/legal/intellectualproperty/protocols/mcpp.mspx) These parsers are considered confidential Microsoft intellectual property and are not distributed publicly. Therefore, these parsers are not part of the publicly-released version of Network Monitor 3

•

You receive one of the following error messages when you run Network Monitor 3 on a Windows Vista-based computer: None of the network adapters are bound to the Netmon driver This network adapter is not configured to capture with Network Monitor This issue occurs if either of the following conditions is true: • You are not running Network Monitor 3 as administrator. • You are not a member of the Netmon Users group. For more information, see the Network Monitor 3 releases notes or see the Operating on Windows Vista topic in Network Monitor 3 Help.

Back to the top

Back to the top

Note ETW is not available in earlier versions of Microsoft Windows.

You can trace the following COM+ and COM providers:

•	COMSVCS
•	COMADMIN
•	OLE32
•	DCOMSCM (RPCSS)

Note The tracing mechanism produces a binary file. The binary file must be formatted by Microsoft so that it can be analyzed.

Back to the top

Note Typically, to troubleshoot an issue, you do not have to enable tracing for all the providers that are listed in the Introduction section.

Back to the top

To start tracing

To start the tracing functionality for a provider, use one of the following commands as appropriate.

Note In the following commands, the placeholder GUID represents the GUID for the provider.

•	logman -start COMSVCS -p {GUID} 0xf 0×5 -ets
•	logman -start COMADMIN -p {GUID} 0xf 0×5 -ets
•	logman -start DCOMSCM -p {GUID} 0×7 0×5 -ets
•	logman -start OLE32 -p {GUID} 0xf 0×5 -ets

Note For more information about how to enable ETW for the OLE32 provider, see the More information section.

The start command creates a log file in the current directory. For example, the start command may create the Dcomscm.etl log file or the Ole32.etl log file. You can use the -o parameter to specify a different path.

Back to the top

To stop tracing

To stop the tracing functionality for a provider, use one of the following commands as appropriate:

•	logman -stop COMSVCS -ets
•	logman -stop COMADMIN -ets
•	logman -stop DCOMSCM -ets
•	logman -stop OLE32 -ets

Note After the trace log is created, you must send the binary files to Microsoft for analysis.

Back to the top

To work around decreased performance if you enable tracing for the OLE32 component

The Ole32.dll file is loaded in many processes. Therefore, you may experience decreased performance if you enable tracing for the OLE32 component.

To work around this issue, enable OLE32 component tracing per process. To enable OLE32 component tracing per process, use one of the following methods.

Note You do not have to use these methods for the other tracing providers.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

Method 1: The registry or static method

If you know the name of the executable of the process or processes that have COM problems, you can add a registry value to enable ETW tracing. To add a registry value to the registry, type the following command at a command prompt.

Note In the following command, the placeholder ExecutablesToTrace represents the process or processes that you want to trace.

Note You can type multiple executables in the registry value. You must type the full path of each executable.

If you are not sure which process or processes have COM problems, you can use the following command.

Note The following command adds a registry value that enables tracing on all process that start after the registry value is set. Tracing is enabled on processes that start after the computer is restarted. Therefore, we recommend that you delete the registry keys after the trace session is completed.

Method 2: The Comtrace.exe or dynamic method

You can use the commands that are listed in the following table to enable ETW tracing by using the Comtrace.exe utility.

Note The Comtrace.exe utility is not part of the operating system. Therefore, we recommend that you use the registry method if you can do this.

Note When you use the Comtrace.exe utility to enable tracing for the OLE32 provider on a program that is running, the tracing functionality stops when the application exits. Additionally, the tracing functionality for the program will not start when you start the program again.

Command	Result
comtrace.exe -f ON -p 123	Turn on COM tracing for PID 123
comtrace.exe -f OFF -p 123	Turn off COM tracing for PID 123
comtrace.exe -f ON -p 123 456	Turn on COM tracing for PID 123 and for PID 456
comtrace.exe -f ON -p *	Turn on COM tracing for all COM processes