Back to the top

Back to the top

Back to the top

Back to the top

Files in the working directory do not have the read only attribute even though they are not checked out from Visual SourceSafe.

Several scenarios can cause this behavior:

1. You may have selected make writable option when getting files from SourceSafe.

2.  You may not have Tools> Options> Local Files tab  Use Read-only Flag for files not checked out selected.

3. You may be sharing a working directory with another user that does have the file checked out.

4. You may have intentionally uncheck the read only attribute in order to do testing on the file without checking the file out.

5. You may not have NTFS permissions to set the read only in the working directory. 

6. In the dialog Tools> Options> expand Source Control and choose Environment, you set the On Edit option to do nothing and you have checked the box in the same dialogue to Allow checked in items to be edited.

Back to the top

Make sure the user has full permissions to their working folder.

In VSS  Explorer:

Open the Tools> Options> Local Files tab and make sure the Use Read-only Flag for files not checked out option has a check mark in it.

or

In Visual Studio:

 Go to Tools> Options> expand Source Control and choose Plug-in Settings.  Click on the advance button and select the Local Files tab and make sure the Use Read-only Flag for files not checked out option has a check mark in it.

In Visual Studio you have the option to be prompted when editing or to automatically check the file out.

In the dialog Tools> Options> expand Source Control and choose Environment.

Set the On Edit option to Prompt for Check out or Automatically check out depending on preference.

Move all the files from the working folder and re-issue the Get Latest (making sure you do not select make writable) and try to edit the file.

Back to the top

If you do a Get Latest, typically the files should be marked with a read only attribute.  However, sometimes the attribute is not set for some reason. Please review the cause section for most common reasons.

Sharing of working directories is not recommend because it can easily lead to the problem described in this article.

If you are editing directly from the SourceSafe Explorer

Open the Tools> Options> General tab and make sure that the Double-click on a file option is set to Ask.

You are prompted by a dialog that contains the following question in a option group:

Do you want to:

View SourceSafe’s copy of this file

Check out this file and edit it in your working folder.

Back to the top

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Back to the top

This guidance contains recommendations that are based on the types of scenarios that may exist in various Microsoft operating system environments. This guidance includes how to use tools such as the following tools:

•	Windows Update
•	Microsoft Update
•	Office Update
•	The Microsoft Baseline Security Analyzer (MBSA)
•	Windows Server Update Services (WSUS)
•	Microsoft System Center Configuration Manager
•	Microsoft Systems Management Server (SMS)
•	The Extended Security Update Inventory Tool

This article describes the detection and deployment guidance for the security release that is dated March 11, 2008.

Back to the top

Detection and deployment

Environments that detect and deploy security updates by using Windows Update, Microsoft Update, Office Update, and Mactopia

Security updates that were released on March 11, 2008 are available through the following Web sites. Any exceptions are described in each Web site section. The products that are supported by each Web site are also listed.

Note Not every update is available on every Web site that is listed here.

Windows Update

The products that are supported by this Web site are as follows:

•	Microsoft Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008

Microsoft Update

The products that are supported by this Web site are as follows:

•	Microsoft Internet Security and Acceleration Server 2004
•	Microsoft Internet Security and Acceleration Server 2006
•	Microsoft Exchange 2000 Server
•	Microsoft Exchange Server 2003
•	Microsoft Exchange Server 2007
•	Microsoft Office 2002
•	Microsoft Office 2003
•	The 2007 Microsoft Office system
•	Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008
•	Microsoft SQL Server 2005
•	Microsoft Forefront Client Security
•	Microsoft Visual Studio 2005

General exceptions

•	Microsoft Update does not support Office 2000 components.
•	Microsoft Update does not support any Apple Macintosh products.

Specific exceptionsMicrosoft Update does not support the part of security update 933103 that involves the following products:

•	Microsoft Visual Studio 2002
•	Microsoft Visual Studio 2003
•	Microsoft BizTalk Server 2000
•	Microsoft BizTalk Server 2002
•	Microsoft Commerce Server 2000
•	Microsoft Internet Security and Acceleration (ISA) Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Office Update

The products that are supported by this Web site are as follows:

•	Office 2000
•	Office 2002
•	Office 2003
•	The 2007 Office system

General Exceptions

•	Office Update does not support 2007 Office components when they are installed on computers that are running Windows Vista or Windows Server 2008. You must use Microsoft Update instead.
•	Office Update does not support any Macintosh products.

Mactopia

The products that are supported by this Web site are as follows:

•	Microsoft Office 2001 for Mac
•	Microsoft Office 2004 for Mac
•	Microsoft Office X for Mac
•	Microsoft Office 2008 for Mac

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 2.0.1

You can detect security updates that were released on March 11, 2008 if you use MBSA version 2.0.1.

General Exceptions

•	MBSA version 2.0.1 does not support any Office 2000 components.
•	MBSA version 2.0.1 does not support any Macintosh products.
•	MBSA version 2.0.1 is not supported on Windows Vista. However, MBSA version 2.0.1 supports remote scans of computers that are running Windows Vista. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 931943 (/Feedback.aspx?kbNumber=931943/)Microsoft Baseline Security Analyzer (MBSA) support for Windows Vista
•	MBSA version 1.2.1 is no longer supported. It will not detect security updates that were released after October 2007.

Specific exceptionsMBSA version 2.0.1 does not support the part of security update 933103 that involves the following products:

•	Visual Studio 2002
•	Visual Studio 2003
•	BizTalk Server 2000
•	BizTalk Server 2002
•	Commerce Server 2000
•	ISA Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that detect and deploy security updates by using Windows Server Update Services (WSUS)

You can detect and deploy security updates that were released on March 11, 2008 if you use any of the following items:

•	WSUS 2.0 Service Pack 1 (SP1)
•	WSUS 3.0
•	WSUS 3.0 Service Pack 1 (SP1)

General Exceptions

•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Office 2000 components.
•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Macintosh products.
•	SUS 1.0 Service Pack 1 (SP1) is no longer supported. It will not receive security updates.

Specific exceptionsWSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support the part of security update 933103 that involves the following products:

•	Visual Studio 2002
•	Visual Studio 2003
•	BizTalk Server 2000
•	BizTalk Server 2002
•	Commerce Server 2000
•	ISA Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that detect and deploy security updates by using SMS 2.0, SMS 2003, or System Center Configuration Manager 2007

You can detect and deploy all security updates that were released on March 11, 2008 if you use any of the following items:

•	Systems Management Server (SMS) 2.0 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with Inventory Tool for Microsoft Updates (ITMU)
•	System Center Configuration Manager 2007

General Exceptions

•	SMS ITMU and System Center Configuration Manager do not support any Office 2000 components.
•	SMS together with the SUS Feature Pack does not support the following products: • The 2007 Office system • Windows Internet Explorer 7 • Windows Vista • Windows Server 2008 • Any x64-based versions of Windows • Any Itanium-based versions of Windows
•	The SMS SUS Feature Pack, SMS ITMU, and System Center Configuration Manager do not support any Macintosh products.

Specific exceptionsWSUS 2.0, WSUS 3.0, and WSUS 3.0 SP1 do not support the part of security update 933103 that involves the following products:

•	Visual Studio 2002
•	Visual Studio 2003
•	BizTalk Server 2000
•	BizTalk Server 2002
•	Commerce Server 2000
•	ISA Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Note The SMS SUS Feature Pack requires the Extended Security Update Inventory Tool to detect all the security updates.

To obtain the Extended Security Update Inventory Tool, visit the following Microsoft Web site:

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

Note To simplify this table, items that were listed under the General Exceptions heading for each detection and deployment technology are not included.

For example, the Microsoft Update column in this table may include a Yes. However, the security bulletin lists an Office 2000 component as affected. Previously, we would have stated in the table that Microsoft Update partially supported deployment of the security update. However, no Office 2000 components are supported by Microsoft Update. Therefore, we no longer account for that product in the table because it is always listed as a general exception.

Security update	Bulletin	Component	Office Update	Windows Update	Microsoft Update	MBSA 2.0.1	WSUS 2.0 and WSUS 3.0	SMS SUS Feature Pack	SMS Inventory Tool for Microsoft Updates	System Center Configuration Manager 2007
			Detect and deploy	Detect and deploy	Detect and deploy	Detect only	Detect and deploy	Detect and deploy	Detect and deploy	Detect and deploy
949029	MS08-014	Microsoft Excel	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
949031	MS08-015	Microsoft Outlook	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
949030	MS08-016	Office	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
933103	MS08-017	Microsoft Office Web Components	Partially. See Office Update section.	Not applicable	Partially. See Microsoft Update section.	Partially. See MBSA section.	Partially. See WSUS section.	Yes	Partially. See SMS section.	Partially. See System Center Configuration Manager section.

Rereleased security updates

There are no rereleases this month.

Back to the top

Frequently asked questions

What is Microsoft doing to provide guidance about how to deploy these updates?

We encourage system administrators to join the monthly technical Webcast to learn more about security updates. The Webcast for this security update airs on Thursday, March 13, 2008 12:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

What other information should I know about MBSA?

For more information about the programs that MBSA currently does not detect, click the following article number to view the article in the Microsoft Knowledge Base:

If you installed a program that is listed in the Affected software section of a security bulletin, you may have to manually determine whether you must install the required security update. For more information about MBSA, visit the following Microsoft Web site:

Can I use SMS or System Center Configuration Manager to determine whether the updates are required?

Yes. SMS helps detect and deploy these security updates. SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with SUSFP use MBSA version 1.2.1 technology for detection. Therefore, SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack have limitations that resemble the limitations of MBSA version 1.2.1.

For more information about SMS, visit the following Microsoft Web site:

The SUS Feature Pack together with the Extended Security Update Inventory Tool is required to detect all the security updates on Microsoft Windows and on other affected Microsoft products.

For more informationabout the limitations of the SUS Feature Pack, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use ITMU to detect and to deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Microsoft Web site:

System Center Configuration Manager 2007 uses WSUS 3.0 for detection and deployment of these security updates. Therefore, anything that is supported by WSUS 3.0 is also supported by System Center Configuration Manager 2007.

Back to the top

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows Vista service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

Prerequisites

To apply this hotfix, you must have Windows Vista Service Pack 1 installed.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other previously released hotfixes.

Registry information

To use this hotfix, you do not have to make any changes to the registry.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista with SP1, x86-based versions

Windows Vista with SP1, x64-based versions

Windows Vista with SP1, Itanium-based versions

Back to the top

Back to the top

For more information about the ReportResult method, visit the following Microsoft Web site:

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

In this scenario, Sysprep errors that resemble the following are logged in the Setuperr.log file:

Additionally, you must now restart the Sysprep tool.

Note The Setuperr.log file resides in the following location:

Back to the top

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista, x86-based versions

Windows Vista, 64-bit versions

Back to the top

Back to the top

Back to the top

The Setupper.log file may contain lines that resemble the following:

Note The Setupper.log file is located in the Windows System32 Sysprep Panther folder.

Back to the top

Back to the top

Back to the top

The following text is an example of an XML answer file:

<settings pass=generalize>        <component name=Microsoft-Windows-Security-Licensing-SLC processorArchitecture=x86 publicKeyToken=31bf3856ad364e35 language=neutral versionScope=nonSxS xmlns:wcm=http://schemas.microsoft.com/WMIConfig/2002/State xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance>            <SkipRearm>1</SkipRearm>        </component>    </settings>

Note You must make sure that the <SkipRearm> setting is removed from the final unattended file that is used to deploy computers in a production environment.If <SkipRearm> is not removed from the unattended file that is used to deploy computers in a production environment, the KMS current client count does not increase for new clients that are added to the network.

Back to the top

To run the Rearm process in Windows Vista, use one of the following methods:

•	Run Sysprep /generalizeon the computers that are used to build the custom Windows Vista image.
•	Run the Slmgr.vbs script in an elevated Command Prompt window. For example, run cscript c: windows system32 slmgr.vbs –rearm.

Note Administrative credentials are required to run the Rearm process. The Rearm process can be run a maximum of three times in a Windows Vista image. For more information about the System Preparation Tool, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

This guidance contains recommendations that are based on the kinds of scenarios that may exist in various Microsoft operating system environments. This guidance includes how to use tools such as the following tools:

• Windows Update
• Microsoft Update
• Office Update
• The Microsoft Baseline Security Analyzer (MBSA)
• Windows Server Update Services (WSUS)
• Microsoft System Center Configuration Manager
• Microsoft Systems Management Server (SMS)
• The Extended Security Update Inventory Tool

This article describes the detection and deployment guidance for the security release that is dated November 11, 2008.

Back to the top

Detection and deployment

Environments that detect and deploy security updates by using Windows Update, Microsoft Update, Office Update, and Mactopia

Security updates that were released on November 11, 2008 are available through the following Web sites. Any exceptions are described in each Web site section. The products that are supported by each Web site are also listed.

NoteNot every update is available on every Web site that is listed here.

Windows Update

The products that are supported by this Web site are as follows:

• Microsoft Windows 2000
• Windows XP
• Windows Server 2003
• Windows Vista
• Windows Server 2008

Microsoft Update

You can detect security updates that were released on November 11, 2008 if you use Microsoft Update.

General exceptions
Microsoft Update does not support the following:

• Visual Studio 2002 or Visual Studio 2003
• Digital Image Suite 2006
• SQL 7.0 or Microsoft Data Engine (MSDE) 1.0
• Report Viewer 2005 or Report Viewer 2008
• Visual FoxPro 8.0 Service Pack 1 (SP1), Visual FoxPro 9.0 SP1, or Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
• Platform SDK: GDI+
• Any Office 2000 components
• Any Macintosh products
• MSN Messenger or Windows Live Messenger

Specific exceptions
There are no specific exceptions this month.

Office Update

The products that are supported by this Web site are as follows:

• Office 2000
• Office 2002
• Office 2003
• The 2007 Office system

General exceptions

• Office Update does not support 2007 Office components when they are installed on computers that are running Windows Vista or Windows Server 2008. You must use Microsoft Update instead.
• Office Update does not support any Macintosh products.

Mactopia

The products that are supported by this Web site are as follows:

• Microsoft Office 2001 for Mac
• Microsoft Office 2004 for Mac
• Microsoft Office X for Mac
• Microsoft Office 2008 for Mac

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 2.1

You can detect security updates that were released on November 11, 2008 if you use MBSA version 2.1.

General exceptions
MBSA version 2.1 does not support the following:

• Visual Studio 2002 or Visual Studio 2003
• Digital Image Suite 2006
• SQL 7.0 or Microsoft Data Engine (MSDE) 1.0
• Report Viewer 2005 or Report Viewer 2008
• Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP1, or Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
• Platform SDK: GDI+
• Any Office 2000 components
• Any Macintosh products
• Microsoft Works 8 when you use an offline scan
  Note For more information, see the Offline and Online scans section later in this section.
• MSN Messenger or Windows Live Messenger

Specific exceptions
There are no specific exceptions this month.

Offline and Online scans

• Online scan
  This is when the system that is scanned by MBSA 2.1 has connectivity to Microsoft Update. This is shown in the completed scan report.
• Offline scan
  This is when the system that is scanned by MBSA 2.1 is managed by WSUS or in an offline secure environment that forces the system to use theWSUSSCN2.CAB offline catalog.

Environments that detect and deploy security updates by using Windows Server Update Services (WSUS)

You can detect and deploy security updates that were released on November 11, 2008 if you use any of the following items:

• WSUS 2.0 Service Pack 1 (SP1)
• WSUS 3.0
• WSUS 3.0 SP1

General exceptionsWSUS does not support the following:

• Visual Studio 2002 or Visual Studio 2003
• Digital Image Suite 2006
• SQL 7.0 or Microsoft Data Engine (MSDE) 1.0
• Report Viewer 2005 or Report Viewer 2008
• Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP1, or Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
• Platform SDK: GDI+
• Any Office 2000 components
• Any Macintosh products
• MSN Messenger or Windows Live Messenger

Specific exceptions
There are no specific exceptions this month.

Environments that detect and deploy security updates by using SMS 2.0, SMS 2003, or SCCM 2007

You can detect and deploy all security updates that were released on November 11, 2008 if you use any of the following items:

• Systems Management Server (SMS) 2.0 together with the SUS Feature Pack
• Systems Management Server (SMS) 2003 together with the SUS Feature Pack
• Systems Management Server (SMS) 2003 together with Inventory Tool for Microsoft Updates (ITMU)
• System Center Configuration Manager (SCCM) 2007

General exceptions

• Microsoft Systems Management Server 2003 Service Pack 3 (SP3) includes support for, and is required for, Windows Vista and Windows Server 2008 manageability.
• SMS 2003 together with the ITMU and SCCM 2007 do not support the following products:
  • Visual Studio 2002 or Visual Studio 2003
  • Digital Image Suite 2006
  • SQL 7.0 or Microsoft Data Engine (MSDE) 1.0
  • Report Viewer 2005 or Report Viewer 2008
  • Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP1 or Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
  • Platform SDK: GDI+
  • Any Office 2000 components
  • Any Macintosh products
  • MSN Messenger or Windows Live Messenger
• SMS together with the SUS Feature Pack do not support the following products:
  • Microsoft Expression Web and Microsoft Expression Web 2
  • Host Integration Server 2000, 2004 and 2006
  • Forefront Client Security 1.0 when it is installed on Windows 2000 SP4
  • Report Viewer 2005 or Report Viewer 2008
  • Visual FoxPro 9.0 SP1 and Visual FoxPro 9.0 SP2 when it is installed on Windows 2000 SP4
  • The .NET Framework 2.0 and the .NET Framework 2.0 SP1 when it is installed on Windows 2000 SP4
  • Windows Media Player 11
  • Digital Image Suite 2006
  • Microsoft Data Engine (MSDE) 1.0
  • SQL Server 2005
  • SQL Server 2008
  • Visual Studio 2008
  • Exchange 2007
  • Microsoft Works 8
  • The 2007 Office system
  • Windows Internet Explorer 7
  • Windows Vista
  • Windows Server 2008
  • Any x64-based versions of Windows or of SQL Server
  • Any Itanium-based versions of Windows or of SQL Server
• The SMS SUS Feature Pack, SMS ITMU, and SCCM do not support any Macintosh products.

Specific exceptions
There are no specific exceptions this month.

NoteThe SMS SUS Feature Pack requires the Extended Security Update Inventory Tool to detect all the security updates.

To obtain the Extended Security Update Inventory Tool, visit the following Microsoft Web site:

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

NoteTo simplify this table, items that were listed under the general exceptions heading for each detection and deployment technology are not included.

For example, the SMS SUS Feature Pack column in this table may include a Yes. However, the security bulletin lists a Windows Vista component as affected. Previously, we would have stated in the table that the SMS SUS Feature Pack partly supported the deployment of the security update because the SMS SUS Feature Pack does not support Windows Vista components. Currently, we no longer account for that specific exception in the table because the exception is always listed as a general exception.

Rereleased security updates

There are no rereleases this month.

Back to the top

Frequently asked questions

What is Microsoft doing to provide guidance about how to deploy these updates?

We encourage system administrators to join the monthly technical webcast to learn more about security updates.The webcast for this security update airs on November 12 at 11am (Pacific Time). To register, visit the following Microsoft Web site:

What other information should I know about MBSA?

For more information about the programs that MBSA currently supports, visit the following Microsoft TechNet Web page:

Can I use SMS or System Center Configuration Manager to determine whether the updates are required?

Yes. SMS helps detect and deploy these security updates. SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with SUSFP use MBSA version 1.2.1 technology for detection. Therefore, SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack have limitations that resemble the limitations of MBSA version 1.2.1.

For more information about SMS, visit the following Microsoft Web site:

The SUS Feature Pack together with the Extended Security Update Inventory Tool are required to detect all the security updates on Microsoft Windows and on other affected Microsoft products.

For more information about the limitations of the SUS Feature Pack, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use ITMU to detect and deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Microsoft Web site:

System Center Configuration Manager 2007 uses WSUS 3.0 for detection and deployment of these security updates. Therefore, anything that is supported by WSUS 3.0 is also supported by System Center Configuration Manager 2007.

Back to the top

This guidance contains recommendations that are based on the kinds of scenarios that may exist in various Microsoft operating system environments. This guidance includes how to use tools such as the following tools:

•	Windows Update
•	Microsoft Update
•	Office Update
•	The Microsoft Baseline Security Analyzer (MBSA)
•	Windows Server Update Services (WSUS)
•	Microsoft System Center Configuration Manager
•	Microsoft Systems Management Server (SMS)
•	The Extended Security Update Inventory Tool

This article describes the detection and deployment guidance for the security release that is dated May 13, 2008.

Back to the top

Detection and deployment

Environments that detect and deploy security updates by using Windows Update, Microsoft Update, Office Update, and Mactopia

Security updates that were released on May 13, 2008 are available through the following Web sites. Any exceptions are described in each Web site section. The products that are supported by each Web site are also listed.

NoteNot every update is available on every Web site that is listed here.

Windows Update

The products that are supported by this Web site are as follows:

•	Microsoft Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008

Microsoft Update

The products that are supported by this Web site are as follows:

•	Microsoft Internet Security and Acceleration Server 2004
•	Microsoft Internet Security and Acceleration Server 2006
•	Microsoft Exchange 2000 Server
•	Microsoft Exchange Server 2003
•	Microsoft Exchange Server 2007
•	Microsoft Office 2002
•	Microsoft Office 2003
•	The 2007 Microsoft Office system
•	Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008
•	Microsoft SQL Server 2005
•	Microsoft Forefront Client Security
•	Microsoft Visual Studio 2005

General exceptions

•	Microsoft Update does not support Office 2000 components.
•	Microsoft Update does not support any Apple Macintosh products.

Specific exceptions

•	Security update 952044 (security bulletin MS08-029) Microsoft Update supports only the Forefront Client Security and Windows Defender parts of this update. The other products that use the Malware Protection Engine update provide built-in mechanisms for automatic detection and deployment.

Office Update

The products that are supported by this Web site are as follows:

•	Office 2000
•	Office 2002
•	Office 2003
•	The 2007 Office system

General exceptions

•	Office Update does not support 2007 Office components when they are installed on computers that are running Windows Vista or Windows Server 2008. You must use Microsoft Update instead.
•	Office Update does not support any Macintosh products.

Mactopia

The products that are supported by this Web site are as follows:

•	Microsoft Office 2001 for Mac
•	Microsoft Office 2004 for Mac
•	Microsoft Office X for Mac
•	Microsoft Office 2008 for Mac

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 2.1

You can detect security updates that were released on May 13, 2008 if you use MBSA version 2.1.

Note MBSA version 2.1 is now released and fully supports security and vulnerability assessment scans on Windows Vista and Windows Server 2008.General exceptions

•	MBSA version 2.1 does not support any Office 2000 components.
•	MBSA version 2.1 does not support any Macintosh products.
•	MBSA version 1.2.1 and 2.0.1 are no longer supported.

Specific exceptions

•	Security update 952044 (security bulletin MS08-029) MBSA version 2.1 does not support the Malware Protection Engine update. The products that use the Malware Protection Engine update provide built-in mechanisms for automatic detection and deployment.

Environments that detect and deploy security updates by using Windows Server Update Services (WSUS)

You can detect and deploy security updates that were released on May 13, 2008 if you use any of the following items:

•	WSUS 2.0 Service Pack 1 (SP1)
•	WSUS 3.0
•	WSUS 3.0 Service Pack 1 (SP1)

General exceptions

•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Office 2000 components.
•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Macintosh products.
•	SUS 1.0 Service Pack 1 (SP1) is no longer supported. It will not receive security updates.

Specific exceptions

•	Security update 952044 (security bulletin MS08-029) WSUS 2.0 and WSUS 3.0 support only the Forefront Client Security and Windows Defender parts of this update. The other products that use the Malware Protection Engine update provide built-in mechanisms for automatic detection and deployment.

Environments that detect and deploy security updates by using SMS 2.0, SMS 2003, or System Center Configuration Manager 2007

You can detect and deploy all security updates that were released on May 13, 2008 if you use any of the following items:

•	Systems Management Server (SMS) 2.0 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with Inventory Tool for Microsoft Updates (ITMU)
•	System Center Configuration Manager 2007

General exceptions

•	SMS ITMU and System Center Configuration Manager do not support any Office 2000 components.
•	SMS together with the SUS Feature Pack does not support the following products: • The 2007 Office system • Windows Internet Explorer 7 • Windows Vista • Windows Server 2008 • Any x64-based versions of Windows • Any Itanium-based versions of Windows
•	The SMS SUS Feature Pack, SMS ITMU, and System Center Configuration Manager do not support any Macintosh products.

Specific exceptions

•

Security update 952044 (security bulletin MS08-029) SMS ITMU and SUS Feature Pack do not support the Malware Protection Engine update. System Center Configuration Manager 2007 supports only the Forefront Client Security and Windows Defender parts of this update. The products that use the Malware Protection Engine update provide built-in mechanisms for automatic detection and deployment.

NoteThe SMS SUS Feature Pack requires the Extended Security Update Inventory Tool to detect all the security updates.

To obtain the Extended Security Update Inventory Tool, visit the following Microsoft Web site:

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

NoteTo simplify this table, items that were listed under the general exceptions heading for each detection and deployment technology are not included.

For example, the Microsoft Update column in this table may include a Yes. However, the security bulletin lists an Office 2000 component as affected. Previously, we would have stated in the table that Microsoft Update partly supported deployment of the security update. However, no Office 2000 components are supported by Microsoft Update. Therefore, we no longer account for that product in the table because it is always listed as a general exception.

Security update	Bulletin	Component	Office Update	Windows Update	Microsoft Update	MBSA 2.1	WSUS 2.0 and WSUS 3.0	SMS SUS Feature Pack	SMS Inventory Tool for Microsoft Updates	System Center Configuration Manager 2007
			Detect and deploy	Detect and deploy	Detect and deploy	Detect only	Detect and deploy	Detect and deploy	Detect and deploy	Detect and deploy
951207	MS08-026	Word	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
951208	MS08-027	Publisher	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
950749	MS08-028	Jet	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes	Yes
952044	MS08-029	Malware Protection Engine	Not applicable	Not applicable	Yes	No	Partly, see the WSUS section	No	No	Yes

Rereleased security updates

There are no rereleases this month.

Back to the top

Frequently asked questions

What is Microsoft doing to provide guidance about how to deploy these updates?

We encourage system administrators to join the monthly technical Webcast to learn more about security updates. The Webcast for this security update airs on May 14, 2008 at 11:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

What other information should I know about MBSA?

For more information about the programs that MBSA currently supports, visit the following Microsoft TechNet Web page:

Can I use SMS or System Center Configuration Manager to determine whether the updates are required?

Yes. SMS helps detect and deploy these security updates. SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with SUSFP use MBSA version 1.2.1 technology for detection. Therefore, SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack have limitations that resemble the limitations of MBSA version 1.2.1.

For more information about SMS, visit the following Microsoft Web site:

The SUS Feature Pack together with the Extended Security Update Inventory Tool is required to detect all the security updates on Microsoft Windows and on other affected Microsoft products.

For more information about the limitations of the SUS Feature Pack, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use ITMU to detect and to deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Microsoft Web site:

System Center Configuration Manager 2007 uses WSUS 3.0 for detection and deployment of these security updates. Therefore, anything that is supported by WSUS 3.0 is also supported by System Center Configuration Manager 2007.

Back to the top

Back to the top

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

For enterprise customers, support for security updates is available through your usual support contacts.

Back to the top

File information

The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported Itanium-based editions of Windows Server 2008

For all supported x64-based editions of Windows Vista or Windows Server 2008

For all supported 32-bit editions of Windows Vista or Windows Server 2008

For all supported x64-based editions of Windows Server 2003 or Windows XP Professional

For all supported Itanium-based editions of Windows Server 2003

For all supported 32-bit editions of Windows Server 2003

For all supported 32-bit editions of Windows XP

Back to the top

This article contains download and support information, installation notes, and general usage information about Network Monitor 3. Network Monitor 3.1 is the latest version.

Back to the top

Download and support information

To download Network Monitor 3.1 visit the following Microsoft Web sites:

Support information for Network Monitor 3 is located at the following Microsoft Connect Web site:

You must sign in to the Web site by using a Windows Live ID. After you sign in, you can apply to participate in the program. To do this, in the Options column of the table, click Apply next to Network Monitor 3. After you enroll in the program, you have access to newsgroups, and you can submit bug reports.

Installation notes

Network Monitor 3.1 can co-exist with earlier versions of Network Monitor. By default, Network Monitor 3.1 is installed in the %Program Files% Microsoft Network Monitor 3.0 folder. Therefore, conflicts do not occur if an earlier version is installed in a different folder on the computer. When you install Network Monitor 3.1, Network Monitor 3 is uninstalled.

Network Monitor 3.1 includes a new driver for Windows Vista-based computers. This new driver supports new features of the Network Driver Interface Specification (NDIS) 6.0 driver. If you are using tools that rely on Network Monitor 2.x NPPTools, the tools will no longer work. To capture network data in Windows Vista, you must use Network Monitor 3.1. Network Monitor 2.x does not capture network data correctly in Windows Vista.

Suggested hardware to run Network Monitor 3.1 is listed as follows:

•	1 GHz or faster processor
•	1 GB or more memory
•	25 MB free space on the hard disk, and additional hard disk space to store capture files

Network Monitor 3.1 is supported on the following operating systems:

•	Windows Vista
•	Microsoft Windows XP
•	Microsoft Windows Server 2003

Warnings and cautions

Currently, we do not recommend that you run Network Monitor 3 on production systems. In scenarios where load is something to consider, use the command-line version of Network Monitor 3 to capture network data. The command-line version is Nmcap.exe. For more information about Nmcap.exe, see the Nmcap.exe command-line tool section.

Network Monitor 3 may consume lots of system resources. Some things to consider are listed as follows.

•	Disk space When you start a capture session, Network Monitor 3 stores frames in a sequence of capture files that are located in the Temp folder. By default, the size of each capture file is 20 MB. By default, if you do not stop the capture session, Network Monitor 3 continues to store capture files in the Temp folder until the free hard disk space on the computer is less than 2 percent. Then, Network Monitor 3 stops the capture session. You can configure the capture file size, the location where the capture files are stored, the free hard disk space limit, and other capture options. To do this, on the Tools menu, point to Options, and then click the Capture tab.
•	Memory use In addition to capturing data, Network Monitor 3 assigns properties to frames, and then uses the properties to group the frames into conversations. Network Monitor 3 displays the conversations and the associated frames in a tree structure in the Network Conversations pane. The Conversations feature of Network Monitor 3 significantly increases memory use. This may cause the computer to become unresponsive. By default, the Conversations feature is turned off. Some higher-level protocol filters require conversation properties. To turn on the Conversations feature, click the Start Page tab, and then click to select the Enable Conversations check box.
•	Processor utilization The Conversations feature of Network Monitor 3 may significantly increase processor utilization when lots of frames are processed. By default, the Conversations feature is turned off, as mentioned in the Memory use section.

General usage

General usage information for Network Monitor 3 is listed as follows.

•	Capture network data As mentioned earlier, Network Monitor 3 may consume lots of system resources. Therefore, if you want to minimize the effect on system resources that may occur when you use Network Monitor 3 to capture data, use the Nmcap.exe command-line tool to capture data. Network Monitor 3 enables you to collect network data and to view the network data in real time as the data is captured. To start a capture session in Network Monitor 3, click the Start Page tab, click Create a new capture tab, and then either click the Start Capture button, or press F10.
•	Filters Network Monitor 3 uses a simple syntax that is expression-based to filter frames. All frames that match the expression are displayed to the user. For more information about filters, do any of the following: • View the topics in the Using Filters section of the Network Monitor 3 User’s Guide. To do this, on the Help menu, click Contents, and then double-click Using Filters. • On the Help menu, point to How Do I , and then click Use Filters. • Use the Capture Filter tab or the Display Filter tab to view standard filters.
•	Conversations By default, the Conversations feature is turned off. This is the default setting because the Conversations feature can consume lots of memory, especially in scenarios when you capture data for long periods of time. To turn on the Conversations feature, click the Start Page tab, and then click to select the Enable Conversations check box. When you turn on the Conversations feature, frames are grouped and displayed in the Network Conversations pane in a tree structure according to the conversations to which they belong. For example, TCP data that uses the same source port and the same destination port is organized into a group. When you click a node in the Network Conversations pane, the corresponding conversation filter is automatically applied to the frames in the Frame Summary pane. Only frames that belong to that particular conversation are displayed.
•	Nmcap.exe command-line tool The Nmcap.exe command-line tool enables you to configure when you want to start a capture session or to stop a capture session. You can also use the Nmcap.exe command-line tool to created chained captures. Chained captures enable you to create multiple capture files. However, the size of the capture files remains small.
•	Network Parsing Language (NPL) Network Monitor 3 parsers are written in a language specifically to make parser development more straightforward. This also provides a level of protection against potential exploitation from malicious code that may occur if parsers were created as DLL files. NPL provides access to parsers. You can view or modify the parsers that are included in Network Monitor 3.

Common issues

Common issues include the following:

•

Protocols may not parse correctly. This issue may occur if either of the following conditions is true: • The Conversations feature is turned off. Certain protocols depend on conversation properties to store state values that may be needed in later frames. For example, TCP needs conversations to store information about retransmitted frames. The filter for TCP Retransmits will not work unless the Conversations feature is enabled. Similarly, the Server Message Block (SMB) protocol cannot translate the response to a Transact command, because the response does not contain the original command. The information is saved in conversation properties. • The parser and the associated protocol may be available under the Microsoft Communications Protocol Program (MCPP) and the Microsoft Work Group Server Protocol Program (WSPP). To learn more about how to become a licensee, visit the following Microsoft Web site: http://www.microsoft.com/about/legal/intellectualproperty/protocols/mcpp.mspx (http://www.microsoft.com/about/legal/intellectualproperty/protocols/mcpp.mspx) These parsers are considered confidential Microsoft intellectual property and are not distributed publicly. Therefore, these parsers are not part of the publicly-released version of Network Monitor 3

•

You receive one of the following error messages when you run Network Monitor 3 on a Windows Vista-based computer: None of the network adapters are bound to the Netmon driver This network adapter is not configured to capture with Network Monitor This issue occurs if either of the following conditions is true: • You are not running Network Monitor 3 as administrator. • You are not a member of the Netmon Users group. For more information, see the Network Monitor 3 releases notes or see the Operating on Windows Vista topic in Network Monitor 3 Help.

Back to the top

Back to the top

This guidance contains recommendations that are based on the kinds of scenarios that may exist in various Microsoft operating system environments. This guidance includes how to use tools such as the following tools:

•	Windows Update
•	Microsoft Update
•	Office Update
•	The Microsoft Baseline Security Analyzer (MBSA)
•	Windows Server Update Services (WSUS)
•	Microsoft System Center Configuration Manager
•	Microsoft Systems Management Server (SMS)
•	The Extended Security Update Inventory Tool

This article describes the detection and deployment guidance for the security release that is dated August 12, 2008.

Back to the top

Detection and deployment

Environments that detect and deploy security updates by using Windows Update, Microsoft Update, Office Update, and Mactopia

Security updates that were released on August 12, 2008 are available through the following Web sites. Any exceptions are described in each Web site section. The products that are supported by each Web site are also listed.

NoteNot every update is available on every Web site that is listed here.

Windows Update

The products that are supported by this Web site are as follows:

•	Microsoft Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008

Microsoft Update

The products that are supported by this Web site are as follows:

•	Microsoft Internet Security and Acceleration Server 2004
•	Microsoft Internet Security and Acceleration Server 2006
•	Microsoft Exchange 2000 Server
•	Microsoft Exchange Server 2003
•	Microsoft Exchange Server 2007
•	Microsoft Office 2002
•	Microsoft Office 2003
•	The 2007 Microsoft Office system
•	Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008
•	Microsoft SQL Server 2005
•	Microsoft Forefront Client Security
•	Microsoft Visual Studio 2005

General exceptions

•	Microsoft Update does not support SQL 7.0 or Microsoft Date Engine (MSDE) 1.0.
•	Microsoft Update does not support Office 2000 components.
•	Microsoft Update does not support any Apple Macintosh products.
•	Microsoft Update does not support MSN Messenger or Windows Live Messenger.

Specific exceptions

•

955702 (MS08-050) – Microsoft Update only supports Windows Messenger 4.7 on Windows XP Service Pack 2 (SP2) and on Windows XP Service Pack 3 (SP3). No other versions of Windows are supported. Windows Messenger 5.1 is not supported.

Office Update

The products that are supported by this Web site are as follows:

•	Office 2000
•	Office 2002
•	Office 2003
•	The 2007 Office system

General exceptions

•	Office Update does not support 2007 Office components when they are installed on computers that are running Windows Vista or Windows Server 2008. You must use Microsoft Update instead.
•	Office Update does not support any Macintosh products.

Mactopia

The products that are supported by this Web site are as follows:

•	Microsoft Office 2001 for Mac
•	Microsoft Office 2004 for Mac
•	Microsoft Office X for Mac
•	Microsoft Office 2008 for Mac

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 2.1

You can detect security updates that were released on August 12, 2008 if you use MBSA version 2.1.

NoteMBSA version 2.1 is now released and fully supports security and vulnerability assessment scans on Windows Vista and on Windows Server 2008.

General exceptions

•	MBSA version 2.1 does not support SQL 7.0 or MSDE 1.0.
•	MBSA version 2.1 does not support any Office 2000 components.
•	MBSA version 2.1 does not support any Macintosh products.
•	MBSA version 2.1 does not support Microsoft Works 8 when using an offline scan. For more information, see the Offline and Online scans section, later in this section.
•	MBSA version 2.1 does not support MSN Messenger or Windows Live Messenger.
•	MBSA version 1.2.1 and 2.0.1 are no longer supported.

Specific exceptions

•	955702 (MS08-050) – MBSA only supports Windows Messenger 4.7 on Windows XP SP2 and on Windows XP SP3. No other versions of Windows are supported. Windows Messenger 5.1 is not supported.
•	924090 (MS08-044) – MBSA only supports detection of Microsoft Works when doing an online scan. For more information, see the Offline and Online scans section, later in this section.

Offline and Online scans

•	Online scan This is when the system that is scanned by MBSA 2.1 has connectivity to Microsoft Update. This is shown in the completed scan report.
•	Offline scan This is when the system that is scanned by MBSA 2.1 is managed by WSUS or in an offline secure environment that forces the system to use the WSUSSCN2.CAB offline catalog.

Environments that detect and deploy security updates by using Windows Server Update Services (WSUS)

You can detect and deploy security updates that were released on August 12, 2008 if you use any of the following items:

•	WSUS 2.0 Service Pack 1 (SP1)
•	WSUS 3.0
•	WSUS 3.0 SP1

General exceptions

•	WSUS does not support SQL 7.0 or MSDE 1.0.
•	WSUS does not support Microsoft Works 8.
•	SUS 1.0 SP1 is no longer supported. It will not receive security updates.

Specific exceptions

•

955702 (MS08-050) – WSUS only supports Windows Messenger 4.7 on Windows XP SP2 and on Windows XP SP3. No other versions of Windows are supported. Windows Messenger 5.1 is not supported.

Environments that detect and deploy security updates by using SMS 2.0, SMS 2003, or SCCM 2007

You can detect and deploy all security updates that were released on August 12, 2008 if you use any of the following items:

•	Systems Management Server (SMS) 2.0 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with Inventory Tool for Microsoft Updates (ITMU)
•	System Center Configuration Manager (SCCM) 2007

General exceptions

•	Microsoft Systems Management Server 2003 SP3 includes support for, and is required for, Windows Vista and Windows Server 2008 manageability.
•	SMS 2003 together with ITMU and SCCM 2007 do not support the following products: • SQL 7.0 • MSDE 1.0 • Microsoft Works 8
•	SMS together with the SUS Feature Pack do not support the following products: • MSDE 1.0 • SQL 2005 • SQL 2008 • Exchange 2007 • Microsoft Works 8 • The 2007 Office system • Windows Internet Explorer 7 • Windows Vista • Windows Server 2008 • Any x64-based versions of Windows or of SQL • Any Itanium-based versions of Windows or of SQL
•	The SMS SUS Feature Pack, SMS ITMU, and SCCM do not support any Macintosh products.

Specific exceptions

•

955702 (MS08-050) – SMS SUSFP, SMS ITMU, and SCCM 2007 only support Windows Messenger 4.7 on Windows XP SP2 and on Windows XP SP3. No other versions of Windows are supported. Windows Messenger 5.1 is not supported.

NoteThe SMS SUS Feature Pack requires the Extended Security Update Inventory Tool to detect all the security updates.

To obtain the Extended Security Update Inventory Tool, visit the following Microsoft Web site:

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

NoteTo simplify this table, items that were listed under the general exceptions heading for each detection and deployment technology are not included.

For example, the SMS SUS Feature Pack column in this table may include a Yes. However, the security bulletin lists a Windows Vista component as affected. Previously, we would have stated in the table that the SMS SUS Feature Pack partly supported the deployment of the security update because the SMS SUS Feature Pack does not support Windows Vista components. Currently, we no longer account for that specific exception in the table because the exception is always listed as a general exception.

Security update	Bulletin	Component	Office Update	Windows Update	Microsoft Update	MBSA 2.1	WSUS 2.0 and WSUS 3.0	SMS SUS Feature Pack	SMS Inventory Tool for Microsoft Updates	System Center Configuration Manager 2007
			Detect and deploy	Detect and deploy	Detect and deploy	Detect only	Detect and deploy	Detect and deploy	Detect and deploy	Detect and deploy
955617	MS08-041	Access	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
955048	MS08-042	Word	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
954066	MS08-043	Excel	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
924090	MS08-044	Office Filters	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
953838	MS08-045	Internet Explorer	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes	Yes
952954	MS08-046	Windows ICM	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes	Yes
953733	MS08-047	IPsec	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes	Yes
951066	MS08-048	Outlook Express/Windows Mail	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes	Yes
950974	MS08-049	Event System	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes	Yes
955702	MS08-050	Windows Messenger	Not applicable	Partly, see the Windows Update section	Partly, see the Microsoft Update section	Partly, see the MBSA section	Partly, see the WSUS section	Partly, see the SMS section	Partly, see the SMS Update section	Partly, see the SCCM section
949785	MS08-051	PowerPoint	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes

Rereleased security updates

There are no rereleases this month.

Back to the top

Frequently asked questions

What is Microsoft doing to provide guidance about how to deploy these updates?

We encourage system administrators to join the monthly technical Webcast to learn more about security updates. The Webcast for this security update airs on August 13, 2008 at 11:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

What other information should I know about MBSA?

For more information about the programs that MBSA currently supports, visit the following Microsoft TechNet Web site:

Can I use SMS or System Center Configuration Manager to determine whether the updates are required?

Yes. SMS helps detect and deploy these security updates. SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with SUSFP use MBSA version 1.2.1 technology for detection. Therefore, SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack have limitations that resemble the limitations of MBSA version 1.2.1.

For more information about SMS, visit the following Microsoft Web site:

The SUS Feature Pack together with the Extended Security Update Inventory Tool is required to detect all the security updates on Microsoft Windows and on other affected Microsoft products.

For more information about the limitations of the SUS Feature Pack, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use ITMU to detect and deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Microsoft Web site:

System Center Configuration Manager 2007 uses WSUS 3.0 for detection and deployment of these security updates. Therefore, anything that is supported by WSUS 3.0 is also supported by System Center Configuration Manager 2007.

Back to the top

The Windows Script Host object model provides the WshShell.Exec method, which allows script to run an application in a child command-shell. The Exec method returns a WshScriptExec object, which exposes the StdOut and StdErr properties. These properties provide access to information the child process has written to its standard output or standard error streams.

Back to the top

A console application’s StdOut and StdErr streams share the same internal 4KB buffer. In addition, the WshScriptExec object only provides synchronous read operations on these streams. Synchronous read operations introduce a dependency between the calling script reading from these streams and the child process writing to those streams, which can result in deadlock conditions.

When the caller reads from the redirected stream of a child process, it is dependent on the child. The caller waits on the read operation until the child writes to the stream or closes the stream. When the child process writes enough data to fill its redirected stream, it is dependent on the parent. The child process waits on the next write operation until the parent reads from the full stream or closes the stream. The deadlock condition results when the caller and child process wait on each other to complete an operation, and neither can proceed. Generally, this occurs if the spawned application is writing to both the StdOut and StdErr streams, while the calling script is architected so that it reads only from one of them.

Back to the top

These are several possible workarounds.

1. Architect the script so that it reads from both StdOut and StdErr, which prevents the buffer from filling up.

2. Redirect the console program output to a disk file (or files), and then read the file(s). When spawning the console application, you can use the > operator to output the results of the operation to a file. You could then use the FileSystemObject to read the output files back in for processing.

FileSystemObject Object
http://msdn.microsoft.com/en-us/library/z9ty6h50(VS.85).aspx (http://msdn.microsoft.com/en-us/library/z9ty6h50(VS.85).aspx)

3. Instead of using the WScript object model for reading the StdOut/StdErr streams, write a COM component that implements asynchronous reads of these streams; and then call the COM component from your script. For example, the System.Diagnostics.Process class in the Microsoft .NET Framework exposes an asynchronous model for reading the StdOut/StdErr streams. Therefore; it is possible to write a COM callable component which utilizes the Microsoft .NET Framework which could raise event back to the script on read operations.

Process.StandardOutput Property
http://msdn.microsoft.com/en-us/library/system.diagnostics.process.standardoutput.aspx (http://msdn.microsoft.com/en-us/library/system.diagnostics.process.standardoutput.aspx)

Process.StandardError Property
http://msdn.microsoft.com/en-us/library/system.diagnostics.process.standarderror.aspx (http://msdn.microsoft.com/en-us/library/system.diagnostics.process.standarderror.aspx)

 

Back to the top

Steps to Reproduce Problem
=====================

1. Create a new text file with the following script.

‘This script will simulate the work done by a console application.
‘This just iterates 500 times, writing data to both the StdOut and StdErr streams.
Dim i
For i = 1 to 500
   WScript.StdOut.WriteLine StdOut: & i
   WScript.StdErr.WriteLine StdErr: & i
Next

2. Save the file as scriptworker.vbs.
3. Create a new text file with the following script.

Dim WSHShell
Dim oExec

Set WSHShell = CreateObject(WScript.Shell)
Set oExec = WSHShell.Exec(cscript scriptworker.vbs)
With oExec
   Do While .Status = 0
      WScript.Sleep 10
      Do While Not .StdOut.AtEndOfStream
         WScript.Echo .StdOut.ReadLine
      Loop
   Loop
End With

4. Save this file as scriptspawn.vbs, and place it in the same folder with scriptworker.vbs.
5. Start a new command prompt (cmd.exe).
6. Navigate to the folder where you copied scriptworker.vbs and scriptspawn.vbs.
7. Run the following command:

cscript.exe scriptspawn.vbs

Note that the script hangs after outputting just over 300 items, and you have to manually kill the process by pressing CTRL+C or CTRL+BREAK.

Steps to Work Around Problem
=======================

This example demonstrates how to change the script to read from both StdOut and StdErr, which prevents the buffer from filling up.

1. Follow the steps in the Steps to Reproduce Problem section above.
2. Use the following script for scriptspawn.vbs, rather than the script shown in the Steps to Reproduce Problem section.

Dim WSHShell
Dim oExec

Set WSHShell = CreateObject(WScript.Shell)
Set oExec = WSHShell.Exec(cscript scriptworker.vbs)
With oExec
   Do While .Status = 0
      WScript.Sleep 10
      Do While Not .StdOut.AtEndOfStream
         WScript.Echo .StdOut.ReadLine
        
         ‘Check the .StdErr to see if it is at the end of its
         ‘stream. If not, call ReadLine on it
         If Not .StdErr.AtEndOfStream Then
            .StdErr.ReadLine
         End If
      Loop
   Loop
End With

Note that when running this script, it does not hang and successfully reads all data from the StdOut property.

Back to the top

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Back to the top