This guidance contains recommendations that are based on the types of scenarios that may exist in various Microsoft operating system environments. This guidance includes how to use tools such as the following tools:

•	Windows Update
•	Microsoft Update
•	Office Update
•	The Microsoft Baseline Security Analyzer (MBSA)
•	Windows Server Update Services (WSUS)
•	Microsoft System Center Configuration Manager
•	Microsoft Systems Management Server (SMS)
•	The Extended Security Update Inventory Tool

This article describes the detection and deployment guidance for the security release that is dated March 11, 2008.

Back to the top

Detection and deployment

Environments that detect and deploy security updates by using Windows Update, Microsoft Update, Office Update, and Mactopia

Security updates that were released on March 11, 2008 are available through the following Web sites. Any exceptions are described in each Web site section. The products that are supported by each Web site are also listed.

Note Not every update is available on every Web site that is listed here.

Windows Update

The products that are supported by this Web site are as follows:

•	Microsoft Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008

Microsoft Update

The products that are supported by this Web site are as follows:

•	Microsoft Internet Security and Acceleration Server 2004
•	Microsoft Internet Security and Acceleration Server 2006
•	Microsoft Exchange 2000 Server
•	Microsoft Exchange Server 2003
•	Microsoft Exchange Server 2007
•	Microsoft Office 2002
•	Microsoft Office 2003
•	The 2007 Microsoft Office system
•	Windows 2000
•	Windows XP
•	Windows Server 2003
•	Windows Vista
•	Windows Server 2008
•	Microsoft SQL Server 2005
•	Microsoft Forefront Client Security
•	Microsoft Visual Studio 2005

General exceptions

•	Microsoft Update does not support Office 2000 components.
•	Microsoft Update does not support any Apple Macintosh products.

Specific exceptionsMicrosoft Update does not support the part of security update 933103 that involves the following products:

•	Microsoft Visual Studio 2002
•	Microsoft Visual Studio 2003
•	Microsoft BizTalk Server 2000
•	Microsoft BizTalk Server 2002
•	Microsoft Commerce Server 2000
•	Microsoft Internet Security and Acceleration (ISA) Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Office Update

The products that are supported by this Web site are as follows:

•	Office 2000
•	Office 2002
•	Office 2003
•	The 2007 Office system

General Exceptions

•	Office Update does not support 2007 Office components when they are installed on computers that are running Windows Vista or Windows Server 2008. You must use Microsoft Update instead.
•	Office Update does not support any Macintosh products.

Mactopia

The products that are supported by this Web site are as follows:

•	Microsoft Office 2001 for Mac
•	Microsoft Office 2004 for Mac
•	Microsoft Office X for Mac
•	Microsoft Office 2008 for Mac

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 2.0.1

You can detect security updates that were released on March 11, 2008 if you use MBSA version 2.0.1.

General Exceptions

•	MBSA version 2.0.1 does not support any Office 2000 components.
•	MBSA version 2.0.1 does not support any Macintosh products.
•	MBSA version 2.0.1 is not supported on Windows Vista. However, MBSA version 2.0.1 supports remote scans of computers that are running Windows Vista. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 931943 (/Feedback.aspx?kbNumber=931943/)Microsoft Baseline Security Analyzer (MBSA) support for Windows Vista
•	MBSA version 1.2.1 is no longer supported. It will not detect security updates that were released after October 2007.

Specific exceptionsMBSA version 2.0.1 does not support the part of security update 933103 that involves the following products:

•	Visual Studio 2002
•	Visual Studio 2003
•	BizTalk Server 2000
•	BizTalk Server 2002
•	Commerce Server 2000
•	ISA Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that detect and deploy security updates by using Windows Server Update Services (WSUS)

You can detect and deploy security updates that were released on March 11, 2008 if you use any of the following items:

•	WSUS 2.0 Service Pack 1 (SP1)
•	WSUS 3.0
•	WSUS 3.0 Service Pack 1 (SP1)

General Exceptions

•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Office 2000 components.
•	WSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support any Macintosh products.
•	SUS 1.0 Service Pack 1 (SP1) is no longer supported. It will not receive security updates.

Specific exceptionsWSUS 2.0 SP1, WSUS 3.0, and WSUS 3.0 SP1 do not support the part of security update 933103 that involves the following products:

•	Visual Studio 2002
•	Visual Studio 2003
•	BizTalk Server 2000
•	BizTalk Server 2002
•	Commerce Server 2000
•	ISA Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that detect and deploy security updates by using SMS 2.0, SMS 2003, or System Center Configuration Manager 2007

You can detect and deploy all security updates that were released on March 11, 2008 if you use any of the following items:

•	Systems Management Server (SMS) 2.0 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with the SUS Feature Pack
•	Systems Management Server (SMS) 2003 together with Inventory Tool for Microsoft Updates (ITMU)
•	System Center Configuration Manager 2007

General Exceptions

•	SMS ITMU and System Center Configuration Manager do not support any Office 2000 components.
•	SMS together with the SUS Feature Pack does not support the following products: • The 2007 Office system • Windows Internet Explorer 7 • Windows Vista • Windows Server 2008 • Any x64-based versions of Windows • Any Itanium-based versions of Windows
•	The SMS SUS Feature Pack, SMS ITMU, and System Center Configuration Manager do not support any Macintosh products.

Specific exceptionsWSUS 2.0, WSUS 3.0, and WSUS 3.0 SP1 do not support the part of security update 933103 that involves the following products:

•	Visual Studio 2002
•	Visual Studio 2003
•	BizTalk Server 2000
•	BizTalk Server 2002
•	Commerce Server 2000
•	ISA Server 2000

For more information about security update 933103, click the following article number to view the article in the Microsoft Knowledge Base:

Note The SMS SUS Feature Pack requires the Extended Security Update Inventory Tool to detect all the security updates.

To obtain the Extended Security Update Inventory Tool, visit the following Microsoft Web site:

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

Note To simplify this table, items that were listed under the General Exceptions heading for each detection and deployment technology are not included.

For example, the Microsoft Update column in this table may include a Yes. However, the security bulletin lists an Office 2000 component as affected. Previously, we would have stated in the table that Microsoft Update partially supported deployment of the security update. However, no Office 2000 components are supported by Microsoft Update. Therefore, we no longer account for that product in the table because it is always listed as a general exception.

Security update	Bulletin	Component	Office Update	Windows Update	Microsoft Update	MBSA 2.0.1	WSUS 2.0 and WSUS 3.0	SMS SUS Feature Pack	SMS Inventory Tool for Microsoft Updates	System Center Configuration Manager 2007
			Detect and deploy	Detect and deploy	Detect and deploy	Detect only	Detect and deploy	Detect and deploy	Detect and deploy	Detect and deploy
949029	MS08-014	Microsoft Excel	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
949031	MS08-015	Microsoft Outlook	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
949030	MS08-016	Office	Yes	Not applicable	Yes	Yes	Yes	Yes	Yes	Yes
933103	MS08-017	Microsoft Office Web Components	Partially. See Office Update section.	Not applicable	Partially. See Microsoft Update section.	Partially. See MBSA section.	Partially. See WSUS section.	Yes	Partially. See SMS section.	Partially. See System Center Configuration Manager section.

Rereleased security updates

There are no rereleases this month.

Back to the top

Frequently asked questions

What is Microsoft doing to provide guidance about how to deploy these updates?

We encourage system administrators to join the monthly technical Webcast to learn more about security updates. The Webcast for this security update airs on Thursday, March 13, 2008 12:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

What other information should I know about MBSA?

For more information about the programs that MBSA currently does not detect, click the following article number to view the article in the Microsoft Knowledge Base:

If you installed a program that is listed in the Affected software section of a security bulletin, you may have to manually determine whether you must install the required security update. For more information about MBSA, visit the following Microsoft Web site:

Can I use SMS or System Center Configuration Manager to determine whether the updates are required?

Yes. SMS helps detect and deploy these security updates. SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with SUSFP use MBSA version 1.2.1 technology for detection. Therefore, SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack have limitations that resemble the limitations of MBSA version 1.2.1.

For more information about SMS, visit the following Microsoft Web site:

The SUS Feature Pack together with the Extended Security Update Inventory Tool is required to detect all the security updates on Microsoft Windows and on other affected Microsoft products.

For more informationabout the limitations of the SUS Feature Pack, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 together with the SUS Feature Pack and SMS 2003 together with the SUS Feature Pack also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use ITMU to detect and to deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Microsoft Web site:

System Center Configuration Manager 2007 uses WSUS 3.0 for detection and deployment of these security updates. Therefore, anything that is supported by WSUS 3.0 is also supported by System Center Configuration Manager 2007.

Back to the top

Back to the top

Back to the top

Detection and deployment

Environments that detect and that deploy security updates by using Windows Update, Microsoft Update, and Office Update

Security updates that were released on June 12, 2007 are available through the following Web sites. Any exceptions are in the following list. The products that are supported by each Web site are also listed.

•	Microsoft Windows Update http://update.microsoft.com/windowsupdate (http://update.microsoft.com/windowsupdate) • Windows 2000, Windows XP, and Windows Server 2003
•	Microsoft Update http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate) • Windows 2000, Windows XP, and Windows Server 2003 • Microsoft Office XP and Office 2003 • Microsoft Exchange 2000 Server and Exchange Server 2003 • Microsoft Internet Security and Acceleration Server 2004 • Microsoft SQL Server 2005
•	Office Update http://officeupdate.microsoft.com (http://officeupdate.microsoft.com) • Office 2000, Office XP, and Office 2003
•	Mactopia http://www.microsoft.com/mac (http://www.microsoft.com/mac/) • Office 2001 for Mac • Office X for Mac • Office 2004 for Mac

Note Not every update is available on every Web site that is listed.

Environments that detect security updates by using MBSA version 1.2.1 or MBSA version 2.0.1

Microsoft Baseline Security Analyzer (MBSA) version 1.2.1 contains an integrated version of the Office Detection Tool (ODT). If you use MBSA 1.2.1 or MBSA version 2.0.1 to detect security updates, you can detect all the security updates that were released on June 12, 2007. Any exceptions are in the following list.

Note The ODT part of MBSA 1.2.1 is limited to local scans only.

Note MBSA 1.2.1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

Note MBSA 2.0.1 is not supported on Windows Vista. However, MBSA 2.0.1 supports remote scans of computers that are running Windows Vista. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Environments that detect and that deploy security updates by using Software Update Services (SUS) or Windows Server Update Services (WSUS)

If you use SUS, WSUS 2.0, or WSUS 3.0 to detect and to deploy security updates, you can detect most security updates that were released on June 12, 2007. Any exceptions are in the following list.

Note SUS 1.0 SP1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

•	Security update 927051 (security bulletin MS07-030) SUS does not support any part of this security update.
•	Security update 931213 (security bulletin MS07-032) SUS does not support any part of this security update.

Environments that detect and that deploy security updates by using SMS 2.0 together with the Security Update Inventory Tool (SUIT) or SMS 2003 together with the Inventory Tool for Microsoft Updates (ITMU)

If you use Microsoft Systems Management Server (SMS) 2.0 together with SUIT, SMS 2003 together with SUIT, or SMS 2003 together with ITMU to detect and to deploy security updates, you can detect and deploy all security updates that were released on June 12, 2007. Any exceptions are in the following list.

Note SMS together with SUIT does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

•	Security update 931213 (security bulletin MS07-032) SMS SUIT does not support any part of this security update.
•	Security update 929123 (security bulletin MS07-034) SMS SUIT supports this update when you use the Extended Security Update Inventory Tool (ESUIT).

To obtain ESUIT, visit the following Microsoft Web site:

Back to the top

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

Security update

Bulletin

Component

Office Update

Windows Update

Microsoft Update

MBSA 1.2 and the Office Detection Tool

MBSA 2.0.1

SUS

WSUS 2.0 and WSUS 3.0

Enterprise Scan Tool

SMS Security Update Inventory Tool

SMS Inventory Tool for Microsoft Updates

Detect and deploy

Detect and deploy

Detect and deploy

Detect only

Detect only

Detect and deploy

Detect and deploy

Detect only

Detect and deploy

Detect and deploy

927051

MS07-030

Microsoft Visio

Yes

Not applicable

Yes

Yes

Yes

Not applicable

Yes

Not applicable

Yes

Yes

935840

MS07-031

Schannel

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

931213

MS07-032

Windows Vista

Not applicable

Yes

Yes

Not applicable

Yes

Not applicable

Yes

Not applicable

Not applicable

Yes

933566

MS07-033

Windows Internet Explorer

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

929123

MS07-034

Microsoft Outlook Express

Not applicable

Yes

Yes

No

Yes

Yes

Yes

Yes

Yes, with ESUIT

Yes

935839

MS07-035

Win32 API

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

Back to the top

Rereleased security updates

Back to the top

Frequently asked questions

Q1: What is Microsoft doing to provide guidance about how to deploy these updates?

A1: Microsoft encourages system administrators to join the monthly technical webcast to learn more about security updates. The webcast for this security update airs on June 13, 2007 at 11:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

Q2: Is the Enterprise Scan Tool (EST) cumulative for SMS like ESUIT is cumulative for SMS?

A2: No, the EST is not cumulative. There are no plans to make the EST cumulative.

Q3: Can I use MBSA to determine whether these updates are required?

A3: Yes, you can use MBSA 1.2.1 and MBSA 2.0.1 to fully detect the need for the following security updates that were released on June 12, 2007.

Microsoft Knowledge Base article number	Bulletin ID	Component	Detection note
931213	MS07-032	Windows Vista	See the MBSA section
929123	MS07-034	Outlook Express	See the MBSA section

For more information about the programs that MBSA currently does not detect, click the following article numbers to view the articles in the Microsoft Knowledge Base:

You may have installed a program that is listed in the Affected software section of a security bulletin that is mentioned in the related article. In this case, you may have to manually determine whether you must install the required security update. For more information about MBSA, visit the following Microsoft Web site:

Q4: Which security updates require that I use the EST together with MBSA 1.2.1 to determine which systems on my network are vulnerable?

A4: The following security update requires that you use the EST together with MBSA to determine which systems on the network are vulnerable.

Microsoft Knowledge Base article number	Bulletin ID	Component
929123	MS07-034	Outlook Express

Q5: Can I use SMS to determine whether the updates are required?

A5: Yes, SMS helps detect and deploy these security updates. SMS 2.0 and SMS 2003 together with SUIT use MBSA 1.2.1 technology for detection. Therefore, SMS 2.0 and SMS 2003 together with SUIT have limitations that resemble the limitations of MBSA 1.2.1. For more information about SMS, visit the following Microsoft Web site:

SUIT together with ESUIT are required for detection of all the security updates on Microsoft Windows and on other affected Microsoft products. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 and SMS 2003 together with SUIT also use the Microsoft Office Inventory Tool to detect the required security updates for Microsoft Office programs such as Microsoft Word. SMS 2003 customers can also use ITMU to detect and deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Web site:

Back to the top

Note You can delete multiple local user accounts at the same time by using Computer Management in Microsoft Windows NT Server 4.0 and in Microsoft Windows NT 4.0 Workstation.

Instead of using Computer Management, you can use the AddUsers utility together with the /e switch to delete multiple local user accounts at the same time.

For more information about the AddUsers utility, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Back to the top

Detection and deployment

Environments that detect and that deploy security updates by using Windows Update, Microsoft Update, and Office Update

Security updates that released on April 10, 2007 are available through the following Web sites. Any exceptions are in the following list. The products that are supported by each Web site are also listed.

•	Microsoft Windows Update http://update.microsoft.com/windowsupdate (http://update.microsoft.com/windowsupdate) • Windows 2000, Windows XP, Windows Server 2003 • Security update 925939 (security bulletin MS07-018) Windows Update does not support any part of this security update.
•	Microsoft Update http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate) • Windows 2000, Windows XP, and Windows Server 2003 • Microsoft Office XP and Office 2003 • Microsoft Exchange 2000 and Exchange 2003 • Internet Security and Acceleration Server 2004 • Microsoft SQL Server 2005 • Security update 925939 (security bulletin MS07-018) Microsoft Update does not support the Microsoft Content Management Server (CMS) 2001 part of this security update. The CMS 2001 part of this security update can be detected and deployed from the Office Update site.
•	Office Update http://officeupdate.microsoft.com (http://officeupdate.microsoft.com) • Office 2000, Office XP, and Office 2003
•	Mactopia http://www.microsoft.com/mac (http://www.microsoft.com/mac) • Office 2001 for Mac • Office X for Mac • Office 2004 for Mac

Note Not every update is available on every Web that is site listed.

Environments that detect security updates by using Microsoft Baseline Security Analyzer (MBSA) version 1.2.1 or MBSA version 2.0.1

MBSA version 1.2.1 contains an integrated version of the Office Detection Tool (ODT). If you use MBSA 1.2.1 or MBSA version 2.0.1 to detect security updates, you can detect all the security updates that released on April 10, 2007. Any exceptions are in the following list.

Note The ODT part of MBSA 1.2.1 is limited to local scans only.

Note MBSA 1.2.1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

Note MBSA 2.0.1 is not supported on Windows Vista. However, MBSA 2.0.1 supports remote scans of computers that are running Windows Vista. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

If you use Software Update Services (SUS) or Windows Server Update Services (WSUS) to detect and to deploy security updates, you can detect most security updates that released on April 10, 2007. Any exceptions are in the following list.

Note SUS 1.0 SP1 does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

•	Security update 925939 (security bulletin MS07-018) SUS does not support any part of this security update. WSUS does not support the CMS 2001 part of this security update.

Environments that detect and that deploy security updates by using SMS 2.0 together with the Security Update Inventory Tool or SMS 2003 together with the Inventory Tool for Microsoft Updates

If you use Microsoft Systems Management Server (SMS) 2.0 together with the Security Update Inventory Tool (SUIT), SMS 2003 together with SUIT, or SMS 2003 together with the Inventory Tool for Microsoft Updates (ITMU), you can detect and deploy all the security updates that were released on April 10, 2007. There are no exceptions this month. Any exceptions are in the following list.

Note SMS together with SUIT does not support Windows Vista, any x64-based versions of Windows, or any Itanium-based versions of Windows.

•	Security update 925939 (security bulletin MS07-018) SMS ITMU does not support the CMS 2001 part of this security update. The CMS 2001 part of this security update can be detected and deployed from the Office Update site.

To obtain ESUIT, visit the following Microsoft Web site:

Back to the top

Summary of detection and deployment guidance

The following table summarizes the detection and deployment guidance for each new security update.

Security update

Bulletin

Component

Office Update

Windows Update

Microsoft Update

MBSA 1.2 and the Office Detection Tool

MBSA 2.0.1

SUS

WSUS

Enterprise Scan Tool

SMS Security Update Inventory Tool

SMS Inventory Tool for Microsoft Updates

Detect and deploy

Detect and deploy

Detect and deploy

Detect only

Detect only

Detect and deploy

Detect and deploy

Detect only

Detect and deploy

Detect and deploy

925902

MS07-017

GDI

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

925939

MS07-018

CMS

Yes

Not applicable

Partially, see the MU section

Yes

Partially. See the MBSA section

Not applicable

Partially, see the WSUS section

Not applicable

Yes

Partially, see the SMS section

931261

MS07-019

PNP

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

932168

MS07-020

MS Agent

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

930178

MS07-021

CSRSS

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

931784

MS07-022

KERNEL

Not applicable

Yes

Yes

Yes

Yes

Yes

Yes

Not applicable

Yes

Yes

Back to the top

Rereleased security updates

There are no rereleased security updates this month.

Back to the top

Frequently asked questions

Q1: What is Microsoft doing to provide guidance about how to deploy these updates?

A1: Microsoft encourages system administrators to join the monthly technical webcast to learn more about security updates. The webcast for this security update airs on April 11, 2007 at 11:00 A.M. (Pacific Time). To register, visit the following Microsoft Web site:

Q2: Is the EST cumulative like ESUIT is for SMS?

A2: No, the EST is not cumulative. There are no plans to make EST cumulative.

Q3: Can I use MBSA to determine whether these updates are required?

A3: Yes, you can use MBSA 1.2.1, MBSA 2.0, and MBSA 2.0.1 to fully detect the need for the following security updates that released on April 10, 2007.

Microsoft Knowledge Base number	Bulletin ID	Component	Detection note
925939	MS07-018	CMS	See the MBSA section

For information about the programs that the MBSA currently does not detect, click the following article numbers to view the article in the Microsoft Knowledge Base:

If you installed a program that is listed in the Affected software section of a security bulletin that is mentioned in the related article, you may have to manually determine whether you must install the required security update. For more information about the MBSA, visit the following Microsoft Web site:

Q4: Which security updates require that I use EST together with MBSA to determine which systems on my network are vulnerable?

A4: None of the security updates require that you use the EST together with MBSA to make this determination.

Q5: Can I use SMS to determine whether the updates are required?

A5: Yes, SMS helps detect and deploy these security updates. SMS 2.0 and SMS 2003 together with SUIT use MBSA 1.2.1 technology for detection. Therefore, SMS 2.0 and SMS 2003 with the SUIT have similar limitations to MBSA 1.2.1. For more information about SMS, visit the following Microsoft Web site:

SUIT together with the ESUIT are required for detection of all the security updates on Microsoft Windows and on other affected Microsoft products. For more information about the limitations of SUIT, click the following article number to view the article in the Microsoft Knowledge Base:

SMS 2.0 and SMS 2003 together with SUIT also use the Microsoft Office Inventory Tool to detect security updates that are required for Microsoft Office programs such as Microsoft Word.

SMS 2003 customers can also use the Inventory Tool for Microsoft Updates to detect and deploy security updates. ITMU uses technology from Microsoft Updates. For more information about ITMU, visit the following Web site:

Back to the top

This article describes how to use the Mail Merge Manager that is included in Word 2008 for Mac to create mailing labels or envelopes.

Back to the top

Mailing labels

To use the Mail Merge Manager to create mailing labels, follow these steps:

1. On the View menu, click Print Layout.
2. On the Standard toolbar, click New.

   A new, blank Word document opens. This becomes your main document.

3. On the Tools menu, click Mail Merge Manager.
4. In the Mail Merge Manager, click Create New under Select document, and then click Labels.
5. Under Printer information, click the kind of printer that you use.
6. On the Label products pop-up menu, click the manufacturer of your labels.

   Note For more label products, click Other on the Label products pop-up menu.

7. Under Product number, click the kind of label that you want, and then click OK.

   Note For information about the margins and other characteristics of a label, click Details.

8. In the Mail Merge Manager, click Get List under Select Recipients List, and then click Open Data Source.
9. Locate and then double-click the data source file.
10. In the Edit Labels dialog box, click a field name in the list on the Insert Merge Field pop-up menu. For example, click the FirstName field.

    Word 2008 adds the field name to the Sample label box.

11. Repeat step 10 for each field that you want to appear in your labels.
12. If you want to include postal bar codes on your labels, click Insert Postal Bar Code, select the options that you want, and then click OK.

    Note To return to this dialog box later, in the Mail Merge Manager under Select Recipients List, click Add or remove placeholders on labels.

13. After you add all the fields that you want, click OK.

    The field names are copied into all the labels in your main document.

14. In your main document, edit the first label to add spaces, commas, and carriage returns where you want them.
15. In the Mail Merge Manager, under Select Recipients List, click Fill in the items to complete your document.

    Word applies the formatting that you use for the first label to all the labels.

16. To finish your labels, do one of the following:
    • To print your labels immediately, under Complete Merge in the Mail Merge Manager, click Merge to printer.
    • To create a document that contains your merged labels that you can save to print later, under Complete Merge in the Mail Merge Manager, click Merge to New Document.

Back to the top

Envelopes

To use the Mail Merge Manager to create envelopes, follow these steps:

1. On the View menu, click Print Layout.
2. On the Standard toolbar, click New.

   A new, blank Word document opens. This becomes your main document.

3. On the Tools menu, click Mail Merge Manager.
4. In the Mail Merge Manager, click Create New under Select Document Type, and then click Envelopes.
5. In the Envelope dialog box, make any changes to the return address that you want.

   Do not enter anything (including spaces) in the Delivery address box.

6. Under Printing Options, make any changes that you want, and then click OK.
7. In the Mail Merge Manager, click Get List under Select Recipients List, and then click Open Data Source.
8. Locate and double-click the data source file.
9. In the Mail Merge Manager, click Contacts under Insert Placeholders.
10. Drag a field name from the Contacts list. For example, drag the FirstName field to the envelope’s address box.
11. Repeat step 10 for all the fields that you want to appear on your envelopes.
12. If you want to include postal bar codes on your labels, drag the PostalCode field onto the addressee box.
13. In your main document, edit the addressee box to add spaces and carriage returns where you want them.
14. To finish your envelopes, do one of the following:
    • To print your envelopes immediately, under Complete Merge in the Mail Merge Manager, click Merge to printer.
    • To create a document that contains your merged envelopes that you can save to print later, under Complete Merge in the Mail Merge Manager, click Merge to New Document.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Back to the top

This article describes how to obtain this tool. This article also provides an operational overview of the tool. This overview includes system requirements and command-line parameters. Finally, this article describes the most common problems that you may encounter when you use the tool.

Back to the top

How to obtain the BitLocker Drive Preparation Tool

Windows Vista Ultimate

If you are using Windows Vista Ultimate, follow these steps to obtain the tool:

1.	Click Start, type Windows Update in the Start Search box, and then press ENTER.
2.	Click Check for updates.
3.	Click View available Extras.
4.	Click to select the BitLocker and EFS enhancements check box, and then click Install.

Windows Vista Enterprise

If you are using Windows Vista Enterprise, use the following services to obtain this tool:

•

Microsoft Customer Support Services For a complete list of Microsoft Customer Support Services telephone numbers, visit the following Microsoft Web site:For more information, visit the following Microsoft Web page: http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)

Back to the top

After the tool finishes preparing the drive, you must restart the computer. Then, you can use the Security item in Control Panel to enable BitLocker.

Back to the top

How to prepare the hard disk for BitLocker Drive Encryption

To encrypt drives and to verify boot integrity, BitLocker requires at least two partitions. These two partitions make up a split-load configuration. A split-load configuration separates the main operating system partition from the active system partition from which the computer starts.

The BitLocker Drive Preparation Tool automates the following processes to make the computer ready for BitLocker:

•	Creating the second volume that BitLocker requires
•	Migrating the boot files to the new volume
•	Making the volume an active volume

When the tool finishes, you must restart the computer to change the system volume to the newly created volume. After you restart the computer, the drive will be configured correctly for BitLocker. You may also have to initialize the Trusted Platform Module (TPM) before you turn BitLocker on.

Back to the top

System requirements

To create a new partition or to merge unallocated space with an existing partition, the target system must meet the following requirements:

•	A genuine version of Windows Vista Ultimate or Windows Vista Enterprise must be installed.
•	The active partition must contain boot configuration data and boot files.
•	The target partition must meet the following requirements: • The partition must be on a simple disk that is initialized for basic storage. • The partition must be a primary partition. Extended drives and logical drives are not supported. • The partition must be formatted by using the NTFS file system. • The partition must not be compressed. • The cluster size of the partition must be less than 4 KB or equal to 4 KB. • The partition is not using software spanning, software mirroring, or software RAID. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 314343 (/Feedback.aspx?kbNumber=314343/) Basic storage versus dynamic storage in Windows XP Note This tool works correctly in hardware RAID configurations. • For a split operation, at least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). • For a merge operation, the partition’s total capacity must be at least 1.5 GB. Also, the partition must have at least 800 MB of free disk space.

The following chart shows the target system requirements.

Back to the top

Operational overview

Target system configurations

The BitLocker Drive Preparation Tool supports Windows Vista Ultimate and Windows Vista Ultimate Enterprise. This tool successfully creates a split-load configuration when the active state, the system state and the boot state are all assigned to the same simple volume.

Default operational procedure

When the BitLocker Drive Preparation Tool starts, it tries to create a split-load configuration by using the following methods, in order of preference:

•	Merge unallocated space with a type 0×7 Windows Recovery (WinRE) partition
•	Create a new partition from unallocated space
•	Split an existing partition Note The tool tries to split the current active partition. If this action fails, the tool splits the largest available partition.
•	Merge unallocated space with the smallest suitable partition

Preferred order of operations

The following chart shows the preferred order of operations that the BitLocker Drive Preparation Tool follows.

Back to the top

Command-line parameters

The BitLocker Drive Preparation Tool uses a simple set of command-line parameters. These parameters make integration with enterprise deployment tools more flexible. Enterprise deployment tools include Microsoft Systems Management Server (SMS) and Microsoft Business Desktop Deployment (BDD). The parameters also provide customized deployment options. The following table lists the parameters. The parameters are not case-sensitive.

Parameter	Description	Notes
[-?] [/?]	Help – Provides a brief description of the tool’s purpose and parameters
[-driveinfo]	Displays the drive letter, the total size, the maximum free space, and the partition characteristics	Only valid partitions are listed. Characteristics are noted only for WinRE, operating system, and unallocated partitions.
[-target {unallocated ¦ drive: {shrink ¦ merge}}]	Indicates the desired operation for target partition: create a new partition from unallocated disk space, split the target partition to create a new partition, or merge unallocated space with the target partition	Cannot merge unallocated spaced with the operating system partition. Unallocated space is not listed if four primary or extended partitions already exist.
[-newdriveletter] ¦ DriveLetter:]	Indicates the drive letter for the newly created partition	Letters A, B, and C are excluded. If no letter is indicated, the first available drive letter backward from S is applied.
[-size ¦ SizeInMegabytes]	Indicates the size in megabytes for the new partition	The minimum size is 1500 MB. At least 10 percent of the target partition must be free after the new partition is created.
[-quiet]	Suppresses confirmation text to avoid user interaction
[-restart]	Restarts the system immediately after all operations are complete	Restarts immediately, regardless of open files or other users logged in.

Example scenario 1

The target system has a single partition. To prepare the computer for BitLocker, you want to split the operating system partition. You want the following conditions to be true:

•	The size of the new partition is 1500 MB.
•	The new partition uses X for the drive letter.
•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Example scenario 2

The target system has more than one partition. To prepare the computer for BitLocker, you want to merge unallocated space with an existing partition. You want the following conditions to be true:

•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Back to the top

A common problem

You may receive the following error message when you use the BitLocker Drive Preparation Tool:

This error may occur in one of the following scenarios.

Scenario 1: You do not have sufficient free disk space

At least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). To resolve this error, move files to another partition or delete files.

Scenario 2: The partition contains files that cannot be moved

The BitLocker Drive Preparation Tool may resize partitions to prepare a hard disk for BitLocker. Occasionally, some unmovable files may prevent the tool from defragmenting and resizing partitions. These files may include any of the following items:

•	Page files
•	Hibernation files (Hiberfil.sys)
•	The registry
•	NTFS metadata files. These files include the following files and others: • $mftmirr • $secure • $volume

This issue may occur even if the operating system is newly installed.

To work around this error, use one of the following methods:

•	Temporarily disable hibernation option and hard disk paging. Then, use the Windows Preinstallation Environment to delete the Hiberfil.sys file and the Pagefile.sys file. Restart the computer in Windows Vista. Then, run the BitLocker Drive Preparation Tool again.
•	Reinstall Windows Vista.

Back to the top

You receive an error message when you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer

When you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer that is running Windows Vista, you may receive the following error message:

To resolve this problem, follow these steps.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

1.	Click Start, type regedit in the Start Search box, and then click regedit in the Programs list.
2.	Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management
3.	Verify the data type of the PagingFiles registry entry. If the data type is REG_SZ, follow these steps: a. Note the value data for the PagingFiles registry entry. b. Back up the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management c. Right-click PagingFiles, and then click Delete. d. Click Yes when you are prompted. e. On the Edit menu, point to New, and then click Multi-String Value. f. Type PagingFiles, and then press ENTER. g. On the Edit menu, click Modify. h. In the Value data box, type the value data that you noted in step 3a, and then click OK. i. Exit Registry Editor.
4.	Restart the computer.

For more information about security for portable computers that are running Windows Vista, visit the following Lenovo Web site:

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Back to the top