"Jim Van Sickler" <vansickj - eodc _at_ kaman c0m> wrote in message
news:1BAD623F-3152-44C0-AAA0-3AD50140771A@microsoft.com...
> MBSA doesn't show that Rollup 1 is missing; WSUS and
> the PCs do.


Is that with the rollup installed or not?
Try uninstalling it and then see what MBSAcli (from the command line)
thinks (with full file checking and all possible diagnostics requested).


>
> MBSA shows MSXML and MDAC as Okay.

You're testing the possibility that there may be some other (undocumented)
prerequisites that the rollup assumes. E.g. MDAC and MSXML are just
the ones that Dave Hawley found for his case.


>
> What does Windows Update look at specifically to flag Rollup 1
> as "Needed"? I know there's a lot of stuff that's updated
> by it, but it seems some reg entry or file version check
> is the key to all this.

Don't know. Ever since MBSA 2.0 the implementation has been even
more obscure than it was with HfNetChk. Torgeir has hinted (elsewhere)
that if you are a scripting wizard you could get some equivalent details out of
the new XMLOUT option.

I mentioned some of this to Dave Hawley when I was working with him:

http://www.microsoft.com/communities...4-6754993ebac3

Notice the More... at the bottom of the page. It goes on to another page.


> If it's installed prior to rollup 1,
> all is well. If it isn't, you're in the "Needed" loop. Installing
> it afterward doesn't repair the damage.
>
> In the end, the question is: are our systems secure or not?


I suspect it mostly depends on which modules have regressed versions.
If the non-regressed versions include all critical updates you probably
have a secure system.


HTH

Robert
---