How does MBSA work with Windows Server Update Services (WSUS)?
MBSA provides support for performing the security updates portion of a scan against the Update Services server that each scanned computer is assigned to as well as performing a standalone scan for customers without an Update Services server. Although administrators can select options in the MBSA to ignore or exclusively observe the Update Services approved list of updates, by default the security scan is performed against the list of approved security updates on the Update Services server and against the complete list of available security updates available in the Microsoft Update catalog. Items not approved on the Update Services server for the scanned computer are given an informational score only and do not count against the cumulative security assessment score. Items that are approved, but are not installed on the target computer, are given an appropriate warning and are considered security risks.
