I scanned a NIST provided VHD with an SCAP Validated FDCC Scanner, but several patches were missing. What does this mean?
VHD’s include all patches available prior to being posted on http://fdcc.nist.gov for download. Subsequent patches released by Microsoft are included the next time the VHD is updated, which may be several months. As a result, these patches are not present on the VHD and will therefore show up as missing during the scan. This is expected behavior and does not indicate a deficiency in the product used to scan the VHD.
Related Questions
- How are the Security Content Automation Protocol (SCAP) and SCAP-validated with FDCC Scanner Capability tools relevant to FDCC?
- I scanned a NIST provided VHD with an SCAP Validated FDCC Scanner, but several patches were missing. What does this mean?
- Why has NIST provided so much information regarding the installation of MSDE as a part of ASSET?