SBS 2000 Changed ISA settings

Discussion:

SBS 2000 Changed ISA settings - not sure how!

(too old to reply)

Chris Curtis

2009-02-03 12:21:25 UTC

I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.

For instance a java program which updates our remote webserver no longer
works.
Authentication is now required when using Mozilla or Google Chroma - IE7 is
OK.
And I notice in event viewer that the W32Time service is no longer working
despite an allow rule enabled.

The ISA server is running in integrated mode and 'ask unauthenticated users
for identification' is unticked.

What have I done?!

Merv Porter [SBS-MVP]

2009-02-03 12:32:29 UTC

Permalink

Hi Chris,

In the SBS Admin Console:

Internet Security and Acceleration Server 2000 | Server and Arrays |
<yourserver> | Access Policy

Check to make sure all Site and Content rules, Protocol Rules and IP Packet
Filters are enabled.

IIRC, re-running ICW disables any custom filters.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no longer
works.
Authentication is now required when using Mozilla or Google Chroma - IE7
is OK.
And I notice in event viewer that the W32Time service is no longer working
despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask unauthenticated
users for identification' is unticked.
What have I done?!

Chris Curtis

2009-02-03 13:50:31 UTC

Permalink

Hi Merv

Yes, they are all enabled.

Chris

Post by Merv Porter [SBS-MVP]
Hi Chris,
Internet Security and Acceleration Server 2000 | Server and Arrays |
<yourserver> | Access Policy
Check to make sure all Site and Content rules, Protocol Rules and IP
Packet Filters are enabled.
IIRC, re-running ICW disables any custom filters.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no longer
works.
Authentication is now required when using Mozilla or Google Chroma - IE7
is OK.
And I notice in event viewer that the W32Time service is no longer
working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask unauthenticated
users for identification' is unticked.
What have I done?!

Merv Porter [SBS-MVP]

2009-02-03 18:49:17 UTC

Permalink

Can you post the results of an ipconfig /all for the SBS server adn for
a workstation?
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no longer
works.
Authentication is now required when using Mozilla or Google Chroma -
IE7 is OK.
And I notice in event viewer that the W32Time service is no longer
working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask unauthenticated
users for identification' is unticked.
What have I done?!

Merv Porter [SBS-MVP]

2009-02-03 18:52:54 UTC

Permalink

You might also try re-running ICW and, in the last screen, enable ISA Server
Packet Filtering. Then complete ICW.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no longer
works.
Authentication is now required when using Mozilla or Google Chroma -
IE7 is OK.
And I notice in event viewer that the W32Time service is no longer
working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask unauthenticated
users for identification' is unticked.
What have I done?!

Chris Curtis

2009-02-04 10:26:58 UTC

Permalink

Hi Merv

No that didn't work!

Ipconfig results are below

SERVER IP Config:

Windows 2000 IP Configuration

Host Name: server1
Primary DNS Suffix: MITRE.LOCAL
Node Type: Hybrid
IP Routing Enabled: No
WINS Proxy Enabled: No
DNS Suffix Search List: MITRE.LOCAL

Ethernet adapter LAN:
Connection-specific DNS Suffix:
Description: Intel(R) PRO/100 Network Connection
Physical Address: 00-B0-D0-78-A0-2C
DHCP Enabled: No
IP Address: 10.0.0.2
Subnet Mask: 255.255.255.0
Default Gateway:
DNS Servers: 10.0.0.2
10.0.0.2
Primary WINS Server: 10.0.0.2

Ethernet adapter ADSL:
Connection-specific DNS Suffix:
Description: HP Ethernet with LAN remote power adapter
Physical Address: 00-60-B0-C3-F6-EE
DHCP Enabled: No
IP Address: 195.149.50.194
Subnet Mask: 255.255.255.248
Default Gateway: 195.149.50.193
DNS Servers: 10.0.0.2
NetBIOS over Tcpip: Disabled

CLIENT:
Windows IP Configuration

Host Name: chris
Primary Dns Suffix: MITRE.LOCAL
Node Type: Hybrid
IP Routing Enabled: No
WINS Proxy Enabled: No
DNS Suffix Search List: MITRE.LOCAL
mitre.local

Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix: mitre.local
Description: Realtek RTL8139 Family PCI Fast Ethernet NIC
Physical Address: 00-19-DB-89-3B-D2
Dhcp Enabled: Yes
Autoconfiguration Enabled: Yes
IP Address: 10.0.0.155
Subnet Mask: 255.255.255.0
Default Gateway: 10.0.0.2
DHCP Server: 10.0.0.2
DNS Servers: 10.0.0.2
Primary WINS Server: 10.0.0.2
Lease Obtained: 02 February 2009 10:32:42
Lease Expires: 10 February 2009 10:32:42

Thanks

Chris

Post by Merv Porter [SBS-MVP]
You might also try re-running ICW and, in the last screen, enable ISA
Server Packet Filtering. Then complete ICW.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no
longer works.
Authentication is now required when using Mozilla or Google Chroma -
IE7 is OK.
And I notice in event viewer that the W32Time service is no longer
working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask unauthenticated
users for identification' is unticked.
What have I done?!

Merv Porter [SBS-MVP]

2009-02-04 14:17:44 UTC

Permalink

Check your ISA 2000 Authentication properties:

Configuring authentication methods for ISA
http://www.isaserver.org/tutorials/Configuring_authentication_methods_for_ISA.html

If you make any changes, restart the ISA Server Control service.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
No that didn't work!
Ipconfig results are below
Windows 2000 IP Configuration
Host Name: server1
Primary DNS Suffix: MITRE.LOCAL
Node Type: Hybrid
IP Routing Enabled: No
WINS Proxy Enabled: No
DNS Suffix Search List: MITRE.LOCAL
Description: Intel(R) PRO/100 Network Connection
Physical Address: 00-B0-D0-78-A0-2C
DHCP Enabled: No
IP Address: 10.0.0.2
Subnet Mask: 255.255.255.0
DNS Servers: 10.0.0.2
10.0.0.2
Primary WINS Server: 10.0.0.2
Description: HP Ethernet with LAN remote power adapter
Physical Address: 00-60-B0-C3-F6-EE
DHCP Enabled: No
IP Address: 195.149.50.194
Subnet Mask: 255.255.255.248
Default Gateway: 195.149.50.193
DNS Servers: 10.0.0.2
NetBIOS over Tcpip: Disabled
Windows IP Configuration
Host Name: chris
Primary Dns Suffix: MITRE.LOCAL
Node Type: Hybrid
IP Routing Enabled: No
WINS Proxy Enabled: No
DNS Suffix Search List: MITRE.LOCAL
mitre.local
Connection-specific DNS Suffix: mitre.local
Description: Realtek RTL8139 Family PCI Fast Ethernet NIC
Physical Address: 00-19-DB-89-3B-D2
Dhcp Enabled: Yes
Autoconfiguration Enabled: Yes
IP Address: 10.0.0.155
Subnet Mask: 255.255.255.0
Default Gateway: 10.0.0.2
DHCP Server: 10.0.0.2
DNS Servers: 10.0.0.2
Primary WINS Server: 10.0.0.2
Lease Obtained: 02 February 2009 10:32:42
Lease Expires: 10 February 2009 10:32:42
Thanks
Chris

Post by Merv Porter [SBS-MVP]
You might also try re-running ICW and, in the last screen, enable ISA
Server Packet Filtering. Then complete ICW.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no
longer works.
Authentication is now required when using Mozilla or Google Chroma -
IE7 is OK.
And I notice in event viewer that the W32Time service is no longer
working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask unauthenticated
users for identification' is unticked.
What have I done?!

Chris Curtis

2009-02-04 15:43:32 UTC

Permalink

Hi Merv

Its set to Integrated which is what it has always been.

Chris

Post by Merv Porter [SBS-MVP]
Configuring authentication methods for ISA
http://www.isaserver.org/tutorials/Configuring_authentication_methods_for_ISA.html
If you make any changes, restart the ISA Server Control service.
--
Merv Porter [SBS-MVP]
============================

Post by Merv Porter [SBS-MVP]
You might also try re-running ICW and, in the last screen, enable ISA
Server Packet Filtering. Then complete ICW.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no
longer works.
Authentication is now required when using Mozilla or Google Chroma -
IE7 is OK.
And I notice in event viewer that the W32Time service is no longer
working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask unauthenticated
users for identification' is unticked.
What have I done?!

Merv Porter [SBS-MVP]

2009-02-04 15:51:28 UTC

Permalink

What happens if you restart the ISA Service Control service (or just reboot
the server)?
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Its set to Integrated which is what it has always been.
Chris

Post by Merv Porter [SBS-MVP]
You might also try re-running ICW and, in the last screen, enable ISA
Server Packet Filtering. Then complete ICW.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no
longer works.
Authentication is now required when using Mozilla or Google
hroma - IE7 is OK.
And I notice in event viewer that the W32Time service is no longer
working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask
unauthenticated users for identification' is unticked.
What have I done?!

Chris Curtis

2009-02-04 17:17:30 UTC

Permalink

I have restarted the ISA Service Control from within the Services mmc.
I'll do a reboot this evening from home when everybody has gone and see if
that makes a difference!

Chris

Post by Merv Porter [SBS-MVP]
What happens if you restart the ISA Service Control service (or just
reboot the server)?
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Its set to Integrated which is what it has always been.
Chris

Post by Merv Porter [SBS-MVP]
You might also try re-running ICW and, in the last screen, enable ISA
Server Packet Filtering. Then complete ICW.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no
longer works.
Authentication is now required when using Mozilla or Google
roma - IE7 is OK.
And I notice in event viewer that the W32Time service is no longer
working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask
unauthenticated users for identification' is unticked.
What have I done?!

Chris Curtis

2009-02-05 09:27:22 UTC

Permalink

Hi Merv

Well the reboot didn't make any difference.

I have a ghost backup which is about three weeks old and pre-dates when the
problem started.
Are there any obvious pitfalls to restoring drive c from it? Our data is on
D, Exchange on E and the logs on F.
Backup Exec, Mailessentials and VirusScan are the only non SBS programs
located on C and I can make sure the catalogs and databases associated with
those are copied before restoring.
I can do a ghost backup before attempting this!

Chris

Post by Chris Curtis
I have restarted the ISA Service Control from within the Services mmc.
I'll do a reboot this evening from home when everybody has gone and see if
that makes a difference!
Chris

Post by Merv Porter [SBS-MVP]
What happens if you restart the ISA Service Control service (or just
reboot the server)?
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Its set to Integrated which is what it has always been.
Chris

Post by Merv Porter [SBS-MVP]
You might also try re-running ICW and, in the last screen, enable ISA
Server Packet Filtering. Then complete ICW.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Merv Porter [SBS-MVP]
Hi Chris,
Internet Security and Acceleration Server 2000 | Server and Arrays
| <yourserver> | Access Policy
Check to make sure all Site and Content rules, Protocol Rules and
IP Packet Filters are enabled.
IIRC, re-running ICW disables any custom filters.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings
the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no
longer works.
Authentication is now required when using Mozilla or Google
oma - IE7 is OK.
And I notice in event viewer that the W32Time service is no longer
working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask
unauthenticated users for identification' is unticked.
What have I done?!

Merv Porter [SBS-MVP]

2009-02-05 13:11:52 UTC

Permalink

I'm only familiar with using Ghost 2003 to image an SBS server (from DOS) so
I'm not sure I can advise you on using a Ghost "backup".

What about trying:

+ Document your current ISA 2000 configuration (custom packet filters, Site
and Content Rules, Protocol Rules, etc)
+ Back up the current ISA 2000 config using the ISA Backup tool in the ISA
console
+ Remove ISA 2000 in Add/Remove Programs (remove any ISA 2000 Service
Packs/upgrades/updates first)
+ Reboot
+ Reinstall ISA 2000 (from the Integrated Setup in Add/Remove Programs)
+ Reinstall any ISA 2000 Service Packs/Updates
+ Re-run ICW
+ Recreate any ISA 2000 custom Rules/Filters/etc.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Well the reboot didn't make any difference.
I have a ghost backup which is about three weeks old and pre-dates when
the problem started.
Are there any obvious pitfalls to restoring drive c from it? Our data is
on D, Exchange on E and the logs on F.
Backup Exec, Mailessentials and VirusScan are the only non SBS programs
located on C and I can make sure the catalogs and databases associated
with those are copied before restoring.
I can do a ghost backup before attempting this!
Chris

Post by Chris Curtis
I have restarted the ISA Service Control from within the Services mmc.
I'll do a reboot this evening from home when everybody has gone and see
if that makes a difference!
Chris

Post by Merv Porter [SBS-MVP]
What happens if you restart the ISA Service Control service (or just
reboot the server)?
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Its set to Integrated which is what it has always been.
Chris

Post by Merv Porter [SBS-MVP]
You might also try re-running ICW and, in the last screen, enable
ISA Server Packet Filtering. Then complete ICW.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Merv Porter [SBS-MVP]
Hi Chris,
Internet Security and Acceleration Server 2000 | Server and Arrays
| <yourserver> | Access Policy
Check to make sure all Site and Content rules, Protocol Rules and
IP Packet Filters are enabled.
IIRC, re-running ICW disables any custom filters.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing
settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no
longer works.
Authentication is now required when using Mozilla or Google
ma - IE7 is OK.
And I notice in event viewer that the W32Time service is no
longer working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask
unauthenticated users for identification' is unticked.
What have I done?!

Chris Curtis

2009-02-05 13:25:59 UTC

Permalink

OK. That's another option thanks!
The irony is I'm in the middle of setting up SBS 2003 on another server - we
like to keep upto date here :-)

Post by Merv Porter [SBS-MVP]
I'm only familiar with using Ghost 2003 to image an SBS server (from DOS)
so I'm not sure I can advise you on using a Ghost "backup".
+ Document your current ISA 2000 configuration (custom packet filters,
Site and Content Rules, Protocol Rules, etc)
+ Back up the current ISA 2000 config using the ISA Backup tool in the
ISA console
+ Remove ISA 2000 in Add/Remove Programs (remove any ISA 2000 Service
Packs/upgrades/updates first)
+ Reboot
+ Reinstall ISA 2000 (from the Integrated Setup in Add/Remove Programs)
+ Reinstall any ISA 2000 Service Packs/Updates
+ Re-run ICW
+ Recreate any ISA 2000 custom Rules/Filters/etc.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
I have restarted the ISA Service Control from within the Services mmc.
I'll do a reboot this evening from home when everybody has gone and see
if that makes a difference!
Chris

Post by Merv Porter [SBS-MVP]
What happens if you restart the ISA Service Control service (or just
reboot the server)?
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Its set to Integrated which is what it has always been.
Chris

Post by Merv Porter [SBS-MVP]
You might also try re-running ICW and, in the last screen, enable
ISA Server Packet Filtering. Then complete ICW.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
Hi Merv
Yes, they are all enabled.
Chris

Post by Merv Porter [SBS-MVP]
Hi Chris,
Internet Security and Acceleration Server 2000 | Server and
Arrays | <yourserver> | Access Policy
Check to make sure all Site and Content rules, Protocol Rules and
IP Packet Filters are enabled.
IIRC, re-running ICW disables any custom filters.
--
Merv Porter [SBS-MVP]
============================

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing
settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver
no longer works.
Authentication is now required when using Mozilla or Google
a - IE7 is OK.
And I notice in event viewer that the W32Time service is no
longer working despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask
unauthenticated users for identification' is unticked.
What have I done?!

Duncan McC

2009-02-09 08:42:45 UTC

Permalink

1. Re-run ICW
2. check your client (workstation) settings and check the ISA firewall,
and that it is running and correctly configured.
3. also on the client PC's, check that IE is correctly using ISA
settings (proxy etc).
--
Duncan

Post by Chris Curtis
I updated the dns forwarders using the ICW
I'm as certain as I can be that I left all other existing settings the same.
And I didn't go anywhere near ISA.
However, we are now having authentication problems.
For instance a java program which updates our remote webserver no longer
works.
Authentication is now required when using Mozilla or Google Chroma - IE7 is
OK.
And I notice in event viewer that the W32Time service is no longer working
despite an allow rule enabled.
The ISA server is running in integrated mode and 'ask unauthenticated users
for identification' is unticked.
What have I done?!