Role-based security from Windows Server 2003 Security Guide gives problems

Hello


I have an Ad-environment with 2 Windows 2003 SP1 eng server and some Windows
2003 SP1 eng member server.
I have applied some EC-server policy from Microsoft document from april
2006.


On Domain root I have applied EC-Domain.inf
On Domain Controller OU I have applied EC-Domain Controller.inf
On Member Server OU I have applied EC-Member Server Baseline.inf
On sub OU Web OU I have applied EC-IIS server.inf

I joined 2 new web-servers to the domain and put them in the default
Computer OU. Lets call them lt104 and lt135 as servername.

Now my problems starts

If I from DC run My Computer > Manage > Connect to another computer, select
server104 see errors in word file.

If I from a member server that lies in Web OU run MBSA against all server
in the domain I get errors from scanning lt104 se word file

If I move the server lt104 to Web OU, none of the above errors occur. But
the server lt104 needs to connect to a standalone server to get picture and
I cant connect to that standalone server if lt104 is in the Web OU but it
works if it lies in Computer OU.


Any ideers whats causing this problem

Regards

Mikael

karl
Mon Nov 06 07:29:04 CST 2006


"Mikael Oskarsson" <nospam@abc.se> wrote in message
news:OTD8INaAHHA.4844@TK2MSFTNGP02.phx.gbl...

> I have an Ad-environment with 2 Windows 2003 SP1 eng server and some
> Windows 2003 SP1 eng member server.
> I have applied some EC-server policy from Microsoft document from april
> 2006.
>
> I joined 2 new web-servers to the domain and put them in the default
> Computer OU. Lets call them lt104 and lt135 as servername.
>
> If I from DC run My Computer > Manage > Connect to another computer,
> select server104 see errors in word file.
>
> If I from a member server that lies in Web OU run MBSA against all server
> in the domain I get errors from scanning lt104 se word file


The full and complete error message you are getting would be helpful. Also,
what happens when you search Google for that error message?


--
kind regards,
Karl Levinson, CISSP, CCSA, MCSE [MS MVP]
--------------------------------
Microsoft Security FAQ:
http://securityadmin.info

Mikael
Mon Nov 06 07:43:33 CST 2006

The errors from My Computer > Manage > Connect to another computer, is the
following:

Event viewer: "Unable to connect the computer "lt104" the error was. Access
is denied"
Local Users and Groups : "Unable to access the computer lt104: Access is
denied"
Services: "Unable to open service control manager database on lt104. Error
5: Access is denied"

MBSA says "An Unexpected error has occure.The operating system return error
code 1240"

Regards Mikael


"karl levinson, mvp" <levinson_k@securityadmin.info> skrev i meddelandet
news:ehUUueaAHHA.4496@TK2MSFTNGP02.phx.gbl...
>
> "Mikael Oskarsson" <nospam@abc.se> wrote in message
> news:OTD8INaAHHA.4844@TK2MSFTNGP02.phx.gbl...
>
>> I have an Ad-environment with 2 Windows 2003 SP1 eng server and some
>> Windows 2003 SP1 eng member server.
>> I have applied some EC-server policy from Microsoft document from april
>> 2006.
>>
>> I joined 2 new web-servers to the domain and put them in the default
>> Computer OU. Lets call them lt104 and lt135 as servername.
>>
>> If I from DC run My Computer > Manage > Connect to another computer,
>> select server104 see errors in word file.
>>
>> If I from a member server that lies in Web OU run MBSA against all server
>> in the domain I get errors from scanning lt104 se word file
>
>
> The full and complete error message you are getting would be helpful.
> Also, what happens when you search Google for that error message?
>
>
> --
> kind regards,
> Karl Levinson, CISSP, CCSA, MCSE [MS MVP]
> --------------------------------
> Microsoft Security FAQ:
> http://securityadmin.info
>
>
>

Roger
Mon Nov 06 07:54:52 CST 2006

Did you follow the advise in the guide and use the SCW (security
configuration wizard)? IOW is the W2k3 firewall in use?
Just as a note, the templates are intended as examples to be evaluated
and used as a basis from which one crafts the settings appropriate for
one's environment.
Why not use the GPMC modelling capability to see what settings
are effective for the webserver when it is in each of the two places,
the Web OU or the Computers container ??
Without our having access to view the specific policy settings in
use it is pretty hard to pin-point any specific settings that are in play
to cause the non-connectivities.



"Mikael Oskarsson" <nospam@abc.se> wrote in message
news:OTD8INaAHHA.4844@TK2MSFTNGP02.phx.gbl...
> Hello
>
>
> I have an Ad-environment with 2 Windows 2003 SP1 eng server and some
> Windows 2003 SP1 eng member server.
> I have applied some EC-server policy from Microsoft document from april
> 2006.
>
>
> On Domain root I have applied EC-Domain.inf
> On Domain Controller OU I have applied EC-Domain Controller.inf
> On Member Server OU I have applied EC-Member Server Baseline.inf
> On sub OU Web OU I have applied EC-IIS server.inf
>
> I joined 2 new web-servers to the domain and put them in the default
> Computer OU. Lets call them lt104 and lt135 as servername.
>
> Now my problems starts
>
> If I from DC run My Computer > Manage > Connect to another computer,
> select server104 see errors in word file.
>
> If I from a member server that lies in Web OU run MBSA against all server
> in the domain I get errors from scanning lt104 se word file
>
> If I move the server lt104 to Web OU, none of the above errors occur. But
> the server lt104 needs to connect to a standalone server to get picture
> and I cant connect to that standalone server if lt104 is in the Web OU but
> it works if it lies in Computer OU.
>
>
> Any ideers whats causing this problem
>
> Regards
>
> Mikael
>
>