Can't Figure out Remote Desktop

I have been trying to get Remote Desktop working and can not figure it
out...i have SBS 2000 with about 19 xp clients...i want to be able to
log into a client from home using my laptop...my laptop and all of the
clients are running XP Pro...I setup a test machine and enabled Remote
Desktop on it and on the laptop i try to go into it but can't login
using the IP address or anything i can think of...it just times out...

To be honest, i know i'm missing something very simple...i am
connected to the internet with the laptop at home and the desktop at
work is on the network...

I've looked online for instructions, but everything i try hasn't
worked...it is almost llike they are assuming people know how to do it
and are glossing over things that are important...

does anyone know of simple step by step instructions i can follow to
enable whatever i need to to get it working?

please help!

jake stahh

Merv
Tue Aug 17 16:14:20 CDT 2004

Set up VPN on SBS 2000 server.

How do I configure the server for remote access
http://www.smallbizserver.net/Default.aspx?tabid=108

Then log in with a username/password that either has domain admin privileges
(alternately, set up each workstation to allow your username/password to
establish a Remote Desktop session)

Get Started Using Remote Desktop
http://www.microsoft.com/windowsxp/using/mobility/getstarted/remoteintro.mspx

Now VPN into the SBS server and then fire up an RDC session from your hoem
computer to any WinXP Pro workstation by opening and configuring the RDC app
on the home computer.

If you have a router on your network, you will need to port forward port
1723 (for VPN) to the external NIC on your SBS 2000 server. You will also
need to allow VPN Passthru on the router (GRE Protocol 47, not port 47).
See your router docs.

Does that answer your question?

--
Merv Porter [SBS MVP]
===================================

"jake stahh" <junk@anv.net> wrote in message
news:8rl4i0hst1utlknue26vg5e9en4k7vnaur@4ax.com...
> I have been trying to get Remote Desktop working and can not figure it
> out...i have SBS 2000 with about 19 xp clients...i want to be able to
> log into a client from home using my laptop...my laptop and all of the
> clients are running XP Pro...I setup a test machine and enabled Remote
> Desktop on it and on the laptop i try to go into it but can't login
> using the IP address or anything i can think of...it just times out...
>
> To be honest, i know i'm missing something very simple...i am
> connected to the internet with the laptop at home and the desktop at
> work is on the network...
>
> I've looked online for instructions, but everything i try hasn't
> worked...it is almost llike they are assuming people know how to do it
> and are glossing over things that are important...
>
> does anyone know of simple step by step instructions i can follow to
> enable whatever i need to to get it working?
>
> please help!
>
> jake stahh

jake
Tue Aug 17 18:36:17 CDT 2004

so far you have, with one post, taken me farther than hours of
documentation...freak...you rock

ok, i can't test it fully because we don't have a dial up here at the
office, so i have to wait to get home and try it - but i did use the
VPN to login with my computer and it allowed me - then i tested it
with the person that needs this connection and i get a message, "Error
649: The Account does not have permission to dial in." - i followed
the directions to allow her to dial in in her account, but that still
didn't work (gave me the same error)...

jared


On Tue, 17 Aug 2004 16:14:20 -0500, "Merv Porter [SBS-MVP]"
<mwport@no_spam_hotmail.com> wrote:

>Set up VPN on SBS 2000 server.
>
>How do I configure the server for remote access
>http://www.smallbizserver.net/Default.aspx?tabid=108
>
>Then log in with a username/password that either has domain admin privileges
>(alternately, set up each workstation to allow your username/password to
>establish a Remote Desktop session)
>
>Get Started Using Remote Desktop
>http://www.microsoft.com/windowsxp/using/mobility/getstarted/remoteintro.mspx
>
>Now VPN into the SBS server and then fire up an RDC session from your hoem
>computer to any WinXP Pro workstation by opening and configuring the RDC app
>on the home computer.
>
>If you have a router on your network, you will need to port forward port
>1723 (for VPN) to the external NIC on your SBS 2000 server. You will also
>need to allow VPN Passthru on the router (GRE Protocol 47, not port 47).
>See your router docs.
>
>Does that answer your question?

Merv
Tue Aug 17 19:49:51 CDT 2004

Well good, we're making progress then.

I presume you mean that the user could not establish a VPN (her user account
gets the 649 error). In the SBS Console, double click on the user and,
under the Dial-In tab, make sure she has permissions to dial in (Remote
Access Permission - Allow Access). Also, on the Terminal Server Profile
tab, at the bottom, I believe you have to have the "Allow Login to Terminal
Server" checked.

Also, maybe... (although I don't think this applies here)

PPTP Clients Cannot Connect to Windows 2000 PPTP Server
http://support.microsoft.com/?kbid=266460

--
Merv Porter [SBS MVP]
===================================

"jake stahh" <junk@anv.net> wrote in message
news:3455i0t3665b4hs655t7iinfdsahdhomnq@4ax.com...
> so far you have, with one post, taken me farther than hours of
> documentation...freak...you rock
>
> ok, i can't test it fully because we don't have a dial up here at the
> office, so i have to wait to get home and try it - but i did use the
> VPN to login with my computer and it allowed me - then i tested it
> with the person that needs this connection and i get a message, "Error
> 649: The Account does not have permission to dial in." - i followed
> the directions to allow her to dial in in her account, but that still
> didn't work (gave me the same error)...
>
> jared
>
>
> On Tue, 17 Aug 2004 16:14:20 -0500, "Merv Porter [SBS-MVP]"
> <mwport@no_spam_hotmail.com> wrote:
>
> >Set up VPN on SBS 2000 server.
> >
> >How do I configure the server for remote access
> >http://www.smallbizserver.net/Default.aspx?tabid=108
> >
> >Then log in with a username/password that either has domain admin
privileges
> >(alternately, set up each workstation to allow your username/password to
> >establish a Remote Desktop session)
> >
> >Get Started Using Remote Desktop
>
>http://www.microsoft.com/windowsxp/using/mobility/getstarted/remoteintro.ms
px
> >
> >Now VPN into the SBS server and then fire up an RDC session from your
hoem
> >computer to any WinXP Pro workstation by opening and configuring the RDC
app
> >on the home computer.
> >
> >If you have a router on your network, you will need to port forward port
> >1723 (for VPN) to the external NIC on your SBS 2000 server. You will
also
> >need to allow VPN Passthru on the router (GRE Protocol 47, not port 47).
> >See your router docs.
> >
> >Does that answer your question?
>

jake
Wed Aug 18 16:37:09 CDT 2004

excellent...that worked...but, only when logged in here at the office
on the network...i took the laptop and was connected here at the
office and could VPN in without any problem...

but...

once i took it off the network and connected using the Verizon
Wireless Card (like using a dial up but using a Cell Phone connection,
so it is about 40k) it wouldn't connect at all...here is the error i'm
getting:

Error 800: Unable to establish the VPN connection. The VPN server may
be unreachable, or security parameters may not be configured properly
for his connection.

I am getting connected using the Verizon card and then I pull up a
page to make sure i have a connection...then once i do i try the VPN
connection and it just says, "connectiong to XX.X.X.X" (ip address). -
sits there for a minute and then gives me the error i typed above.

any ideas guru?

jake stahh

On Tue, 17 Aug 2004 19:49:51 -0500, "Merv Porter [SBS-MVP]"
<mwport@no_spam_hotmail.com> wrote:

>Well good, we're making progress then.
>
>I presume you mean that the user could not establish a VPN (her user account
>gets the 649 error). In the SBS Console, double click on the user and,
>under the Dial-In tab, make sure she has permissions to dial in (Remote
>Access Permission - Allow Access). Also, on the Terminal Server Profile
>tab, at the bottom, I believe you have to have the "Allow Login to Terminal
>Server" checked.
>
>Also, maybe... (although I don't think this applies here)
>
>PPTP Clients Cannot Connect to Windows 2000 PPTP Server
>http://support.microsoft.com/?kbid=266460

Merv
Wed Aug 18 18:40:38 CDT 2004

I don't have any experience with Cell phone VPN connections.

> "connectiong to XX.X.X.X" (ip address).

Is that a public IP address or a private IP address? I assume it a public
address (not 192.168.x.x). It should the public (WAN) IP address of your
router.

When off the SBS network, change the laptop to a workgroup (any name will
do) and log onto the laptop with the same username/password combination that
you will be using to establish the VPN (you'll need to create this "local"
account). Disable the ISA firewall client if it's active. Establish the
cell phone connection and then try establishing the VPN.

--
Merv Porter [SBS MVP]
===================================
"jake stahh" <junk@anv.net> wrote in message
news:uoi7i09a6sbsou0i7gnsloqq7r9e9sb8bm@4ax.com...
> excellent...that worked...but, only when logged in here at the office
> on the network...i took the laptop and was connected here at the
> office and could VPN in without any problem...
>
> but...
>
> once i took it off the network and connected using the Verizon
> Wireless Card (like using a dial up but using a Cell Phone connection,
> so it is about 40k) it wouldn't connect at all...here is the error i'm
> getting:
>
> Error 800: Unable to establish the VPN connection. The VPN server may
> be unreachable, or security parameters may not be configured properly
> for his connection.
>
> I am getting connected using the Verizon card and then I pull up a
> page to make sure i have a connection...then once i do i try the VPN
> connection and it just says, "connectiong to XX.X.X.X" (ip address). -
> sits there for a minute and then gives me the error i typed above.
>
> any ideas guru?
>
> jake stahh
>
> On Tue, 17 Aug 2004 19:49:51 -0500, "Merv Porter [SBS-MVP]"
> <mwport@no_spam_hotmail.com> wrote:
>
> >Well good, we're making progress then.
> >
> >I presume you mean that the user could not establish a VPN (her user
account
> >gets the 649 error). In the SBS Console, double click on the user and,
> >under the Dial-In tab, make sure she has permissions to dial in (Remote
> >Access Permission - Allow Access). Also, on the Terminal Server Profile
> >tab, at the bottom, I believe you have to have the "Allow Login to
Terminal
> >Server" checked.
> >
> >Also, maybe... (although I don't think this applies here)
> >
> >PPTP Clients Cannot Connect to Windows 2000 PPTP Server
> >http://support.microsoft.com/?kbid=266460
>

jake
Thu Aug 19 12:34:34 CDT 2004

yeah, it is a public IP address - didn't want to have that out there,
but yes, it isn't 192.168 esque...

i tried it at home last night with a dial up and it still doesn't
connect...same error as the Verizon card.

i followed your directions below with the cell card and am again
getting nowhere - same timeout with "Unable to establish the VPN
connection"

i'll try the instructions with a dial up, but my suspicions are that
the verizon card will be like a dial up in getting it to work...

jake


On Wed, 18 Aug 2004 18:40:38 -0500, "Merv Porter [SBS-MVP]"
<mwport@no_spam_hotmail.com> wrote:

>I don't have any experience with Cell phone VPN connections.
>
>> "connectiong to XX.X.X.X" (ip address).
>
>Is that a public IP address or a private IP address? I assume it a public
>address (not 192.168.x.x). It should the public (WAN) IP address of your
>router.
>
>When off the SBS network, change the laptop to a workgroup (any name will
>do) and log onto the laptop with the same username/password combination that
>you will be using to establish the VPN (you'll need to create this "local"
>account). Disable the ISA firewall client if it's active. Establish the
>cell phone connection and then try establishing the VPN.

Merv
Thu Aug 19 14:44:29 CDT 2004

I presume you have the standard two NICs in your SBS server. Set your
router to port forward Port 1723 to the IP address of the external NIC on
your SBS server. Also, turn on VPN Pass Through on your router (see your
manual). This will forward all VPN traffic that hits the router's (public)
WAN IP address to your SBS server for authentication by ISA.

--
Merv Porter [SBS MVP]
===================================

"jake stahh" <junk@anv.net> wrote in message
news:1oo9i01p2e13m804kr47n1c2mmf9232t69@4ax.com...
> yeah, it is a public IP address - didn't want to have that out there,
> but yes, it isn't 192.168 esque...
>
> i tried it at home last night with a dial up and it still doesn't
> connect...same error as the Verizon card.
>
> i followed your directions below with the cell card and am again
> getting nowhere - same timeout with "Unable to establish the VPN
> connection"
>
> i'll try the instructions with a dial up, but my suspicions are that
> the verizon card will be like a dial up in getting it to work...
>
> jake
>
>
> On Wed, 18 Aug 2004 18:40:38 -0500, "Merv Porter [SBS-MVP]"
> <mwport@no_spam_hotmail.com> wrote:
>
> >I don't have any experience with Cell phone VPN connections.
> >
> >> "connectiong to XX.X.X.X" (ip address).
> >
> >Is that a public IP address or a private IP address? I assume it a
public
> >address (not 192.168.x.x). It should the public (WAN) IP address of your
> >router.
> >
> >When off the SBS network, change the laptop to a workgroup (any name will
> >do) and log onto the laptop with the same username/password combination
that
> >you will be using to establish the VPN (you'll need to create this
"local"
> >account). Disable the ISA firewall client if it's active. Establish the
> >cell phone connection and then try establishing the VPN.
>

jake
Thu Aug 19 17:16:25 CDT 2004

i do have 2 nic's, but don't have an external router...i have the DSL
going into one nic on the server and the other one going to the switch
for the network...so there is nowhere to to set port forwarding

On Thu, 19 Aug 2004 14:44:29 -0500, "Merv Porter [SBS-MVP]"
<mwport@no_spam_hotmail.com> wrote:

>I presume you have the standard two NICs in your SBS server. Set your
>router to port forward Port 1723 to the IP address of the external NIC on
>your SBS server. Also, turn on VPN Pass Through on your router (see your
>manual). This will forward all VPN traffic that hits the router's (public)
>WAN IP address to your SBS server for authentication by ISA.

Merv
Thu Aug 19 19:32:17 CDT 2004

Ok... so you're using ISA and you've run through the steps at Mariette's
site:
http://www.smallbizserver.net/Default.aspx?tabid=108
http://www.microsoft.com/Resources/documentation/SBS/2000/all/reskit/en-us/sbrk0013.mspx

You've also set up ISA to allow VPN by re-running ICW and, at the COnfigre
Packet Filtering screen, selecting "Enable ISA Server Packet Filtering" and
checking VPN

Then, you set up your remote client machine to use the WAN IP address of
your external NIC in the VPN connectoid onhte remote machine.

Is all this correct so far?

You should also review:

How to Configure Small Business Server for Full Time Internet Access with
Two Network Adapters
http://support.microsoft.com/?id=306802

HOW TO: Turn On and Configure Inbound VPN Access in Small Business Server
2000
http://support.microsoft.com/?id=320697

You'll should also perform the procedures in the following KB article:
Name resolution and connectivity issues on a Routing and Remote Access
Server that also runs DNS or WINS
http://support.microsoft.com/?id=292822

Though unlikely, your ISP may also be blocking VPN.

If you can afford $50, pick up an inexpensive router and set up your SBS per
the instructions at: (I'm assuming you have a dynamic WAN IP from your ISP)

Two Nics, a dynamic IP address, ISA, router
http://www.smallbizserver.net/Default.aspx?tabid=50

It increases security, takes some of the burden off ISA (and therefore the
SBS server) and makes troubleshooting easier. I generally use a DLink
DI-604 for this.

Again, assuming that you have a dynamic (WAN) IP address from your ISP, when
you get the VPN up and running, you'll probably want to set up a free
account at a DDNS (Dynamic DNS) provider like www.dyndns.org so that any
changes to your WAN IP can be tracked. This will give you consistent access
to your network via VPN even if your WAN IP address changes.

--
Merv Porter [SBS MVP]
===================================

"jake stahh" <junk@anv.net> wrote in message
news:e39ai0tkpmpgi1qgnduuk31icppad0j2cc@4ax.com...
> i do have 2 nic's, but don't have an external router...i have the DSL
> going into one nic on the server and the other one going to the switch
> for the network...so there is nowhere to to set port forwarding
>
> On Thu, 19 Aug 2004 14:44:29 -0500, "Merv Porter [SBS-MVP]"
> <mwport@no_spam_hotmail.com> wrote:
>
> >I presume you have the standard two NICs in your SBS server. Set your
> >router to port forward Port 1723 to the IP address of the external NIC on
> >your SBS server. Also, turn on VPN Pass Through on your router (see
your
> >manual). This will forward all VPN traffic that hits the router's
(public)
> >WAN IP address to your SBS server for authentication by ISA.
>