I thought I might post a solution (work around?) I found to a perlexing
issue we had with web browsing: it may be no use to anyone but would have
saved me hours!
I had a single user who could not browse the web via IE6 on a W2K client
machine (SBS "internal" web pages were correctly served). For any URL, the
ISA server returned a 403 error "The ISA server denies the specified URL
(12202)". Every other user was able to browse normally and the user with
problems could browse from all XP clients we have on site. The Firewall
client is installed and configured correctly on all machines. IE settings
were correct as per SBS defaults (i.e. pointing at the SBS2000 ISA:
http://ISASERVER:8080)
There were no differences between this user's setup and that of all other
users in terms of group memberships (local or Domain).
Looking at the various ISA logs, any connection that this user tried to make
from IE generated entries in the Firewall client log rather than the Web
Proxy log entries that other users generated. An example log with
authenticated, Rule 1 and Rule 2 fields on as well as the defaults (user
name replaced):
10.0.0.50 *** IEXPLORE.EXE:3:5.0 Y 2004-08-12 09:06:10 ISASERVER -
207.46.245.92 80 15 - 3415 80 TCP Connect 20000 BackOffice Internet Access
Protocol Rule - 21 84
This suggested that for whatever reason, IE was trying to connect via the
Firewall service and not via WebProxy. After much playing with Firewall and
IE proxy settings, the only solution I found was to clear all the local IE
cache, history etc, clear the IE proxy settings, quit IE. Then reopen and
set IE proxy setting to ISASERVER:8080, including setting the advanced proxy
address field to ISASERVER:8080 (all protocols checked). Note that I had
already tried reentering http://ISASERVER:8080 and this did not work.
Firewall client remains enabled.
Why this solved the problem I don't know (HKLU registry issue?), although
I'd appreciate any suggestions on the underlying cause.
Andy Sims