default permissions revisited

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ smallbiz
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
 - 1
 - Blackberry Do I need to purchase a Blackberry server to push emails out of Exchange to the Blackberry server then onto my Blackberry handheld, or can I tell me ISP to give me a special account so that I can access emails on the go? We are running SBS 2000 with around 40 Win2K clients. Sachin Tag: default permissions revisited Tag: 164270
 - 2
 - NAT problems SBS 2003 Some XP and windows 2k clients don't get a translated address from the windows 2003 SBS NAT pool and can't connect to the internet. I can work fine with databases etc on the same server, but to go beyond the server, the 10.0.0.0/24 address needs to be translated into a 192.168.254.0/28 I have excluded from the NAT pool the outside interface of the sbs server which is 192.168.254.7/28 . When I enable the basic firwall and disable it after it works again for a while. I think because then all NAT entries are cleared. Any ideas ? Setup is like this: LAN 10.0.0.0/24======10.0.0.1 (inside interface on the SBS) windows 2003 SBS (192.168.254.7 outside interface) =====cisco837 (adsl router with dhcp and 192.168.254.0/28) (The router is managed by the telecomms company) Tag: default permissions revisited Tag: 164268
 - 3
 - Exchange Mail Database Size Limitations Can someone please tell me what the maximum size is for a mail database in SBS2000??? I believe that the Exchange version supplied with SBS2000 is a version of Exchange Standard 2000 which has limitations of 16GB but is it bigger because it is for the SBS2000 product. Any clarification would be appreciated. Thanks Tag: default permissions revisited Tag: 164265
 - 4
 - **SBS User group in Phoenix Starting Up** Michael Cocanower pings me and asks if I can announce that he's scheduled their first meeting for November 10, 2004 at the Phoenix Microsoft Office: 2929 North Central Avenue, Suite 1400 Phoenix, AZ 85012 Here is the registration link If you are an SBSer in Phoenix, SIGN UP! Small Business Server Users Group Meeting https://msevents.microsoft.com/cui/eventdetail.aspx?culture=en-US&eventid=1032259230&x=9&y=12 Wednesday, November 10, 2004 5:00 PM - Wednesday, November 10, 2004 6:00 PM (GMT-08:00) Pacific Time (US & Canada) Welcome Time: 4:45 PM Language: English-American Microsoft Office - Phoenix MPR 2929 North Central Avenue, Suite 1400 Phoenix Arizona 85012 United States General Event Information Products: Small Business Server. Recommended Audience: IT Professional, Partner and Technology Decision Maker. Please join us for the official kick off of the Arizona SMB User Group! This new group is being formed to provide a forum for administrators, resellers, consultants, partners and professionals dedicated to furthering the use and knowledge of Microsoft Small Business Server as a reference platform for SMB relationships. Our goal is to provide monthly meetings, information exchange, demos, study groups, and local peer support. This group will help you to connect with others (technical/non-technical) interested in learning about, working with and using Microsoft Small Business Server. To share information and to help one another in the resolution of issues that arise. To stay abreast of changes in the industry and understand their impact on our businesses. SBS Partners of varying skill levels are invited to get together to share ideas, meet other SBSers, and discuss Microsoft Small Business Server and other SMB technologies, as well as, business issues related to the SMB sector. -- http://www.sbslinks.com/really.htm Tag: default permissions revisited Tag: 164262
 - 5
 - Renamed Admin Accounts 30 min Delayed Login to Client Workstations Good-evening everyone, I posted this earlier and several people tried to help me out. I was wonder if someone can help me out with Windows Small Business Server 2000 domain controller and client desktop logon with administrator account. I have a domain controller which has been in operation for quite some time. The original administrator account has been renamed for security as is all our other clients ever since the beginning of the server's life span. But when I try to use the account to login to any client machine joined to the domain, whether it be a new install or not, the system stalls at Loading profile and settings.... window, but the mouse is still active, and the blue animated line on the window still scrolls. When I remove the Home Folder of the administrator account it works fine. But when I add back the home folder it fails. The Home Folder is a network share. After waiting for 30 min or so, the login succeeds and all the mappings are correct. I have a feeling that the login is trying to query the AD for this property and is not returning the value of the Home Folder. I can of course still login to the Server and login to server using Terminal Services with this renamed administrator account. Any help would be great. Thanks. Tag: default permissions revisited Tag: 164259
 - 6
 - Pcanywhere & isa I have pcanywhere set up on a client behind my isa server. The client ip is 10.0.0.25 my enternal ip is 10.0.0.1 my external network is 192.168.5.1 and my router is 192.168.5.0. The question: is it possible in isa2000 to port forward from the internet to the client so he can access his desktop at work? Isa hides the internal network from the external one so i can't work out where or how to go about getting this to work. i can pcanywhere to the server ok but its getting through the darn server to the client i need to see his ip address to connect. Thanks Adam. Tag: default permissions revisited Tag: 164257
 - 7
 - Shared fax problems Has anyone experienced problems with MS Shared Fax? We are experiencing major problems with receiving faxes. Sometimes we receive a partial fax may 3 of 10 pages the next time we receive the same fax we receive 6 of 10. Then sometimes it will say succesfully recieved 4 pages, but the fax was actually 5 pages and the second page is missing. Our customers are constantly having to resend the faxes. However some faxes we receive without any glitch. I don't understand this and it is a major issue. Please help. Thanks, JH Tag: default permissions revisited Tag: 164255
 - 8
 - Login bypass Hi, I was wondering if there is a way to bypass the login password on a windows XP workstation when they want to get to domain. The reason behind, I have a SBS 2003 and few workstations and a printer connected to domain. Since this is a public place like a Library I don't want the users to log on whenever they turn on the computer or whenever they want to print to the printer. Please advise. Tag: default permissions revisited Tag: 164245
 - 9
 - Backing up a workstation Is there a way to get NTBackup on an SBS2000 server to back up a workstation, short of setting the entire workstation's drive as shared? I have upgraded workstation hardware by running backup from the workstation and saving backup file to the server, but this time we are upgrading the workstation from W98 to XP (finally) abd my understanding is that XP's backup will not restore from a file made by W98's backup, so I need to use the Backup from the server. Is there a relatively easy way to do this. Thanks, Dave Tag: default permissions revisited Tag: 164239
 - 10
 - Exch2k Rejecting External "Internal" Emails Hi group, hope you can help with this one (maybe 2 problems?)....SBS2k (almost fully patched :), Exch2k, etc. etc., setup right off the whitepapers.... We have POP3 email addresses at our ISP for our on-the-road salesmen. These external email addresses are not set up in our internal Exchange environment, even though the email addresses have the format of salesman@emaildomain.com. When we send an email from our internal Exchange server to one of the salesman, Exchange has an "unresolved" recipient, so based on our SMTP settings the email is forwarded to our ISP's mail.emaildomain.com, where the messages find their way to the right salesman's POP3 account. This has worked great for many months. However, beginning this morning, Exchange is refusing to forward the emails and is issuing the following error: salesman1@emaildomain.com' on 9/8/2004 11:11 AM You do not have permission to send to this recipient. For assistance, contact your system administrator. <sol.serverdomain.local #5.7.1 smtp;550 5.7.1 me@email.com> Access not allowed There were no changes made on the server, no change to Exchange's config, backups running fine, other emails - no problems, and the ISP is fine. Can you all think of a reason why these would suddenly stop working? I don't know if this is related, but during diagnosis I did locate an Exchange warning-level Application Event Log entry that started 3 weeks ago. It is issued twice per day (first time 8/18 12:01AM, second time12:02 PM) and has reissued approximately one-half hour later each day since (today the first warning today was issued at 11:01 AM, the second will probably be issued at 11:02 PM tonight). Here it is: "MSExchangeIS Mailbox Store, MTA Connections, Event 2000. Verify that the Microsoft Exchange MTA service has started. Consecutive ma-open calls are failing with error 3051." Sure enough the "Microsoft Exchange MTA Stacks" service is Stopped. Am I hosed? Tag: default permissions revisited Tag: 164238
 - 11
 - new server Hi We currently are running SBS2000. This server also acts as our file server and we are slowly running out of room (it is also somewhat old). I was looking into buying a new server to act as our file server (so the current SBS would just manage the domain/email etc). I was on the dell website and noticed you could buy a server with SBS2003 for about the same price as windows server 2003. That being said, is it fairly easy to move the current SBS2000 to a new server that has SBS2003? We are also running a seperate webserver through the SBS2000 so I would also need to transfer all the ISA2000 settings etc. Has anyone ever done this? Is it fairly straight forward? In your opinion, what would you do? Tag: default permissions revisited Tag: 164236
 - 12
 - User As Local Administrator on Laptop Hello, SBS2K, WinXP. I have a user that I set up with a domain profile on the SBS. He logs into his laptop both in the office and on the road. He is not able to do some things on the laptop, such as defrag, because he does not have the privileges. I wanted to allow him to be part of the Administrators group on his local PC, but when I went into the Local Users and Groups on the laptop, his profile is not there. I assume it is because he has a domain account and logs into it, not the local PC. That said, how can I make him part of the Administrators group only on his PC. I looked in Member Of tab of his domain account via Active Directory, but didn't see anything. Is this something that has to be set via Group Policy? Also, after I make these changes, how can I get his profile to update? He is currently out of the office and will be for a few more days. He does have the VPN connection to the network set up. Can I do something like with GPO where you connect through the VPN and run GPUpdate? Any help would be appreciated. Thanks, Chris Tag: default permissions revisited Tag: 164234
 - 13
 - problems adding client licenses.... We have a Windows 2000 SBS server and an add'l Windows 2003 (standard) server. The win2K3 OS came with 5 licenses. We purchased an add'l 5 licenses to install. When I log on to the win2k3 server locally using the administrator account and attempt to add licenses, I get an error message stating that the "license logging service is not running on the target machine, or the target machine is not accessible". When I check the service in question, it has been disabled and can not be started. I then tried loggin on to teh win2k3 server using my domain admin account and was able to add a "new license" using the Licensing app in control panel. But when I click the client tab and select the win2k3 server in our domain, once again, I get the above listed error... How do I go about adding client licenses (server mode) to the win2k3 member server? Tag: default permissions revisited Tag: 164233
 - 14
 - How can I recover a faulty DNS zone ? I have Installed and configured my internal DNS with the Internet Registred Zone for my DNS on my SBS 2000 Server. How can I change this zone name and what are the best guide for configuring the Internal and externe DNS in SBS 2000. Many think for any super helper. Tag: default permissions revisited Tag: 164229
 - 15
 - Problem accessing specific site through ISA server We are having problems accessing one specific site. When browsing there are errors on page, and most pages display garbled text. Bypass the ISA and the site can be accessed fine. Any ideas? Many thanks Tag: default permissions revisited Tag: 164219
 - 16
 - Automatic Email Disclaimer I have SBS 2003 and would like to set up an email disclaimer at the bottom of all emails that are sent out. Could you please tell me how to do this? Regards, RSW Tag: default permissions revisited Tag: 164218
 - 17
 - ActiveSync advice... Hi, We recently upgraded a client from Outlook 2002 (rolled out from the SBS) to Outlook 2003 (part of the Office 2003 Pro suite). The client uses a SONY Clie to sync his Inbox, Calendar etc... This was woking fine with Outlook 2002 but now he cannot sync at all since upgrading to Outlook 2003. Can someone help?? Thanks in advance, skc Tag: default permissions revisited Tag: 164216
 - 18
 - How to measure traffic Can someone please give me an idea on how to measure the outgoing internet traffic from the server. We're running SBS2003 standard. We seem to be using a bit of bandwidth and I just want to see what is happening. Our ISP says that it seems to be a lot of traffice from port 110, we have exchange setup and works ok. There doesn't seem to be anything in the queue that could be causing problems. Does SBS have something inbuilt that I can use or is there a free basic 3rd party product that I can use. Any help would be appreciated. many thanks Tag: default permissions revisited Tag: 164206
 - 19
 - Connect PC's to server Could someone please tell me how do I connect the pc's to the server - first of all - were can i see what the domain is that the pcs need to connect to , and secondly how do i set it up so that it connects? Thanks Tag: default permissions revisited Tag: 164205
 - 20
 - Testing. Tag: default permissions revisited Tag: 164202
 - 21
 - User rec. this exchange error, about no permission to send to recipient. Everything seems to be working ok, however when this staff member sends an email to this email address they get the following error messge. Anyone got any ideas. Your message did not reach some or all of the intended recipients. Subject: Payment Files Sent: 8/09/2004 1:32 PM The following recipient(s) could not be reached: Easylink Bank of Qld (easylink@boq.com.au) on 8/09/2004 1:32 PM You do not have permission to send to this recipient. For assistance, contact your system administrator. MSEXCH:MSExchangeIS:/DC=local/DC=empirehotel:SERVER Tag: default permissions revisited Tag: 164198
 - 22
 - Shared fax question I am trying to implement a shared fax situation where I can receive two faxes and send a fax at the same time. I thought I could do this by adding 2 USB modems and 1 PCI modem to the server. Unfortunately it seems as though I can only get 1 of the USB modems to work at a time. If I try to use the other it simply does not respond, is their a known limitation to this? Is there a solution? How would a multi port serial PCI card work? Also, if I need to dial a 9 to obtain an outside line for these modems, where do I set this option? On the server under Phone & Modem Options, or must it be done on the client? Any & all help would be greatly appreciated! Thanks, James Hernandez Tag: default permissions revisited Tag: 164194
 - 23
 - Intruder alert from ISA I keep getting notified about these Intruder alerts from ISA. Where can I start to look at what is going on? The frequency is about 1 per day. More on weekends. ISA Server name: BOB ISA Server detected a spoof attack from Internet Protocol (IP) address 127.0.0.1. A spoof attack occurs when an IP address that is not reachable via the interface on which the packet was received. If logging for dropped packets is set, you can view details in the packet filter log. Thanks Bob Tag: default permissions revisited Tag: 164191
 - 24
 - Moving from old smallbiz2000 server to a new smallbiz2000 server We have a 2000 small business server. We would like to migrate all users/data from the existing server to a brand new server. We are not upgrading to smallbiz2003 yet. I cannot find any documentation explaining how to migrate from one smallbiz2000 domain to another. Can anybody comment? Tag: default permissions revisited Tag: 164175
 - 25
 - Exchange recovery We have changed our SBS2000 to SBS2003. The Exchange data were transfered by using simple *.pst files. After update to the new system the old one was canceled. After that we have found that one folder from Public folders (contacts) was not transfered. I still have complete data base (folder with an old Exchange database). Can I use someway this database to recover my missed catalogue? It would be enough if I can simply have a look into the contacts in the folder, which was not transfered with regards Marek Staniewski canceling the SBS2003 Tag: default permissions revisited Tag: 164167
- Next
 - 1
 - Trying to use Passive Ftp through ISA I've tried many different suggestions from the MS knowledgebase but still can't configure ISA to correctly use ftp in passive mode. I can access the ftp server when setting up packet filters but not when using the ftp protocal in server publishing. I have 1 internal adapter and 1 external adapter. When I try to initiate a passive file transfer. I get the 425 error Can't open data connection. Any help would be greatly appreciated. Tag: default permissions revisited Tag: 164161
 - 2
 - screen gone hi have spent all day loading small business 2000, everything went well for a change for me, loaded all the drivers and it seemed ok, then when i booted down and up again i have lost my monitor, i have connected another pc to the monitor and it works fine. I remember a long time ago i set the screen res to high in win 95 and similar happened, problem is cant get in to change it? Anyone know as cant remember how we solved it? phil Tag: default permissions revisited Tag: 164151
 - 3
 - re-did our external scsi raid, now sbs won't give it a drive letter It sees the drive when we go to system devices, but won't give it a drive letter.. what's up with that? thanks.. Tag: default permissions revisited Tag: 164148
 - 4
 - cpu running at 100% after booting when i boot my server it has 9 instances of svchost.exe and 14 instances of wmiprvse.exe is this normal? what do they do? my cpu is running at 100% but doesn't seem to have any problems doing tasks. Tag: default permissions revisited Tag: 164144
 - 5
 - SBS 2000 Disaster Recovery Assistance Needed Urgent Request !! We have a situation where a disk controller has failed in an SBS2000 server. There is another operational Domain Controller in this environment. The main boot/system volume which failed was a Dynamic Disk. The server had Veritas Backup Exec Disaster Recovery Wizard run on it 2 weeks ago and a very recent System State backup and a full Information Store backup using same software but IDR wizard fails to recover as I have just learned about a Veritas IDR patch that was not on the server before failure. As the main boot/system disk was a Dynamic Disk, Windows itself fails to see the drives so I cannot do a repair. I have recreated basic disk partitions on the boot disk and installed Windows 2000 server and Backup Exec onto this drive. I have tried to do a System State restore but at reboot I get Stop 0X7b errors which I think have something to do with the original dynamic disk setup. I think I have to restore all applications maually and then restore individual settings where possible. My questions are: 1. How can I recover active directory on to the original SBS 2000 server by replicating from the other active domain controller as SBS wants to be the root of the forest ? 2. How do I restore ISA settings ? Thanks in advance. Kevin Spanner Tag: default permissions revisited Tag: 164143
 - 6
 - Exchange not receiving emails Hi, I have a client with SBS2K service packed up. They had been running fine last week but since the weekend they cannot receive email through Outlook/Exchange running on SMTP. The ISP has no reported problems. Email sends out OK. Any ideas where to start? Many thanks Sam. Tag: default permissions revisited Tag: 164127
 - 7
 - small business server 2000 Have installed Small business server 2000, but after loading am getting lots of driver errors missing for ethernet adapter and so on, that many that its blocked up event viewer and even after delting and not remembering them its everytime i log on the errors fill the event log and jam up the system, obviously i am missing some drivers that are essential to run SBS2000. If i format the partition and load XP and then put SBS 2000 over the top would that help with the drivers? as it seems that SMS has no drivers on the 4 disks i have for it, but XP picked a lot up as on board the disk. I have all the driver disks that came with the server but I have added a network pco card nad that is some of the drivers that it says are missing, but when i put the driver disk in it doesn 't see them? Should i uninstall the pci card and just get SBS working? Thanks for any help -- Mr Chuckles ;-) Tag: default permissions revisited Tag: 164126
 - 8
 - Error: Access Denied in OWA I have SBS2000 and have recently set up OWA using SSL. I have accessed OWA on three different computers. On two of them (one Win2k, one XP) everything works fine. On the third (XP), when I reply or forward an e-mail I get a new e-mail window but instead of having the reply/forward message in the e-mail body, it says Error: Access Denied. I am logging on to the same account on all three computers. Two of them are home PCs hooked to the same network - both with XP with SP2 installed - but it is one of these that has the error. I appreciate any guidance or help on this. DJ -----= Posted via Newsfeeds.Com, Uncensored Usenet News =----- http://www.newsfeeds.com - The #1 Newsgroup Service in the World! -----== Over 100,000 Newsgroups - 19 Different Servers! =----- Tag: default permissions revisited Tag: 164116
 - 9
 - windows update Hi I set up a Windows software update server and i got it to work fine and i have 1 question. How can i enable users to install windows updates if they are not part of the domain admin or administrator group? THanks Peter. Tag: default permissions revisited Tag: 164112
 - 10
 - Shared Fax Hello. What modem do I have to use? In this moment I can't send faxes... event viewer registers error 32028: An error was encountered while sending a fax. The service will attempt to resend the fax. If further transmissions fail, please verify that the following items are working correctly: phone line, fax sending device and fax receiving device. Sender: Edinson Rivas Hernandez. Billing code: . Sender company: . Sender dept: . Recipient name: ff. Recipient number: 9,8823391. Device name: Zoom External V92 Voice Faxmodem. The receiving fax machine shows this message: COMM ERROR 90 01 COMM ERROR A 05 My modem is a serial v92 voice fax modem - Zoom What can I do? thanks for your help. Tag: default permissions revisited Tag: 164109
 - 11
 - Exchange Badmail Folder Hi, on SBS 2000, mail is been picked up but does not get deleted from our POP3 account, and we are getting the "badmail folder" full. Where do i start to look for the problem? Many Thnaks Jay Tag: default permissions revisited Tag: 164107
 - 12
 - Where do my emails go? When mail is sent to the global mailbox, where does the mail go that is sent to "thewrongaddress@domainname.com" is it returned or evaporated? Is there a way of sending it to a failedmail user account (eg. administrator)? Tag: default permissions revisited Tag: 164102
 - 13
 - Changing the internal email address The company I work for has recently been purchased and is now operating under a new name. I therefore need to change the internal address so that any email that is sent from the business is sent from someone@bramleylakes.com and not from the old company. Is there a way of doing this and change the name on the server? Can anyone help? Tag: default permissions revisited Tag: 164101
 - 14
 - re setting up small business server now realised how big the job is and have gone online and bought a couple of books do you recommend any of these Small Business Server 2000 Resource Kit" http://www.amazon.co.uk/exec/obidos/ASIN/0672315130/202-9679828-3479017 Sams teach yourself small business server in 21 days http://www.amazon.co.uk/exec/obidos/ASIN/0672315130/202-9679828-3479017 any advice on better books gratefully received Tag: default permissions revisited Tag: 164100
 - 15
 - SBS 2003 Can't Browse Intranet web site 1st time I install SBS 2003 everything ok. But 2nd time I format the hard disk then reinstall again the SBS 2003, the Intranet web site can't browse. I think I haev reformat & reinstall SBS2003 more than 10 times, Can't solve this problem. Some one help me. Thanks Tag: default permissions revisited Tag: 164099
 - 16
 - setting up a domain Is there an online tutorial on how to set up a network domain? I have just bought myself a server and have 2 other pcs one a laptop, and have microsoft small business server 2000. I have a hub and all cables needed, and will use the server as a router. I am having problems in setting my internet up with blue yonder, seems to recognise it but not be able to use it, just keeps going back to recognise the modem page. Anyway i diverse, basically am happy to start all over and reformat if anyone knows an online tutorial to get me going I would appreciate any help, thanks in advance and again apologies if this is the wrong NG. phil Tag: default permissions revisited Tag: 164098
 - 17
 - DNS Problem here not sure how to fix Hi Everyone Have been given the role in our business to admin the network. We have a server running sbs2000 with about 10 clients, mostly windows 2000 pro boxes with a few xp machines. Connected to the network is a Netgear DG814 which is for our internet connection, the netgear also acts as our dhcp server. The problem we are having is that when a machine connects to the network it takes ages for both pre and post login, almost up to 30 minutes. On the workstations we are getting the following in the application even log 6/09/2004 3:18:20 PM Userenv Error None 1000 NT AUTHORITY\SYSTEM ADMIN01 Windows cannot determine the user or computer name. Return value (1722). in the system log 5789 N/A ADMIN01 Attempt to update DNS Host Name of the computer object in Active Directory failed. The updated value was 'ADMIN01'. The following error occurred: 6/09/2004 2:24:02 PM NETLOGON Error None 5788 N/A ADMINMAN Attempt to update HOST Service Principal Names (SPNs) of the computer object in Active Directory failed. The updated values were '<UNAVAILABLE>' and '<UNAVAILABLE>'. The following error occurred: The security context could not be established due to a failure in the requested quality of service (e.g. mutual authentication or delegation). I've tried doing what microsoft say but it doesn't work, can someone help me please thanks in advance Tag: default permissions revisited Tag: 164091
 - 18
 - DNS and firewall on SBS 2003 Anyone know how to remove the firewall from the SBS2003 to allow incoming DNS requests to be fulfilled? i attempted to go into routing and remote access and setting a service and ports map up for TCP port 53 but when i do a port scan it still shows it as closed. any help would be appreciated. Tag: default permissions revisited Tag: 164089
 - 19
 - <> Kevin [a bit waterlogged] and his song of the week news://msnews.microsoft.com/Od7AycgkEHA.644@tk2msftngp13.phx.gbl but he's nice and safe as I hope all other SBSers are ------------------------------------------ SMBNation is JUST around the corner. Everyone have safe flights. The next news of the week will be posted during the summit http://www.smbnation.com I'm looking forward to seeing folks and putting email addresses with faces! ----------------------------------------- The big news for the developer community but sort of "ho hum" for us was the changes going forward in Longhorn http://radio.weblogs.com/0001011/2004/08/30.html#a8167 --------------------------------------- Mariette and Marina are constantly adding content to www.smallbizserver.net Smallbizserver.Net > SBS 2003 > Exchange Server 2003 > Intelligent Message Filter on SBS 2003: http://www.smallbizserver.net/Default.aspx?tabid=174 ---------------------------------------- Patches out this week on Windows Update .NET Download details: .NET Framework 1.1 Service Pack 1 for Windows Server 2003: http://www.microsoft.com/downloads/details.aspx?FamilyID=ae7edef7-2cb7-4864-8623-a1038563df23&DisplayLang=en Sharepoint services sp1 Download details: Windows SharePoint Services Service Pack 1: http://www.microsoft.com/downloads/details.aspx?FamilyID=875da47e-89d5-4621-a319-a1f5bfedf497&DisplayLang=en ---------------------------------------- If after applying the Sharepoint SP1 service pack you are getting HTTP 500 or 0x80040E14 error: http://msmvps.com/bradley/archive/2004/09/03/12954.aspx --------------------------------------- Issue with the V5 version of Windows update and ISA Server: http://msmvps.com/bradley/archive/2004/09/04/13009.aspx -------------------------------------- Pssst.... can someone tell me what a Blob parser is? Download details: Windows SharePoint Services: Usage BLOB Parser: http://www.microsoft.com/downloads/details.aspx?FamilyID=8ed64398-4992-47cb-9075-afec32060986&DisplayLang=en ----------------------- Download details: Servers for Small Business: http://www.microsoft.com/downloads/details.aspx?FamilyID=cfb2223f-0fa2-4f2f-8585-796f120ecbe1&DisplayLang=en Power points for customers ------------------------ 875420 - How to enable Live Communication Server traffic through ISA Server 2000: http://support.microsoft.com/?kbid=875420 838906 - You may be disconnected when you connect a Windows XP-based computer to a remote server through a VPN, and you use an external firewall device or a NAT device: http://support.microsoft.com/?kbid=838906 -------------------------- In other news this week - - - - - - - - - - Copyright Office pitches anti-P2P bill A hotly contested wrangle in Congress over how to outlaw file-swapping networks just took a new twist. The U.S. Copyright Office has drafted a new version of the Induce Act that it believes will ban networks like Kazaa and Morpheus while not putting hardware such as portable hard drives and MP3 players on the wrong side of the law. http://news.com.com/Copyright+Office+pitches+anti-P2P+bill/2100-1027_3-5345528.html - - - - - - - - - - Further data security laws on the way Although a US draft bill calling for compulsory annual security audits to be carried out by publicly listed companies has been delayed until early next year, security experts said regulations of this kind are inevitable, both for US and UK firms. http://www.vnunet.com/news/1148994 - - - - - - - - - - Bagle variant lacks teeth The worm is being thwarted because most of the site from which it attempts to download malware cannot be contacted. Another version of the Bagle mass-mailing computer worm started spreading this week, but it probably won't get far, security experts said. http://news.zdnet.co.uk/internet/security/0,39020375,39165277,00.htm - - - - - - - - - - Critical Kerberos bugs surface Multiple vulnerabilities have been reported in version five of the widely-used Kerberos authentication protocol. The most serious could be exploited by crackers to gain root control to authentication servers. Exploits are yet to surface and patches are available. All releases of MIT Kerberos 5 up to and including krb5-1.3.4 are affected. At fault are "double-free vulnerabilities" in MIT Kerberos 5 implementation's Key Distribution Center (KDC) program and libraries. http://www.securityfocus.com/news/9449 http://news.zdnet.co.uk/internet/security/0,39020375,39165276,00.htm - - - - - - - - - - WinZip warns of security flaws in software Windows clients running the popular WinZip application are at risk from a number of critical security flaws, according to WinZip Computing Inc. and security researchers. The compression/ decompression tool is one of the most widely used piece of software on the Windows platform. http://security.itworld.com/4345/040902winzipflaw/page_1.html - - - - - - - - - - Army urged to step up IT security focus The security threat on DOD networks is growing substantially each day, so much so that on two separate occasions this summer, viruses infiltrated two top-secret computer systems at the Army Space and Missile Defense Command. Army Lt. Gen. Larry J. Dodgen, the command's leader, blamed the viruses, which appeared on the Defense Department's Secret Internet Protocol Router Network, on users and network administrators who were not conducting their jobs in a diligent fashion. http://www.gcn.com/vol1_no1/daily-updates/27138-1.html - - - - - - - - - - Microsoft warns spyware could foul up security update Though Microsoft Corp.'s new security update package is all about protecting systems from worms, viruses and spyware, it can't do much about what's already on computers -- and that could pose a problem. The company is warning users of the Windows XP operating system to check for spyware before downloading the free massive security update, called Service Pack 2. http://www.siliconvalley.com/mld/siliconvalley/news/editorial/9565886.htm SP2 plays havoc with online banking An Australian bank says installing the Windows update prevents users from logging into its Web interface. St.George Bank may be forced to make changes to its online banking interface as adoption of Windows XP Service Pack 2 becomes widespread among consumers. http://news.zdnet.co.uk/internet/security/0,39020375,39165283,00.htm WinXP SP2 = security placebo? http://www.theregister.co.uk/2004/09/02/winxpsp2_security_review/ Why SP2 deserved every shred of the scrutiny http://zdnet.com.com/2100-1105_2-5344180.html XP SP2 glitches to trip up one in 10 upgrades - report http://www.theregister.co.uk/2004/09/02/sp2_glitches_study/ Most US firms ignore spyware risk http://www.vnunet.com/news/1157773 - - - - - - - - - - Oracle patches finally released The database maker has fixed several flaws in its software as it attempts to move to a monthly patching schedule. Database software maker Oracle pushed out a host of long-awaited patches after struggling to organise its software fixes into a monthly release schedule. http://news.zdnet.co.uk/internet/security/0,39020375,39165278,00.htm - - - - - - - - - - Apache, open-source groups wary of Sender ID The Apache Foundation, an open-source development group, on Thursday pulled its support of the proposed antispam standard Sender ID, saying Microsoft's license requirements are too strict. The move by the group responsible for the popular Apache Web server comes as other open-source developers also voiced reservations about Microsoft's attempts to apply stringent license requirements to its contribution to the spam- fighting technology. http://zdnet.com.com/2100-1104_2-5345317.html - - - - - - - - - - Cybercrime is not limited by boundaries Computer crimes more and more assume transnational, organized and group character. Transnational character of computer crimes poses a certain social threat - a threat to the compound of the national security. Modern technologies gave an impetus to criminal activity as well as to the free trade and economy. http://www.crime-research.org/news/02.09.2004/604/ - - - - - - - - - - Cutting email cholesterol Each week vnunet.com asks a different expert to give their views on recent virus and security issues, with advice, warnings and information on the latest threats. This week Alasdair Kilgour, managing director of CommVault UK and Ireland, suggests some preventative steps for IT managers to adopt to reduce the email burden. http://www.vnunet.com/news/1157771 - - - - - - - - - - Tech threats: the new front in the War on Terror There's little doubt nowadays that the 21st century is shaping up to be a very unstable era in human history. Non-state actors like al-Qaeda are stepping up their fight against nation-states, employing mostly conventional, low-tech solutions to their acts of terrorism. http://www.cbc.ca/news/viewpoint/vp_hughes/20040901.html - - - - - - - - - - New WiFi security adds strong encryption A new security specification for wireless networking incorporates the Advanced Encryption Standard, opening the door for certification under the Federal Information Processing Standard. WiFi Protected Access 2 is a technical specification from the Wi-Fi Alliance based on the recently approved 802.11i standard. http://www.gcn.com/vol1_no1/daily-updates/27135-1.html - - - - - - - - - - Hummingbird stretches connectivity, security Hummingbird this week added new features in its Hummingbird Connectivity 10 suite, introduced secure-terminal software called Connectivity SecureTerm, and added other features to its security suite. The Connectivity 10 suite allows organizations to securely integrate heterogeneous legacy infrastructures with Windows desktops, enabling customers to meet business continuity and corporate governance requirements. http://zdnet.com.com/2110-1104_2-5339786.html - - - - - - - - - - Spam tide drowns email Email's usefulness is being downgraded because of the effort needed to filter out spam, says IDC. Rising tides of spam are drowning the usefulness of email, according to a new report from IDC. Spam has accounted for 38 percent of the 31 billion emails sent each day in North America in 2004, up from 24 percent in 2002, the market researcher said. http://news.zdnet.co.uk/communications/networks/0,39020345,39165256,00.htm Sendmail trials Sender ID http://news.zdnet.co.uk/internet/0,39020369,39165170,00.htm - - - - - - - - - - ID thief to the stars tells all Book excerpt: In "Your Evil Twin," MSNBC.com's Bob Sullivan argues that credit industry neglect led to the identity theft epidemic. Note: Last year, some 10 million people were victims of identity theft, and some estimates claim as many as 1 in 10 Americans have been hit by the crime in recent years. MSNBC.com's Bob Sullivan explores the digital epidemic in a new book, "Your Evil Twin." http://www.msnbc.msn.com/id/5763781/ -- http://www.sbslinks.com/really.htm Tag: default permissions revisited Tag: 164088
 - 20
 - SBS 2003, Exchange 2003 & Win XP Pro Client I have a SBS2003 Server with Win XP Pro Clients on the domain...All clients run outlook 2003 installed Via 2003 remote client install. In addition to the server configured Exchange mail account each Client has a manually configured POP3 Mail account for recieving and sending mail. My problem arises when I try to set this POP3 account as the default mail account through the mail applet in control panel at the client end. Although It is quite possible to do this it only remains the default account until the system is restarted at which point MS exchange is reassigned as default. Obviously this setting is being controlled somewhere within Exchange or Possibly in the User settings on the server. I also have a Win 2000 client with the same problem. Any thoughts? Ed Kivell Tag: default permissions revisited Tag: 164083
 - 21
 - SBS2003 + Exchange smtp causing internet problems Hi Everyone Been trying to work this one out all weekend but damned if I can. We currently install an SBS2003 Standard server to service about 15 staff members, Exchange is setup to run as our SMTP Server. Our current internet connect is a business grade Bigpond (Australia) account, 256/64. The problem I am having is that staff are sending out emails which are in the range of 4-7mb in size and sometimes they send this email to several email addresses, in turn what is happening is that bandwidth is being taken up, virtual stopping our internet connection. What can I do to fix this problem, in the next few weeks we will be upgrading to a faster connection, however i need to get a solution together before hand or else my butt is toast !!! Any help would be appreciated Tag: default permissions revisited Tag: 164068
 - 22
 - Can't install Critical Update 867461 (.NET 1.0 SP3) Hi, Windows Update is telling me I need Critical Update 867461, .NET Framework 1.0 Service Pack 3, but when I try to install it I get the following error. Can anyone suggest how to proceed? GaryK --------------------------------------------------------------------- SL3.TMP - Common Language Runtime Debugging Services Application has generated an exception that could not be handled Process id=0x8a8 (2216), Thread id=0x7b0 (1968) Click OK to terminate the application. Click Cancel to degug the application. ----------------------------------------------------------------------- Tag: default permissions revisited Tag: 164067
 - 23
 - << SBS Posting FAQ for New Users - V:1.0 - Last Updated: 2004-07-21>> An HTML version of this document is available at: http://www.sbs-rocks.com/netiquette.htm -------------- The following tips are designed to help you get the fastest and most appropriate answer to your questions. They suggest which newsgroup to use,what basic research to do before posting, information to include in your posting, newsgroup etiquette, and alternate sources of useful information. Following them will help us to help you. =================================================== - Post to the appropriate newsgroup: For SBS 4/4.5: microsoft.public.backoffice.smallbiz For SBS 2000 : microsoft.public.backoffice.smallbiz2000 For SBS 2003 : microsoft.public.windows.server.sbs Microsoft News Server: news.microsoft.com The SBS Newsgroups provide a free forum for threaded discussion and peer support on issues related to Small Business Server by users, service providers and interested parties. Please remember when posting that non Microsoft people don't get paid to be here, and MVPs are -not- Microsoft employees. { Who are the Microsoft MVPs ? http://mvp.support.microsoft.com/default.aspx?scid=fh;EN-US;mvpfaqs } Everyone here is giving generously and freely of their time, experience and expertise to enhance the Small Business Server Community. Join it, support it, respect it and enjoy it. - SBS Rocks ! =================================================== A Web interface to the SBS 2003 newsgroup is at: http://support.microsoft.com/newsgroups/?pr=newsgsbs2003 You'll find the Rules of conduct on the MS Website at: Welcome to Microsoft Discussion Groups http://communities2.microsoft.com/communities/newsgroups/en-us/default.aspx =================================================== - Do some basic researches for previously posted solutions. ( It's most likely been posted and solved before. ) Advanced Google Search: http://www.google.com/advanced_search Domain: microsoft.com experts-exchange.com Advanced Google Groups Search of the Usenet archives: http://groups.google.com/advanced_group_search Advanced Microsoft Search: http://search.microsoft.com/search/search.aspx?st=a&View=en-us (Note that you can also just enter a KB, Q or Error Number) Event Log Entries associated with your issue or setup: http://www.eventid.net (Enter the Event number from the Event Log) http://search.microsoft.com (Enter '1001' (for example) or 'error 1001') Your Public Interface: http://www.dnsreport.com http://www.dnsstuff.com Your network Settings on Servers and workstations: Start > Run > cmd : ipconfig /all Ports Status Start > Run > cmd : netstat -an =================================================== - Post with a meaningful subject line so those with expertise or interest in the topic can find it quickly. - Posting with a purely attention seeking topic such as "DISASTER" or "No-One Ever Responds to Me" may get you noticed -once- but is likely to get you ignored or dropped in future. Remember -everyone's- issue is important to them, so que jumping won't enhance anyone's opinion of you within the newsgroup. Mentioning the SBS component, Exchange, ISA, SQL Server, RAS, Pop Connector etc.in the heading will be a big help in catching the eye of experts in that field. =================================================== - If posting a Question, post with sufficient information for a complete stranger to understand your SBS version, environment; your issue, what you have tried and what failed. You're not cutting down on the typing as you'll be asked anyway, and it can only enhance the speed to diagnosis and resolution. A secondary benefit to this is that in correctly framing the question, the resolution often presents itself. Note: Stating your SBS version ( 4, 4.5, 2000, 2003 ) is particularly important as is whether your SBS 2003 is Standard or Premium and whether you have ISA installed. Please state all messages and IDs in failure notices and/or in the event viewers. Also what may have been installed/changed/updated prior to or during the issue. =================================================== - Posting In capitals on is considered SHOUTING! ...Please don't. =================================================== - Don't overlook or discount Paid Support. If the Issue is urgent or complex, the time you spend searching for a "free" solution. ...and cost factors such as Worker Downtime, Customer Irritation, Lost Productivity, and Hair Replacement costs will likely far outweigh the cost of a Support Call to Microsoft PSS (Product Support Services ) or a Support Professional. Note: Hotfixes are free of charge. Just ask for the specific Hotfix. =================================================== - It's difficult to convey human emotions on Usenet (Humour, Pathos, Sarcasm, Tongue-In-Cheek ) so use of emoticons and/or acronym tags is advised. .... and no; you -don't- have to be serious all the time. It's a community. Enjoy ! =================================================== - There are many paths to a solution and as many experiences in getting there as there are posters. Sometimes the paths are well worn, tried and true. Sometimes paths diverge, sometimes converge, and sometimes new trails are blazed. Understand and respect that, and use what suits you and your situation. =================================================== - People are different, but people are people. You should be nice to them. This is a technical newsgroup and not a place for Egos or Flame Wars. As a community we try to leave them at the door and respect each other. What you post here is archived and available to anyone, anytime. Remember ...."Please don't feed the Trolls!" =================================================== - Newsgroups are not your only source of Information / Help. Many of the members of the SBS Community provide support via Websites, Lists and Blogs such as: http://www.sbslinks.com/ ( Susan's Links to all things SBS) http://www.smallbizserver.net/ ( Mariette's Website and Forum ) http://www.sbs-rocks.com/articles.htm ( Andy's SBS Articles) http://www.sbsfaq.com/ ( Wayne's Website ) sbs2k@yahoogroups.com ( SBS Forum on Yahoo ) Blogs by: Chad, Charlie, Kevin, Susan http://www.msmvps.com/cgross/ http://blogs.msdn.com/canthe http://www.msmvps.com/kwsupport/ http://www.msmvps.com/bradley/ The Microsoft SBS Websites: Small Business Server Homepage for all sorts of Information, Demos, Whitepapers Upgrades, Migrations Events and Training http://www.microsoft.com/windowsserver2003/sbs/default.mspx Small Business Community Sharepoint Site: http://sbcomm.sts.winisp.net/default.aspx Downloads for Windows Small Business Server 2003 - Keep Your Server Up to Date - http://www.microsoft.com/windowsserver2003/sbs/downloads/default.mspx =================================================== - Don't be shy to post a Question ....or an Answer. SBS encompasses a lot and has been known to make even corporate SysAdmins Cringe and MCSEs cry. None of us knows -all- the answers. We were all "Newbies" once and none of us has experience with every permutation, combination, setup and environment SBS is deployed in, so there are -no- stupid or dumb questions. That's the domain of answers that imply that there are. If you're asking a question and know the answer to another one on the page, muck in and post it. The poster may get a faster resolution than they would have, and an additional member may get a response they wouldn't have otherwise Your solution may be a something that we can all learn from. - What goes around, comes around.- =================================================== - It's not only Break/Fix. Anecdotes, Wishlists, Insights and Brickbats are all grist to the mill of SBS Topics and all on-topic for the community. =================================================== - Don't Multi-post*. ( *the Same Posting within different newsgroups or within the same thread.) If you must post to several newsgroups, Cross-post to just the relevant ones. A response in one will then show up in the others and all can follow the thread. =================================================== - Be patient. Newsgroups are not Instant Messaging, and people aren't on-line just waiting for you to post. If the situation -is- that urgent, then Paid Support will pay for itself. Remember: No-one -owes- you a response. =================================================== - Things get missed. Things do get lost or missed, or someone with the appropriate skills or experience may not be available, so if you haven't had a response after 3 Days or so, post again, perhaps with more detail and things you've tried in the interim. ============================================ - Lastly, -enjoy - and remember, SBS Rocks ! For and on behalf of the SBS Community. SBS FAQ Poster *To avoid seeing this Post in the future add it to your Ignore Filter.* Tag: default permissions revisited Tag: 164066
 - 24
 - XP/SP2 and Recov Console Hi, FYI, you can install the Recovery Console onto XP/SP2 from a slipstreamed XP/SP2 CD or from the slipstreamed i386 directory copied from said slipstreamed CD. GaryK Tag: default permissions revisited Tag: 164064
 - 25
 - << INFO FOR WINDOWS UPDATE ISSUE - ISA Server 2000/Windows/Auto update <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"> <title></title> </head> <body> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> Windows Update on the v5 platform which is all XP sp2 machines Some XP sp1 machines [how to tell ... when the machine goes to Windows update there will be a v5 in the url name] Anyone running with ISA in the egress filtering mode [not all/all/all rule] will get this issue.  Adjust your ISA 2000's accordingly [The following info courtesy of Mr.  Jim "Mr. Isa" Harrison] Please note this also affects any other authenticating firewall [and not just ISA server] ------------------------------------------------------- There are two NTLM authentication issues affecting WU v5 when WU uses web proxy requests to access Windows Update:<u1:p></u1:p><o:p></o:p> 1 – NTLMSSP_AUTH responses may contain null credentials<o:p></o:p> <u1:p></u1:p> 2 – NTLMSSP_NEGOTIATE credentials may be sent on a half-closed connection<u1:p></u1:p><o:p></o:p> <u1:p> </u1:p><o:p></o:p> We haven’t heard any reports of WUv5 issues with non-NTLM (Basic, Digest) authentication yet and we haven’t specifically tested this.<u1:p></u1:p><o:p></o:p> We have been able to repro this with ISA Server 2000 and we have also heard reports of WU failing through other NTLM-authenticating proxy servers (Proxy 2, Squid are two examples).<u1:p></u1:p><o:p></o:p> The cause of each problem is still being worked out, but a clear workaround is available and it boils down to two things: <u1:p></u1:p><o:p></o:p> <ul type="disc" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Disable authentication for Windows Update requests.<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Disable “global authentication” for web proxy requests<u1:p></u1:p><o:p></o:p></li> </ul> <u1:p> </u1:p><o:p></o:p> ISA Server Note: you may have heard that the “ReturnDeniedIfAuthenticated registry setting explained in <a href="http://support.microsoft.com/?id=297324">http://support.microsoft.com/?id=297324</a> is part of the problem.  While applying this setting to ISA 2000 does help expose the WU authentication problems, it is not the cause. If you have applied this setting to your ISA 2000 Server, you did so with good reason to solve a specific problem. You should not remove this setting if you have applied it.  By the same token, if you are not experiencing the problem outlined in this KB article, you don’t need to and shouldn’t apply it.  The above article applies only to ISA 2000; you should not apply any ISA 2000 registry settings to ISA 2004 unless the relevant KB article explicitly instructs you to.  Currently, none do.<u1:p></u1:p><o:p></o:p> <u1:p> </u1:p><o:p></o:p> Now let’s get on with the workaround…<u1:p></u1:p><o:p></o:p> Per the WU team, there are four destinations that should be included for creating anonymous Windows Update access policies:<u1:p></u1:p><o:p></o:p> TABLE 1<u1:p></u1:p><o:p></o:p> <table style="margin-left: 30.2pt; border-collapse: collapse;" cellpadding="0" cellspacing="0" border="0" class="MsoNormalTable"> <tbody> <tr> <td style="border: 1pt solid windowtext; padding: 0in 5.4pt; width: 23.4pt;" valign="top" width="31"> Item<u1:p></u1:p><o:p></o:p> </td> <td style="border-style: solid solid solid none; border-color: -moz-use-text-color; border-width: 1pt 1pt 1pt medium; padding: 0in 5.4pt; width: 2.25in;" valign="top" width="216"> FQDN<u1:p></u1:p><o:p></o:p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color windowtext windowtext; border-width: medium 1pt 1pt; padding: 0in 5.4pt; width: 23.4pt;" valign="top" width="31"> 1<u1:p></u1:p><o:p></o:p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 2.25in;" valign="top" width="216"> *.download.microsoft.com<u1:p></u1:p><o:p></o:p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color windowtext windowtext; border-width: medium 1pt 1pt; padding: 0in 5.4pt; width: 23.4pt;" valign="top" width="31"> 2<u1:p></u1:p><o:p></o:p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 2.25in;" valign="top" width="216"> *.windowsupdate.com<u1:p></u1:p><o:p></o:p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color windowtext windowtext; border-width: medium 1pt 1pt; padding: 0in 5.4pt; width: 23.4pt;" valign="top" width="31"> 3<u1:p></u1:p><o:p></o:p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 2.25in;" valign="top" width="216"> *.windowsupdate.microsoft.com <u1:p></u1:p><o:p></o:p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color windowtext windowtext; border-width: medium 1pt 1pt; padding: 0in 5.4pt; width: 23.4pt;" valign="top" width="31"> 4<u1:p></u1:p><o:p></o:p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 2.25in;" valign="top" width="216"> windowsupdate.microsoft.com<u1:p></u1:p><o:p></o:p> </td> </tr> </tbody> </table> <u1:p> </u1:p><o:p></o:p> <u1:p> </u1:p><o:p></o:p> For ISA 2000<u1:p></u1:p><o:p></o:p> <ul type="disc" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Disable “global” authentication for web proxy requests<u1:p></u1:p><o:p></o:p></li> </ul> <ul type="disc" style="margin-top: 0in;"> <ol type="1" start="1" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Open the ISA Manglement MMC<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Select View, then Advanced<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Expand Servers and Arrays<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">R-click   <ArrayName>, select Properties<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Select Outgoing Web Requests<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Uncheck Ask Unauthenticated users for identification<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Click Apply, <u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">When prompted, select Save the changes and restart the service(s)<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Click OK<u1:p></u1:p><o:p></o:p></li> </ol> </ul> <u1:p> </u1:p><o:p></o:p> <ul type="disc" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Create a destination set for Windows Update domains<u1:p></u1:p><o:p></o:p></li> </ul> <ul type="disc" style="margin-top: 0in;"> <ol type="1" start="1" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Expand <ArrayName> and PolicyElements<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">R-click Destination Sets, select New, then Set<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Enter WindowsUpdate in the Name field, click Next<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Click Add<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Enter *.download.microsoft.com in the Domain field<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Leave the Path field blank<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Click OK<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Repeat steps 4 through 7 for each remaining entry in Table 1<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Click OK<u1:p></u1:p><o:p></o:p></li> </ol> </ul> <u1:p> </u1:p><o:p></o:p> <ul type="disc" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Create an anonymous Site and Content rule for Windows Update requests<u1:p></u1:p><o:p></o:p></li> </ul> <ul type="disc" style="margin-top: 0in;"> <ol type="1" start="1" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Expand Access Policy <u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">R-click Site and Content Rules, select New, then Rule<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Enter Windows Update in the Name field, click Next<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Select Allow, click Next<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Select Allow access based on destination, click Next<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">In the Apply this rule to: drop-down list, select Specified Destination Set<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">In the Name: drop-down list, select Windows Update<u1:p></u1:p><o:p></o:p></li> <li style="color: navy;" class="MsoNormal">Click Next, then Finish<u1:p></u1:p><o:p></o:p></li> </ol> </ul> <u1:p> </u1:p><o:p></o:p> <u1:p> </u1:p><o:p></o:p> For ISA 2004<o:p></o:p> <u1:p></u1:p> <ul type="disc" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Disable “global” authentication for web proxy requests<u1:p></u1:p><o:p></o:p></li> </ul> Open the ISA Manglement MMC<u1:p></u1:p><o:p></o:p> Expand <ArrayName>, then Configuration<u1:p></u1:p><o:p></o:p> Select Networks<u1:p></u1:p><o:p></o:p> In the middle pane, select the Networks tab<u1:p></u1:p><o:p></o:p> R-click Internal and select Properties<u1:p></u1:p><o:p></o:p> Select the Web Proxy tab<u1:p></u1:p><o:p></o:p> Click Authentication<u1:p></u1:p><o:p></o:p> In the Authentication window, uncheck Require all users to authenticate, click OK<u1:p></u1:p><o:p></o:p> Click Apply, then OK<u1:p></u1:p><o:p></o:p> Repeat steps 5 through 9 for each network object where you allow Web Proxy requests<u1:p></u1:p><o:p></o:p> <u1:p> </u1:p><o:p></o:p> <ul type="disc" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Create an anonymous Access Rule for Windows Update <u1:p></u1:p><o:p></o:p></li> </ul> In the left pane, R-click Firewall Policy and select New, then Access Rule<u1:p></u1:p><o:p></o:p> Enter Windows Update in the Name field, click Next<u1:p></u1:p><o:p></o:p> Select Allow, click Next<u1:p></u1:p><o:p></o:p> In the This rule applies to: drop-down list, select Selected Protocols<u1:p></u1:p><o:p></o:p> Click Add<u1:p></u1:p><o:p></o:p> In the Add Protocols dialog, expand Web<u1:p></u1:p><o:p></o:p> Select HTTP and click Add<u1:p></u1:p><o:p></o:p> Select HTTPS and click Add<u1:p></u1:p><o:p></o:p> Click Close, then Next<u1:p></u1:p><o:p></o:p> In the Access Rule Sources dialog, click Add<u1:p></u1:p><o:p></o:p> In the Add Network Entities dialog, expand Networks<u1:p></u1:p><o:p></o:p> Select Internal and click Add<u1:p></u1:p><o:p></o:p> For each network where you unchecked Require all users to authenticate, select that network object and click Add<u1:p></u1:p><o:p></o:p> Click Close, then Next<u1:p></u1:p><o:p></o:p> In the Access Rule Destinations window, click Add<u1:p></u1:p><o:p></o:p> In the Add Network Entities window menu bar, click New, then Domain Name Set<u1:p></u1:p><o:p></o:p> In the New Domain Name Set Policy Element window, enter Windows Update in the Name field<u1:p></u1:p><o:p></o:p> Click New<u1:p></u1:p><o:p></o:p> In the Domain names included in this set list, change the new entry to *.download.microsoft.com<u1:p></u1:p><o:p></o:p> Repeat steps 19 and 20 for each remaining entry in Table 1<u1:p></u1:p><o:p></o:p> Click OK<u1:p></u1:p><o:p></o:p> In the New Domain Name Set Policy Element window, select Windows Update, click Add, then Close<u1:p></u1:p><o:p></o:p> Click Next, Next, then Finish<u1:p></u1:p><o:p></o:p> In the top part of the middle pane, Apply and Discard buttons will appear; click Apply<u1:p></u1:p><o:p></o:p> When Apply New Configuration dialog reports “Changes to the configuration were successfully applied”, click OK<u1:p></u1:p><o:p></o:p> <u1:p> </u1:p><o:p></o:p> <ul type="disc" style="margin-top: 0in;"> <li style="color: navy;" class="MsoNormal">Make the Windows Update rule the first rule <u1:p></u1:p><o:p></o:p></li> </ul> NOTE: If you prefer to list all of your deny rules first, then you can make the Window Update rule the first rule following them<u1:p></u1:p><o:p></o:p> In the left pane, select Firewall Policy <u1:p></u1:p><o:p></o:p> If Windows Update is already the first rule in the list, stop here<o:p></o:p> <u1:p></u1:p> In the middle pane, select Windows Update<u1:p></u1:p><o:p></o:p> In the right pane select the Tasks tab<u1:p></u1:p><o:p></o:p> Click Move the selected rule up until Windows Update is the first rule in the list<u1:p></u1:p><o:p></o:p> In the top part of the middle pane, Apply and Discard buttons should appear; click Apply<u1:p></u1:p><o:p></o:p> When Apply New Configuration dialog reports “Changes to the configuration were successfully applied”, click OK<u1:p></u1:p><o:p></o:p> <u1:p> </u1:p><o:p></o:p> Look for a KB that details the WU side of the issue and cross-links to an ISA KB with these instructions. <pre class="moz-signature" cols="72">-- <a href="http://www.sbslinks.com/really.htm" class="moz-txt-link-freetext">http://www.sbslinks.com/really.htm</a></pre> <pre cols="72" class="moz-signature">-- <a class="moz-txt-link-freetext" href="http://www.sbslinks.com/really.htm">http://www.sbslinks.com/really.htm</a></pre> </body> </html> Tag: default permissions revisited Tag: 164062

Not sure about this one but it kind of doesn't seem normal
to me so anyone who has words of wisdom, it's muchly
apprecaited.

For some reason the root of C: has one permission set,
everyone / full control.

Seems scary to me and I don't know how it exactly happened
but I have suspicisions. Is there anywhere changes to
permissions are logged and by whom?

I have TID's and documents suggested in a previous post but
they don't say much regarding the root of C except to say
adjust as necessary. I can't imagine root of C:
everyone/full access is necessary.

Suggestions? Thanks again.

Top

Re: default permissions revisited by Martin

Martin
Thu Sep 09 16:09:19 CDT 2004

thanks anyway, figured it out

>>> Martin Stepanek<martin@image-technology.com> 09/09/2004
8:32:19 am >>>
Not sure about this one but it kind of doesn't seem normal
to me so anyone who has words of wisdom, it's muchly
apprecaited.

For some reason the root of C: has one permission set,
everyone / full control.

Seems scary to me and I don't know how it exactly happened
but I have suspicisions. Is there anywhere changes to
permissions are logged and by whom?

I have TID's and documents suggested in a previous post but
they don't say much regarding the root of C except to say
adjust as necessary. I can't imagine root of C:
everyone/full access is necessary.

Suggestions? Thanks again.

Top

default permissions revisited by rick

rick
Sun Sep 12 17:38:58 CDT 2004

I think it's a default setting for share permissions,
which is actually limited by the NTFS permission
inheritance and any group policy. This whole area is a
bit of a minefield.

Cheers,

Rick

>-----Original Message-----
>Not sure about this one but it kind of doesn't seem normal
>to me so anyone who has words of wisdom, it's muchly
>apprecaited.
>
>For some reason the root of C: has one permission set,
>everyone / full control.
>
>Seems scary to me and I don't know how it exactly happened
>but I have suspicisions. Is there anywhere changes to
>permissions are logged and by whom?
>
>I have TID's and documents suggested in a previous post
but
>they don't say much regarding the root of C except to say
>adjust as necessary. I can't imagine root of C:
>everyone/full access is necessary.
>
>Suggestions? Thanks again.
>.
>

Top