GinEric
asked on
NVidia Firewall will not load into Internet Explorer after PDC role removal with hostname and domainname change
nVidia Firewall will not load into Internet Explorer after PDC role removal after having removed the role and changed the hostname and domainname.
Does anyone know how to fix this?
Does anyone know how to fix this?
ASKER
With Microsoft on the phone, completely removed it and started over. I've since found, after reinstalling the nVidia drivers, that it is a permissions problem coming from Windows Server 2003 R2.
I got an nVidia error #1 after reinstall and trying to use Network Access Manager
The Forceware Web Interface service terminated with service-specific error 1 (0x1).
and thousands of DCOM errors that say some SID does not have permission to :
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
Something basic is disallowing the redirection of the frontend of nVidia which uses it's own Apache instance as an interface to configure the firewall settings.
It may not matter much, since on Monday we're stripping the servers of this version of Windows Server and installing a new one.
I believe Windows is disallowing execution of the basic cgi scripts, but can't find out how it's doing that. What paranoiaware! I can handle security and I really don't need all this extra junk which stops things by default. I wish they'd let administrator think for themselves, instead of giving into the general public's fears about stopping everything from executing.
I got an nVidia error #1 after reinstall and trying to use Network Access Manager
The Forceware Web Interface service terminated with service-specific error 1 (0x1).
and thousands of DCOM errors that say some SID does not have permission to :
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
Something basic is disallowing the redirection of the frontend of nVidia which uses it's own Apache instance as an interface to configure the firewall settings.
It may not matter much, since on Monday we're stripping the servers of this version of Windows Server and installing a new one.
I believe Windows is disallowing execution of the basic cgi scripts, but can't find out how it's doing that. What paranoiaware! I can handle security and I really don't need all this extra junk which stops things by default. I wish they'd let administrator think for themselves, instead of giving into the general public's fears about stopping everything from executing.
what a bit of fun,
i have seen issues with NVIDIA firewall before so it doesnt really surprise me that there is yet again issues with it.....
i have seen issues with NVIDIA firewall before so it doesnt really surprise me that there is yet again issues with it.....
ASKER
It's not nVidia, it's Windows, of that I'm sure because I have a production server Apache running side by side with it, but I have to define the ScriptsAlias and add other executeable directories to that Apache. It too has cgi-bin problems owing to Windows permissions paranoia, considering the Data Execution Prevention [DEP], a builit in Windows Firewall that is junk, an attempt at a built in Windows antivirus that is junk, a DNS that is non RFC compliant, a web browser that is non html compliant, and a lot more non compliant Windows software.
And we're Microsoft Developers and Partners!
We're constantly on the phone with them, at Microsoft Headquarters. It took us a month to get a version of Windows Server 2003 because the distributors and resellers couldn't find a copy! This from the pressing plant, which we believe must be in Puerto Rico [that's what the box says!], and a complete breakdown in the distribution chain.
It was hard enough acquiring XP Pro 64-bit, which also took over week. Next week we'll be full 64-bit, ready for Vista and perhaps a Vista Server, if they get that far this year. But it looks like there are going to be real fun problems when that comes out!
It will sell, no doubt, and there will be about a million experts telling people how to fix problems, but, like our block of IP questions, I think the answers will be just too simple for some to figure out.
I'm going to get some manuals and the debugger for this system and see if I can't pinpoint what is causing this permissions problem with Windows.
And we're Microsoft Developers and Partners!
We're constantly on the phone with them, at Microsoft Headquarters. It took us a month to get a version of Windows Server 2003 because the distributors and resellers couldn't find a copy! This from the pressing plant, which we believe must be in Puerto Rico [that's what the box says!], and a complete breakdown in the distribution chain.
It was hard enough acquiring XP Pro 64-bit, which also took over week. Next week we'll be full 64-bit, ready for Vista and perhaps a Vista Server, if they get that far this year. But it looks like there are going to be real fun problems when that comes out!
It will sell, no doubt, and there will be about a million experts telling people how to fix problems, but, like our block of IP questions, I think the answers will be just too simple for some to figure out.
I'm going to get some manuals and the debugger for this system and see if I can't pinpoint what is causing this permissions problem with Windows.
good luck with it mate, all out of my side of things now, all the best though
ASKER
What I'm down to: Installing the role of Domain Controller subtracts the automatic "localhost" pseudo domainname privileges therefrom.
nVidia chipset manufacturers install their configuration utilities using Apache2. Because Windows Server 2003 (R2) has more than strict default security settings the nVidia chipset drivers which rely on Apache2 for viewing and configuration of their onboard [as well as Asus' onboard nVidia chipset] Ethernet.
http://www.musics.com/manhtml/nVidia/nForce4.Marvell.onboard/Report.htm
http://www.musics.com/manhtml/nVidia/Devices/Devices.Report.html
While this Network Access Manager will run on kiddie computers [and other non Fully Qualified Doman Name systems named "localhost"], it will not run on real servers under Windows Server 2003 (R2) because that Operating System is POSIX compliant with respect to Apache not running as localhost.
That means that while nVidia made a wise choice in using the httpd server for the http [the World Wide Web, of which Internet Explorer is a client and Internet Information Server is an emulating server] because this is where all forms of word processing and information exchange are headed, they did not know how to install their frontend properly. They did not take the time to run their daemon in a chrooted jail, which means they did not take the time to run the service as a user, rather than the local system account. The local system account is localhost and no service should be run as such, which is to say as "localhost."
So now we come across how to fix it. The service must be started with a command of this type:
"D:\nVidia\NETWOR~1\Apache
if the service name is NetworkAccessManager.exe and has been installed with that name, or, by changing the name Apache.exe to NetworkAccessManager.exe to distinguish it from any other Apache or web server service.
Done per http://httpd.apache.org/docs/2.2/platform/windows.html on this particular machine.
Because nVidia made no provisions to do the proper install for Windows, per the above, which should have been:
apache -k uninstall -n "NetworkAccessManager.exe"
one has to do a "workaround" to get it to work. This involves creating a user for the service, and giving it the proper permissions to Grant Local Activation and to then fix this error:
"The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BC866CF2-5486-41F7-B46B-9
to the user Enterprise\username SID (S-1-5-21-837930903-147659
which leads to this Microsoft Advistory:
10016 DCOM EVENT_COM_ACCESS_DENIED_IN
A simple "Access Denied" for the service to start. Finding this permission, however, is more of a task. Per the article :
http://support.microsoft.com/kb/913119/en-us
2.e. is changed to selecting a username, instead of the IUSR_ServerName [apparently this still doesn't work with a real PDC hostname, so you can use the chrooted user instead]. Thereafter following the advisroy and setting the Launch Activation Allow checkbox for that user.
When a service is run as a user with the ability to restrict permissions, this is called a Chrooted Jail. CH is from chmod, the permission command in Linux ported to Windows by C and Linux programmers, root is the root user meaning that root or the built in Administrator or System Authority account is overseeing this process, and Jail means that that service [daemon] is within the jail set by the permissions and the administrative account, that is, it cannot access objects outside of its confines.
This error began showing up with nearly all new chipsets, since about 2004, regarding Via and nVidia, particularly on their drivers for the onboard chipset, when using a layer controlled under the Data Execution Prevention [DEP] strategic hardware design of the 64-bit systems architecture. This architecture is a necessary prerequisite for DEP because it includes a Special Operator in the Microprocessor to control the lowest level of access, which should always be "supervised" by the Operating System. Set the Special Ops bit, and call an Operating System routine to handle any program as a subtask, such as controlling the fan speeds, checking temperatures, and all functions within the Control Mode Set [Supervisory and Privileged Mode of Intel, AMD, and Citrix microprocessors, as well as Motorola microprocessors (which had this feature 25 years ago)].
Take a good look here: http://en.wikipedia.org/wiki/AMD64
Under "No Execute Bit" ; that is "Our Design!" from over 30 years ago, just now being implemented in microprocessors. Without "Our Bit," you don't have Data Execution Prevention, however, this is at a cost in that you must now allow for application and user permissions to launch and execute outside of the system areas, and, this must be done under System Authority.
So, I knew this problem was a DEP problem as soon as it failed to launch or execute, and/or load a web page that needed to launch and execute, as do the cgi and other executeable scripts found on many web pages, including .asp and .cgi
I simply did not know where Microsoft had implemented it in their billions of bytes of Operating System software. I still do not know all of the locations of its implementation in the DEP architecture as assigned by the mostly Redmund programmers, and others around the world, the developers and partners, like us.
Mostly, the problem is borne out of lowe level training that is completely unaware of how this architecture has been implemented. Since Unisys, it's owners, stockholders, and employees, retired or not, own the copyrights and patents to these innovations, Microsoft, AMD, Intel, perhaps Citrix and others who use the 64-bit design, must have a standing agreement with these copyright and patent owners through Unisys [whose foundation is aboriginally Univac and Burroughs, the two J. Presper Eckert and John Mauchly companies] in order to use these copyrighted and patented creations and discoveries, hence, the announcements of the partnering of all of these with Unisys.
Many trainees and even degreed IT and computer professionals are completely unaware of this architecture and these legal requirements, and the 64-bit systems are, at best, vagueries to them. Not realising that there are actual designers of these systems sitting right here discussing problems with the 64-bit emulated copies of these mainframe architectures [AMD, Intel, Citrix, et ux en toto], a lack of understanding may exist at some levels.
But since this is a relevant problem that encompasses nearly all aspects of the new Windows 64-bit Operating Systems, this platform, this Experts Exchange, has been lucky enough to have such experts here fully detailing the operation for those who need to know them in order to understand how their network and system architecture actually works, and thereby to quickly spot and resolve problems.
The question was to see if anyone had had this problem before. If they had lost the ability to execute programs at some point under Windows Server 2003 (R2).
I did not expect anyone to explain it as I have. I'll award the points to anyone who participates and formulates the points I've made above if they agree and it solves any of their execution permissions problems. After all, I can't award them to myself, and the fact is that DEP is going to play an extremely important role in Vista, when it arrives. Those who don't understand this basic design concept will have a hard time in troubleshooting and fixing problems related to execute and access permissions on Windows Server 2003 (R2) 64-bit and the upcoming Vista Server versions.
I often find the depth of information I provide is very comprehensive, simply because I'm involved in the design and don't want to trivialize or skip over what I consider to be critically important, as this area involving the Execute Bit is, but this is written mostly as my "draft" copy of what will appear on my site; if Experts Exchange wishes to use it, I grant the right to re-publish, but require that the author be fully credited.
Which is fairly generous, since it's the most accurate information there is, from one of the designers himself. I could have just put it all in a book, which would have cost dearly, but I felt that sharing the information was a kind gesture and the right thing to do for those who have an exceptional interest in Systems Architecture and Operating Systems Design.
Plus, it helps me to get valid feedback for the upcoming books.
Thanks. Add and ask away and I'll award the points shortly.
nVidia chipset manufacturers install their configuration utilities using Apache2. Because Windows Server 2003 (R2) has more than strict default security settings the nVidia chipset drivers which rely on Apache2 for viewing and configuration of their onboard [as well as Asus' onboard nVidia chipset] Ethernet.
http://www.musics.com/manhtml/nVidia/nForce4.Marvell.onboard/Report.htm
http://www.musics.com/manhtml/nVidia/Devices/Devices.Report.html
While this Network Access Manager will run on kiddie computers [and other non Fully Qualified Doman Name systems named "localhost"], it will not run on real servers under Windows Server 2003 (R2) because that Operating System is POSIX compliant with respect to Apache not running as localhost.
That means that while nVidia made a wise choice in using the httpd server for the http [the World Wide Web, of which Internet Explorer is a client and Internet Information Server is an emulating server] because this is where all forms of word processing and information exchange are headed, they did not know how to install their frontend properly. They did not take the time to run their daemon in a chrooted jail, which means they did not take the time to run the service as a user, rather than the local system account. The local system account is localhost and no service should be run as such, which is to say as "localhost."
So now we come across how to fix it. The service must be started with a command of this type:
"D:\nVidia\NETWOR~1\Apache
if the service name is NetworkAccessManager.exe and has been installed with that name, or, by changing the name Apache.exe to NetworkAccessManager.exe to distinguish it from any other Apache or web server service.
Done per http://httpd.apache.org/docs/2.2/platform/windows.html on this particular machine.
Because nVidia made no provisions to do the proper install for Windows, per the above, which should have been:
apache -k uninstall -n "NetworkAccessManager.exe"
one has to do a "workaround" to get it to work. This involves creating a user for the service, and giving it the proper permissions to Grant Local Activation and to then fix this error:
"The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BC866CF2-5486-41F7-B46B-9
to the user Enterprise\username SID (S-1-5-21-837930903-147659
which leads to this Microsoft Advistory:
10016 DCOM EVENT_COM_ACCESS_DENIED_IN
A simple "Access Denied" for the service to start. Finding this permission, however, is more of a task. Per the article :
http://support.microsoft.com/kb/913119/en-us
2.e. is changed to selecting a username, instead of the IUSR_ServerName [apparently this still doesn't work with a real PDC hostname, so you can use the chrooted user instead]. Thereafter following the advisroy and setting the Launch Activation Allow checkbox for that user.
When a service is run as a user with the ability to restrict permissions, this is called a Chrooted Jail. CH is from chmod, the permission command in Linux ported to Windows by C and Linux programmers, root is the root user meaning that root or the built in Administrator or System Authority account is overseeing this process, and Jail means that that service [daemon] is within the jail set by the permissions and the administrative account, that is, it cannot access objects outside of its confines.
This error began showing up with nearly all new chipsets, since about 2004, regarding Via and nVidia, particularly on their drivers for the onboard chipset, when using a layer controlled under the Data Execution Prevention [DEP] strategic hardware design of the 64-bit systems architecture. This architecture is a necessary prerequisite for DEP because it includes a Special Operator in the Microprocessor to control the lowest level of access, which should always be "supervised" by the Operating System. Set the Special Ops bit, and call an Operating System routine to handle any program as a subtask, such as controlling the fan speeds, checking temperatures, and all functions within the Control Mode Set [Supervisory and Privileged Mode of Intel, AMD, and Citrix microprocessors, as well as Motorola microprocessors (which had this feature 25 years ago)].
Take a good look here: http://en.wikipedia.org/wiki/AMD64
Under "No Execute Bit" ; that is "Our Design!" from over 30 years ago, just now being implemented in microprocessors. Without "Our Bit," you don't have Data Execution Prevention, however, this is at a cost in that you must now allow for application and user permissions to launch and execute outside of the system areas, and, this must be done under System Authority.
So, I knew this problem was a DEP problem as soon as it failed to launch or execute, and/or load a web page that needed to launch and execute, as do the cgi and other executeable scripts found on many web pages, including .asp and .cgi
I simply did not know where Microsoft had implemented it in their billions of bytes of Operating System software. I still do not know all of the locations of its implementation in the DEP architecture as assigned by the mostly Redmund programmers, and others around the world, the developers and partners, like us.
Mostly, the problem is borne out of lowe level training that is completely unaware of how this architecture has been implemented. Since Unisys, it's owners, stockholders, and employees, retired or not, own the copyrights and patents to these innovations, Microsoft, AMD, Intel, perhaps Citrix and others who use the 64-bit design, must have a standing agreement with these copyright and patent owners through Unisys [whose foundation is aboriginally Univac and Burroughs, the two J. Presper Eckert and John Mauchly companies] in order to use these copyrighted and patented creations and discoveries, hence, the announcements of the partnering of all of these with Unisys.
Many trainees and even degreed IT and computer professionals are completely unaware of this architecture and these legal requirements, and the 64-bit systems are, at best, vagueries to them. Not realising that there are actual designers of these systems sitting right here discussing problems with the 64-bit emulated copies of these mainframe architectures [AMD, Intel, Citrix, et ux en toto], a lack of understanding may exist at some levels.
But since this is a relevant problem that encompasses nearly all aspects of the new Windows 64-bit Operating Systems, this platform, this Experts Exchange, has been lucky enough to have such experts here fully detailing the operation for those who need to know them in order to understand how their network and system architecture actually works, and thereby to quickly spot and resolve problems.
The question was to see if anyone had had this problem before. If they had lost the ability to execute programs at some point under Windows Server 2003 (R2).
I did not expect anyone to explain it as I have. I'll award the points to anyone who participates and formulates the points I've made above if they agree and it solves any of their execution permissions problems. After all, I can't award them to myself, and the fact is that DEP is going to play an extremely important role in Vista, when it arrives. Those who don't understand this basic design concept will have a hard time in troubleshooting and fixing problems related to execute and access permissions on Windows Server 2003 (R2) 64-bit and the upcoming Vista Server versions.
I often find the depth of information I provide is very comprehensive, simply because I'm involved in the design and don't want to trivialize or skip over what I consider to be critically important, as this area involving the Execute Bit is, but this is written mostly as my "draft" copy of what will appear on my site; if Experts Exchange wishes to use it, I grant the right to re-publish, but require that the author be fully credited.
Which is fairly generous, since it's the most accurate information there is, from one of the designers himself. I could have just put it all in a book, which would have cost dearly, but I felt that sharing the information was a kind gesture and the right thing to do for those who have an exceptional interest in Systems Architecture and Operating Systems Design.
Plus, it helps me to get valid feedback for the upcoming books.
Thanks. Add and ask away and I'll award the points shortly.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
thankyou mate, even though i did nothing to help you!
all the best
all the best
ASKER
Sometimes listening is enough.
What I did to make nVidia Firewall work:
01.) copy D:\nVidia\NetworkAccessMan
02.) Renamed D:\nVidia\NetworkAccessMan
03.) Created user nobody [the normal Apache chrooted jail]
04.) Granted "Launch Applications" to nobody
05.) borrowed the startup command "D:\Program Files\Apache Software Foundation\Apache2.2\bin\h
06.) used it this way "D:\nVidia\NETWOR~1\Apache
and that from a command prompt. It runs now and I can once again configure my firewall using the nVidia tray icon.
nVidia is just so much more configurable than Microsoft Firewall and it was worth all of the effort. It's also a lot easier to find than the Windows Security popup and the Windows Firewall administration popup. In searching the internet for the error and solution, to :
"The Forceware Web Interface service terminated with service-specific error 1 (0x1)."
I found no definitive answers since the nVidia creation, about 2004. Googling will show this non-result. The answer, as I suspected it would be, was to solve it myself, hopefully with expert help. Even if someone would only listen, that is enough to solve a problem very often. Up to this point Jay_Jay70, no other expert did listen. For that I thank you. You will make one of the best experts there is here, because you listen.
As for others who often criticized the aboriginal question, which was deleted here, this answer stands as a monument that will come to haunt many henceforth.
"The customer is always right." J.C. Penny
to paraphrase:
"The questioner is always right." GinEric
Don't you just love it when your'e right? This question and answer is classic. And my bet is that it will be the #1 solution for this problem, from experts exchange and from Musics.com
https://www.experts-exchange.com/questions/21870899/NVidia-Firewall-will-not-load-into-Internet-Explorer-after-PDC-role-removal-with-hostname-and-domainname-change.html#16829874
http://www.musics.com/manhtml/nVidia/A_21870899.Q_21870899.html#16829874
The last word.
What I did to make nVidia Firewall work:
01.) copy D:\nVidia\NetworkAccessMan
02.) Renamed D:\nVidia\NetworkAccessMan
03.) Created user nobody [the normal Apache chrooted jail]
04.) Granted "Launch Applications" to nobody
05.) borrowed the startup command "D:\Program Files\Apache Software Foundation\Apache2.2\bin\h
06.) used it this way "D:\nVidia\NETWOR~1\Apache
and that from a command prompt. It runs now and I can once again configure my firewall using the nVidia tray icon.
nVidia is just so much more configurable than Microsoft Firewall and it was worth all of the effort. It's also a lot easier to find than the Windows Security popup and the Windows Firewall administration popup. In searching the internet for the error and solution, to :
"The Forceware Web Interface service terminated with service-specific error 1 (0x1)."
I found no definitive answers since the nVidia creation, about 2004. Googling will show this non-result. The answer, as I suspected it would be, was to solve it myself, hopefully with expert help. Even if someone would only listen, that is enough to solve a problem very often. Up to this point Jay_Jay70, no other expert did listen. For that I thank you. You will make one of the best experts there is here, because you listen.
As for others who often criticized the aboriginal question, which was deleted here, this answer stands as a monument that will come to haunt many henceforth.
"The customer is always right." J.C. Penny
to paraphrase:
"The questioner is always right." GinEric
Don't you just love it when your'e right? This question and answer is classic. And my bet is that it will be the #1 solution for this problem, from experts exchange and from Musics.com
https://www.experts-exchange.com/questions/21870899/NVidia-Firewall-will-not-load-into-Internet-Explorer-after-PDC-role-removal-with-hostname-and-domainname-change.html#16829874
http://www.musics.com/manhtml/nVidia/A_21870899.Q_21870899.html#16829874
The last word.
Thankyou GinEric and congrats on a pretty hectic solution, you obviously have a brain on you and will do well yourself
Cheers Mate
James
Cheers Mate
James
ASKER
Thanks. I now know how to fix all my servers and how to share the fix for a lot of nVidia and Microsoft conflicts, video, sound, ethernet, with others.
where di you remove the role to?