Firewall Configuration fails during Configure E-mail and Internet Connection Wizard on Windows 2003 SBS SP1

Please Type IPconfig All from a Command Prompt them post the result.
You said:
" We have recently switched their Internet service provider which required some minor reconfiguration of the server."
Could you tell me what was the configuration before changing Internet provider?
What is the configuration now?

Vico1

Vico1,

Here are the ipconfig results;

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : PMSA2K3DC
   Primary Dns Suffix  . . . . . . . : PMSA.local
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : Yes
   DNS Suffix Search List. . . . . . : PMSA.local

Ethernet adapter Network Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
   Physical Address. . . . . . . . . : 00-0E-0C-4F-10-04
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.0.1
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.254
   DNS Servers . . . . . . . . . . . : 192.168.0.1
   Primary WINS Server . . . . . . . : 192.168.0.1

Tunnel adapter Automatic Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Automatic Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : C0-A8-00-01
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : fe80::5efe:192.168.0.1%2
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Disabled

All I had to change was the ISP DNS server address, set the server to send and receive email via DNS routes rather than the ISP SMTP server, and re-applied the Web Services Configuration. Everything works great except the Firewall Configuration and the Web Services externally.

Any reason why this server is configured with 1 NIC?
You Know, Microsoft recommended configuration for SBS is 2 NICs, 1 for Internet and the other one for Intranet.

What do you use this tunnel adapter for?

The Configuration of SBS Server does not Enable, or Install IP version 6 That is maybe where your error is coming from.

Did you try to Disable The IP Version 6 Protocol?

Vico1!

Is This SBS Premium or Standard?
If Premium do you have ISA Installed?

Vico1!

In a small to medium business network setup and with the speed and bandwidth of broadband, we don't see any point in running two NICs for this client. They do not need any restriction of internet and requiring proxy is not an issue for them. Their ADSL router handels all the port forwarding. IPv6 is istalled but not currently enabled; but that is where the Pseudo-Interface comes from.

I ended up swapping NICs required as we had another issue with the first particular adapter this morning; this appeared to be either a driver or firewall issue, the server could ping itself, but nothing else on the network. The server is running SBS Standard, no ISA server. One memory module is also not being detected and therefore not being utilised. I will investigate this hardware issue onsite tomorrow.

Accdat,

The errors you are receiving in the CEICW are logged in that wizards log located at C:\Program Files\Microsoft Windows Small Business Server\Support\icwlog.txt

Please review that file to see what specificly ERRORed and post that back here.

However, I would suspect as well that it's the IPv6.  Since you aren't using it, uninstall it.  If that's not it, then the problem may be in the fact that you swapped the NICs and there is still some old data lingering around.  Make sure that the old NIC has been completely uninstalled in the device manager, and then run the "Change Server IP Address" wizard to reset everything correctly.  (Even though you will not actually be changing the IP and running it with the current IP, it'll reset everything related to the NIC).

Also, Microsoft doesn't necessarily support two NICs over one.  I do, however, think that's a better configuration for many reasons, but most importantly security.
But that's probably not going to change this issue one way or another.

Jeff
TechSoEasy

I also noticed in your screenshot that the Companyweb isn't showing up in IIS.  Have you not installed SharePoint yet?

Jeff
TechSoEasy

Jeff,

I did not initially configure this Server, so the reasons behind it current configuration are a little vague at the moment. The SharePoint Services entry is in Add Remove programs indicating that it had been installed at some stage but has possibly been manually deleted through IIS (this may be where it's having issues, although company web doesn't come up as an option in the Web Services settings during the wizard). I ran through the Internet Conection Wizard, only chaging the Web Services settings and found the entry for this in the logs, I can't see anything wrong with the log but here it is:


11/10/2006 2:21 PM
c:\Program Files\Microsoft Windows Small Business Server\Networking\ICW\wizinet.dll, version 5.2.2893.0
calling CNetCommit::ValidatePropertyBag ().
Call to Querying for the property bag () returned ok.
Call to Reading hardware selection () returned ok.
Hardware selection: 2
Call to Validating hardware selection () returned ok.

11/10/2006 2:21 PM
c:\Program Files\Microsoft Windows Small Business Server\Networking\ICW\wizrfire.dll, version 5.2.2893.0
calling CRFireCommit::ValidatePropertyBag (0xd086f8).
Call to This is a Router Single Nic configuration only Web Publishing will be configured, Basic Firewall will not be configured. () returned ok.
Call to Reading web publishing selection () returned ok.
Call to Reading OWA publishing selection () returned ok.
Call to Reading RUP publishing selection () returned ok.
Call to Reading Monitoring publishing selection () returned ok.
Call to Reading OMA publishing selection () returned ok.
Call to Reading RPC publishing selection () returned ok.
Call to Reading Companyweb publishing selection () returned ok.
Call to Reading ROOT publishing selection () returned ok.
Web publishing selections:
OWA publishing: 1
RUP publishing: 1
Monitoring publishing: 0
OMA publishing: 1
RPC publishing: 1
Companyweb publishing: 0
ROOT publishing: 1
Call to CRFireCommit::ValidatePropertyBag () returned ok.

11/10/2006 2:21 PM
c:\Program Files\Microsoft Windows Small Business Server\Networking\ICW\wizcert.dll, version 5.2.2893.0
Calling CCertCommit::ValidatePropertyBag
Require SSL for OWA: 1
Require SSL for Remote Portal: 1
Require SSL for Monitoring: 0
Require SSL for OMA: 0
Require SSL for CompanyWeb: 0
Require 128 Bit Encryption: 1
Cert selection: -1
CCertCommit::ValidatePropertyBag returned OK

11/10/2006 2:21 PM
c:\Program Files\Microsoft Windows Small Business Server\Networking\ICW\wizemail.dll, version 5.2.2893.0
calling CEmailCommit::ValidatePropertyBag ().
calling pdispPPPBag->QueryInterface (IPropertyPagePropertyBag, 0x6e50c).
Call to pdispPPPBag->QueryInterface () returned ok.
calling ReadInt4 (0xd086f8, DB5E5E45-3598-4F1D-8FF7-0ED35B9EB6A4).
Call to ReadInt4 () returned ok.
The out param of ReadInt4() is -1.
calling CValidatePropertyUtil.ValidatePropertyInteger ().
Call to CValidatePropertyUtil.ValidatePropertyInteger () returned ok.
Call to CEMailCommit::ValidatePropertyBag () returned ok.
calling CNetCommit::Commit (13666040).
calling CNetCommit::ValidatePropertyBag ().
Call to Querying for the property bag () returned ok.
Property bag is not dirty, skipping validation
calling CNetCommit::Common ().
Call to Configuring the time service () returned ok.
Call to Notifying RWW for ISA () returned ok.
Call to CNetCommit::Common () returned ok.
Call to CNetCommit::Commit () returned ok.
calling CRFireCommit::CommitEx (0xd086f8).
calling CRFireCommit::ValidatePropertyBag (0xd086f8).
Call to This is a Router Single Nic configuration only Web Publishing will be configured, Basic Firewall will not be configured. () returned ok.
Call to Reading web publishing selection () returned ok.
Call to Reading OWA publishing selection () returned ok.
Call to Reading RUP publishing selection () returned ok.
Call to Reading Monitoring publishing selection () returned ok.
Call to Reading OMA publishing selection () returned ok.
Call to Reading RPC publishing selection () returned ok.
Call to Reading Companyweb publishing selection () returned ok.
Call to Reading ROOT publishing selection () returned ok.
Web publishing selections:
OWA publishing: 1
RUP publishing: 1
Monitoring publishing: 0
OMA publishing: 1
RPC publishing: 1
Companyweb publishing: 0
ROOT publishing: 1
Call to CRFireCommit::ValidatePropertyBag () returned ok.
Call to GetPrivateNICGuid () returned ok.
Call to GetIPAddress for private nic () returned ok.
Call to GetSubnetMask for private nic () returned ok.
RUP is published
Call to Fixing the inheritance for root dir () returned ok.
Call to Unpublishing the default web site () returned ok.
Error 0x80070003 returned from call to Fixing the inheritance for companyweb dir().
calling Set Web Publishing Rules (0x80070003).
Error 0x80070003 returned from call to CRFireCommit::Commit().
Calling CCertCommit::CommitEx
Calling CCertCommit::ValidatePropertyBag
Nothing is published, will not touch SSL Settings
*** CCertCommit::ValidatePropertyBag returned ERROR 1
CCertCommit::CommitEx returned OK
calling CEmailCommit::Commit (0x258968).
calling CEmailCommit::ValidatePropertyBag ().
calling pdispPPPBag->QueryInterface (IPropertyPagePropertyBag, 0x6e488).
Call to pdispPPPBag->QueryInterface () returned ok.
calling ReadInt4 (0xd086f8, DB5E5E45-3598-4F1D-8FF7-0ED35B9EB6A4).
Call to ReadInt4 () returned ok.
The out param of ReadInt4() is -1.
calling CValidatePropertyUtil.ValidatePropertyInteger ().
Call to CValidatePropertyUtil.ValidatePropertyInteger () returned ok.
Call to CEMailCommit::ValidatePropertyBag () returned ok.
calling pdispPPPBag->QueryInterface (IPropertyPagePropertyBag, 0x6e4f4).
Call to pdispPPPBag->QueryInterface () returned ok.
calling ReadInt4 (0xd086f8, DB5E5E45-3598-4F1D-8FF7-0ED35B9EB6A4).
Call to ReadInt4 () returned ok.
The out param of ReadInt4() is -1.
calling GetDomainAndControllerNames ().
Call to GetDomainAndControllerNames () returned ok.
calling GetOrganizationName (\\PMSA2K3DC.PMSA.local, DC=PMSA,DC=local).
Call to GetOrganizationName () returned ok.
calling GetFirstAdministrativeGroup (\\PMSA2K3DC.PMSA.local, DC=PMSA,DC=local, PMSA).
Call to GetFirstAdministrativeGroup () returned ok.
calling GetFirstRoutingGroup (\\PMSA2K3DC.PMSA.local, DC=PMSA,DC=local, PMSA, first administrative group).
Call to GetFirstRoutingGroup () returned ok.
Call to SetCookieAuthentication () returned ok.
Call to Enabling Wireless admin for OMA () returned ok.
Call to Getting NETBIOS domain name () returned ok.
NETBIOS domain name: PMSA
Call to Enabling NTLM on /public () returned ok.
calling CommitPOP3 (0xd086f8).
Call to CommitPOP3 () returned ok.
calling _SetRegInt4Value (HKEY_LOCAL_MACHINE, SOFTWARE\Microsoft\SmallBusinessServer\Connectivity\ICW, Last_MailOption_Exchange, -1).
Ignoring return value from call to _SetRegInt4Value().
Call to CEMailCommit::Commit () returned ok.
calling GetBOConnector ().
Call to GetBOConnector () returned ok.
calling spADs->PutEx (ADS_PROPERTY_CLEAR, msExchSmtpOutboundSecurityPassword).
Call to spADs->PutEx () returned ok.
calling spADs->SetInfo ().
Call to spADs->SetInfo () returned ok.

I will uninstall IPv6 tomorrow morning when I go back out onsite and re-attempt the configuration of the Web Services; I am doubtful that this is going to have any affect but worth a try.

Jeff,

After reviewing the log and searching for "Error":

Error 0x80070003 returned from call to Fixing the inheritance for companyweb dir().
calling Set Web Publishing Rules (0x80070003).
Error 0x80070003 returned from call to CRFireCommit::Commit().
Calling CCertCommit::CommitEx
Calling CCertCommit::ValidatePropertyBag
Nothing is published, will not touch SSL Settings
*** CCertCommit::ValidatePropertyBag returned ERROR 1

I believe my best course of action to be the following;

This does seem to reference companyweb as being a potential issue, if it doesn't exist, perhaps I should remove SharePoint Services entirely from Add / Remove Programs, un-install IPv6, shutdown server, investigate memory issue, startup, run IP Change Wizard, retry Internet Connection Wizard. Post Results.

When you swapped the NIC If you didn't uninstall the drivers before removing the hardware, It cuase errors just like Jeff mentioned above.

1 NIC configuration is not going to cause any problems. It's a friendly reminder (for security Issue).

I would uninstall the IPV6 Protocol.
If you didn't Uninstall the drivers on the old NIC, I would reinsert yhe Hardware and properly uninstall the drivers.
Then run ICW

vico1!
 

Course of action to be taken tomorrow;

1. CompanyWeb website missing in ISS causing potential issue with IC Wizard; remove SharePoint services from Add/Remove Programs.
2. IPv6 installed but not enabled; unsure why this is installed, remove.
3. To address NIC issues experienced, uninstall driver for both onboard NICs (Reinstall on reboot).
4. Shutdown server and investigate memory module issue.
5. Startup server, reconfigure IP settings using IP Change Wizard.
6. Retry Internet Connection Wizard.
7. Post results.

I will let you know how I go, thanks for the advice!

Berg

Jeff,

I carried out the work that I specified yesterday; you are correct in observing the method I took was a shotgun approach.

I will provide you with some additional information in regards to the NIC failure I experienced yesterday to give you a better understanding of why it was necessary to take this approach.

On Monday, I setup the new ADSL2+ connection. On Tuesday morning, I received an email indicating that their Website was offline, so I investigated the cause. At this point I noticed the server to be running slower than usual, so I checked its resources and noticed that half the memory was missing. I requested the server be shutdown on Wednesday morning, the power removed from the server and it be start back up to eliminate any transient power issues that may have affected the memory. This made no change to the memory. I again ran the Internet Connection Wizard, this once again failed at the same point, I manually set the permissions on the default website.

I later received a phone call advising me that everyone had lost their connection to the server. I talked a staff member through troubleshooting the failure point by pinging network devices from the server and a workstation. I isolated the network problem with the server adaptor. The server could ping its IP address, but nothing else on the network. I re-applied the IP configuration and rebooted the server; there was no change in the adaptor functionality. In a last ditch attempt to get the server operational, I disabled the adaptor clearing its IP settings and enabled the secondary adaptor. I applied the IP setting and tested the connection to the server. The issue was temporarily resolved and the server operational until the point that I could get out onsite to physically inspect the server. I did not have the resources to conclusively locate the error with this adaptor at the time; hence they reason of failure was unknown at this stage.

Due to the lack of time and the multiple issues I had to deal with, I had to complete as much work as possible in the given time. My incentives in order of priority were; to locate faulty module and/or test main board for slot issues, resolve issues with the NIC adaptor and test its functionality, remove IPv6 as a possible issue with Firewall Configuration, remove SharePoint Services and retry the Internet Connection Wizard. The Firewall and Web Services issue is not critical in this case; this can be resolved over time and is not preventing the operation of their hosted website. Their email is functional and their clients can obtain information that they require – remote access to their email and computers through Web Services is not mission-critical for this business.

I cannot see how any of the procedures I carried out this morning should have affected the other in terms of operation; I had multiple goals to achieve in a limited time frame and this seemed to be the most efficient course of action given my limited knowledge of the server history and my knowledge of SharePoint Services. I realise that SBS is prone to issues by modifying its default operating environment; I did not deleted SharePoint from ISS, nor did I setup their current website, all I know is that whoever has done this has created issues with SharePoint and its integration with SBS preventing the wizard from applying the security setting required to access Web Services from external addresses.

I now know that un-installing SharePoint Services has not fixed the issue and that further steps are required to be taken to repair IIS. The customer has also ordered a memory upgrade to help with their database application. Even with both modules working they were consistently utilizing over 95% of the available memory. Once this memory has arrived I will go out onsite early in the morning, install the new memory which will help with the speed of repairs and follow the guides you have mentioned to repair IIS and SharePoint Services.

Thanks for your help and advice, I am learning a great deal about SharePoint in this process and how it ties in with SBS. I will let you know how I go with the repair.

Regards,

Berg

Jeff,

Can you suggest anything else at this point before I go back?

Thanks, Berg

The fact is that all of the issues you list would not have occurred if you had sucessfully completed the CEICW when you put in the new DSL connection.  This single wizard is the most important piece of an SBS configuration and cannot be left undone, nor can it be left with errors.  There would have been no reason to troubleshoot the point of failure, and I believe that the NIC most likely didn't fail.  

I'm quite certain that the IPv6 caused a misconfiguration that if it was originally removed you would have completed the CEICW successfully.  Of course, there's no way to know this for sure... but as I stated in my suggested action plan... if you don't clear that up, you will have no idea what is or isn't working.

Jeff
TechSoEasy

Jeff,

The Web Services sites worked fine internally from the network. My assumption was that even though Sharepoint Services was not working correctly, the links between IIS and Exchange were infact working correctly. The sites worked fine, it was external access that was producing the page error.

I therefore only followed the Sharepoint re-installationg guide. After re-installing Sharepoint with Windows 2003 SP1 CD's, I applied the SharePoint SP2 and re-ran the Internet Connection Wizard. The Wizard completed successfully and I can now access the Web Services site remotely.

Thanks for you help!

Berg

Terrific... glad you got it worked out.

Jeff
TechSoEasy