• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2793
  • Last Modified:

ISA 2004 Services won't start on SBS 2003

A customer has a new-ish (3-4 weeks) SBS 2003 Premium R2 install on a HP Proliant ML150 G5 server with 2 x quad core CPUs.

Today, the Microsoft Firewall service has decided it doesn't want to run anymore and so the ISA Server services are also failing to start.

I'm getting Error 1068 when I try to start the Microsoft Firewall & Microsoft ISA Server Job Scheduler services, and Error 1067 when I try to start the Microsoft ISA Server Control Service.

In the Application log I'm getting Event ID 7024 - "The Microsoft ISA Server Control service terminated with service-specific error 3221239581 (0xc000371d)"
and also Event ID 1000 - "Faulting application mspadmin.exe, version 4.0.2167.887, stamp 462cc523, faulting module ntdll.dll, version 5.2.3790.4455, stamp 49900e8a, debug? 0, fault address 0x0001a379".

When I've had these in the past it's always been because of the multi-core CPU's so I've just applied the ISA service pack 3 and the problem was fixed.

This time the server was fully patched. I tried re-installing ISA 2004 SP3 and also completely uninstalling ISA and reinstalling ISA and then applying the service packs, but still the same problem exists. Currently I've got ISA uninstalled so the customer can use the internet but they really need some of the functionality of ISA to be fully up and running.

There doesn't appear to be any new software installed on the server and the customer confirms this.

Can anyone suggest what may be causing ISA to fail in this case and how I can resolve the problem?
0
dbasplus
Asked:
dbasplus
  • 4
  • 3
1 Solution
 
Keith AlabasterCommented:
Check the running services - and the state of the internet connection sharing service - make sure this is DISABLED and stopped. if it is not then at boot time, ISA and the ICS begin to start up - ICS gets running more quickly and grabs the port and a couple of .dll files therefore ISA fails to start - because the port/files it needs are no longer free. The issue is caused by an MS Update but I can't recall the MS number for it.
0
 
dbasplusAuthor Commented:
Checked that - the "Windows Firewall/Internet Connection Service (ICS)" service is disabled and stopped.
0
 
dbasplusAuthor Commented:
I found that by uninstalling update KB956572 (http://support.microsoft.com/kb/956572), all the problems are fixed.

Not sure exactly why it was causing the problem but if I get any more info I will post it here.

N.B. I have installed this update on several other similar systems and had no problems whatsoever.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
Keith AlabasterCommented:
Well done - sorry I couldn't remember the KB update number as it is extremely new - I am at work so have no access to my home system databases etc. The workaround is to temporarily set the number of processors in the boot.ini file until the patch is corrected.

set /numprocs=x    (cores/2)

Without going into detail, ISA will only run on a box with four processors - and the patch is seeing your box as having eight. I would recommend making the change and reapplying the patch - I think you will find it works OK.

Keith
0
 
Keith AlabasterCommented:
Found it yourself? Hmmm - interesting viewpoint.
0
 
dbasplusAuthor Commented:
Sorry I didn't realise you were talking about the same KB as the one I found. There was no issue with ICS at all so I thought you were suggesting a completely different one.

KB956572 only came through yesterday - only a few hours before my question was posted. I simply went through all the updates that were installed yesterday and investigated each one as this was the only change on the box that I could find.

Re - number of processors - yes our box is showing as 8 but I thought that issue was fixed back in SP2 for ISA?

Feel free to have the points - doesn't bother me!
0
 
Keith AlabasterCommented:
lol - me either but thank you. No - it wasn't 'fixed' as it is by design. The simple issue here is the way this particular patch worked. the recommendation from the MS design team is to leave the -12 patch deployed but to temporarily add the proc setting to the boot.ini file.

Regards

Keith_Alabaster
ISA MVP
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now