SBS 2008 - Remote Web Workplace RDP to PCs stopped working sudenly.

We have an SBS 2008 server that has been running fine. Tonight, after no changes were made on the server or to client PCs (and after work hours) suddenly there is no access to desktop PCs via Remote Web Workplace.

https://remote.ourdomain.com  using Internet Explorer works fine from outside the LAN to connect to RWW.

Users can log-on with their credentials, and authentication works fine. They get into RWW.

Once in Remote Web Workplace they can chose to "Check E-Mail" and the OWA opens fine and authentication is good. They can work normally in the OWA.

We are not using SharePoint - never have on this server, so the SP site is disabled.

If they select to "Connect to a Computer" there is an immediate failure and they receive the messages box "Cannot connect to the Remote Web Workplace site. To continue, contact your network administrator. "

This happens when logged on as the Admin as well, when trying to RDP into the server via RWW.

All PCs are verified up and running, and can be accessed by VNC and TeamViewer.

I see nothing in the event viewer that points to what is going on during the failed attempts.

This was working fine until about 8pm this evening and is used vigorously throughout the day and early evening. There were no issues reported until the failures begun.

**We are using a 3rd party SSL Cert that is installed and up to date.

Among other things, we have tried the following:
Rebooting the server does not help.
Re-registering the IIS Assembly  IISConfigLib.dll and then IISReset has not helped at all.
Even the SBS "Fix my network" as a last resort did nothing to resolve.

An audit of the firewall (SonicWall TZ210) shows it is fine w/ no changes.

Anyone have a suggestion?
LVL 3
mojopojoAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Shreedhar EtteCommented:
Please check eventvwr and post any warning or error event generated during RDP access from RWW.
0
mojopojoAuthor Commented:
Event Log - Web Server ErrorEvent Log - Web Server ErrorI logged into RWW using an Admin account and attempted to use the RWW "Connect to a Computer" link to connect to 10 different PCs in a period of 5 minutes. All of them failed.

In each case I received the error reply instantly "  Cannot connect to the Remote Web Workplace site. To continue, contact your network administrator. "  There is no doubt the PCs are not being queried. Also, half of the PCs are known to be powered off. So this is a SBS issue.

In the Event Viewer I don't see anything that directly reflects entries generated during the 5 minute window during my failed attempts.

However, in the Event Viewer during the last few boots I found corresponding, identical entries in the Event Viewer > Server Rolls > Web Server (*See Attached Screen Shot)

Log Name:      System
Source:        Microsoft-Windows-IIS-W3SVC
Date:          10/10/2013 11:35:11 PM
Event ID:      1007
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      servername.OURDOMAIN.local
Description:
The World Wide Web Publishing Service (WWW Service) did not register the URL prefix https://*:443/ for site 1950898318. The necessary network binding may already be in use. The site has been disabled. The data field contains the error number.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-IIS-W3SVC" Guid="{05448E22-93DE-4A7A-BBA5-92E27486A8BE}" EventSourceName="W3SVC" />
    <EventID Qualifiers="49152">1007</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-10-11T04:35:11.000Z" />
    <EventRecordID>2762079</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>servername.OURDOMAIN.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="UrlPrefix">https://*:443/</Data>
    <Data Name="SiteID">1950898318</Data>
    <Binary>B7000780</Binary>
  </EventData>
</Event>

You can see from the screen shot that these entries come in threes - each listing a different site ID.

I do not know if this has anything to do with our issue. I will have to go back in the logs before the issue started to verify if they were being created prior to the issue tonight. However, this could be due to the fact that we have SharePoint shut down.

Here is the Event Error from the Application log just after the failed attempts (**See Screen Shot below)



Log Name:      Application
Source:        Windows SharePoint Services 3 Search
Date:          10/10/2013 11:46:09 PM
Event ID:      2436
Task Category: Gatherer
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      SERVERNAME.OURDOMAIN.local
Description:
The start address <sts3s://remote.OURDOMAIN.com:987/contentdbid={21b89432-e66d-4175-8d90-0024bdbd4744}> cannot be crawled.

Context: Application 'Search index file on the search server', Catalog 'Search'

Details:
      The crawler could not communicate with the server. Check that the server is available and that the firewall access is configured correctly.   (0x80041200)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows SharePoint Services 3 Search" />
    <EventID Qualifiers="32768">2436</EventID>
    <Level>3</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-10-11T04:46:09.000Z" />
    <EventRecordID>3247276</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SERVERNAME.OURDOMAIN.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

Context: Application 'Search index file on the search server', Catalog 'Search'

Details:
      The crawler could not communicate with the server. Check that the server is available and that the firewall access is configured correctly.   (0x80041200)</Data>
    <Data>sts3s://remote.OURDOMAIN.com:987/contentdbid={21b89432-e66d-4175-8d90-0024bdbd4744}</Data>
  </EventData>
</Event>

This looks like an separate issue caused by the SharePoint site being shut down. But I wanted to include it due to the close time stamp from the failed RDP connections.
Event-Aplication.png
0
mojopojoAuthor Commented:
Again - the Web Server ERRORS were generated at the boot.

The Application ERRORS were generated approximately the time of the failed attempt to RDP from RWW, however there are no where near the number of errors to correspond with the number of attempts (by over 5 to 1)
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

mojopojoAuthor Commented:
Event Viewer - Application ErrorMy apologies.

Here is the screen shot of the Application logs...
0
mojopojoAuthor Commented:
This is the error window that opens from RWW when an attempt is made to "Connect to a Computer", regardless if that PC is known to be up or powered down...RWW to RDP FAIL
0
mojopojoAuthor Commented:
Going in to IIS Manager I see that the "Default Web Site" has not started (There us a question-mark (?) appended over the site icon and "Start" is an option in the "Manage Web Site" Action menu)

When I attempt to start the site I receive the following error box (*See Screen Shot Below)

"This Web site cannot be started. Another Web site may be using the same port."

However all IIS services appear to be running fine.IIS Manager Default Web Site Site not startedIIS MAnager Default Web Site Start FAILS
This looks to be the root of my trouble.
0
mojopojoAuthor Commented:
This is what I receive when I attempt to connect to an RDP session to a PC on the LAN via RWW from the SBS 2008 box...RDP from RWW FAILS from LAN to LAN
0
mojopojoAuthor Commented:
I removed, and then recreated the "SSB Web Applications" site in IIS. It was still somehow missing tsweb.aspx, so I restored that from a backup. After the site was recreated in IIS I ran an "iisreset" at an elevated command line.

After that, I rebooted the SBS 2008 box and now RRP via RWW is working fine, as is all of Remote Web Worlplace and OWA for all users.

For Full Disclosure: I had also re-keyed the SSL Cert (public from GoDaddy) and installed the new certs in IIS using the SBS Ceert wizard. It was done previous to deleting and recreating the site in IIS (SBS Web Applications). I do not know if that had any effect in my final results.

This issue can be closed.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mojopojoAuthor Commented:
This was the result of a lot of research and trial and error. There is no one source I can cite, nor a single link I could provide with a canned detail of the process I used. I will try to sort my notes and possibly post a short step-by-step of what I did. Thanks for looking in on this thread. -MP
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.