Blog of the EMEA SBS Team

A New beginning and an end…

Team SBS — Tue, 17 Mar 2009 12:19:00 GMT

Hello Readers,

With mixed feelings we are announcing the end of postings on this blog. The blog will continue to be here so that you may refer to old posts however we will contribute new posts to The Official SBS Blog and hope to contribute our bit to SBS world.

We hope that you saw value out of our blogging here and will continue to help us help you.

With Newsletters, things are still a bit undecided. While the right thing is clearly to continue it so that pure technical information reaches your door step, we would like to know what you feel about it. Hence we have a small poll below. Please let us know your thoughts on the news letter and we shall decide with that.

See you there. :)

SBS 2003: Configuring ISA 2004 behind a Router for Router to Router VPN Tunnel.

Team SBS — Mon, 16 Feb 2009 20:28:37 GMT

[Today’s post comes to us courtesy Milind Bhavsar.]

Router to router VPN between sites is quite a common scenario. We have often see scenarios where on one side we have SBS 2003 with ISA 2004 installed in Edge firewall mode and on other side we have Windows 2003 Server Std. Edition running ISA 2004 Std. or just a Windows 2003 Server Std. without any firewall. So we have decided to blog about the same.

General Issue’s with this configuration.

1) Not able to access Internal Network (SBS) from remote site.
2) Traffic destined for Internal Network (SBS) doesn’t reaches the external interface of the ISA 2004.

Configuration and Troubleshooting discussed in this blog are to be done on ISA 2004 and some minute changes on your router however this blog does not cover router to router VPN. We are presuming your router-to-router VPN is working fine.

Configuration on ISA 2004.

1) Create a Computer Set in ISA 2004 with the range of remote network.
For e.g. on Site A ISA 2004 create a computer set specifying the range as 10.0.0.1 to 10.0.0.254
2) Then create a Access Rule in ISA 2004 which allows all traffic from computer set to Internal network and local host.
3) Do the same configuration on Site B with computer range 172.16.1.1 – 172.16.1.254.
4) You don’t have to make any changes on the other side if ISA 2004 is not installed and RRAS (NAT ) is also not in use.
5) However you will have to check the router configuration which we will discuss further in this blog.

1> Creating a Computer Set:

> Open ISA2004 Management Console and click on Firewall Policy under your ServerName.
> On the far right, click on Toolbox> Network Objects> New> Computer Set.

2> Creating the Access Rule:

> Right click on Firewall Policies> New> Access Rule.
> Type a name and then click next.
> Select “Allow” rule Action and select “All Outbound traffic”. Select the Computer Set created as source.
> Select Internal network and local host as destinations.
> Allow the rule for all users.

Apart from the ISA 2004 configuration you also have to make sure that the routers are aware about all the remote subnets, because if you see the example diagram on each site we have two network subnets.

In most of the configuration we see that traffic destined to internal network of router (e.g. Site A 192.168.1.x) is configured on the remote router (e.g. router B), But the remote router (Router B) doesn’t have any information of the subnet behind ISA 2004 (e.g. 172.16.1.X)

Same goes for Site A router which knows the router B internal network (e.g. 192.168.2.X) but doesn’t know the subnet behind the ISA 2004 on Site B (e.g. 10.0.0.0)

The best way to determine the configuration of router on both the sides is to do a tracert to reach the other subnet

For e.g

From Site A SBS server we ran following command

1) Tracert 192.168.2.2 (In Most situations this works fine)

a)First Hop would be the router on local site 192.168.1.1
b)Then instead of traffic going on to the Internet will go in vpn tunnel and reach the tunnel end point on the other side 192.168.2.1.
c) Finally reaches the External Interface of ISA 2004 192.168.2.2.

2) Tracert 10.0.0.1

a) First Hop would be the router on local site 192.168.1.1.
b) Now it can go to search 10.0.0.0 network on internet depending on the configuration of the router because if the router doesn’t know that 10.0.0.0 network also exist at the end of same VPN tunnel it will push the traffic to internet

We have taken e.g. of Draytek router how to configure the additional remote subnet however if you have a different router, please refer to your respective manufacturer’s product guide.

c) On site A router you see the remote network 192.168.2.0 which is the internal network for the Site B router click on more button and add the other subnet for Site B that is 10.0.0.X with correct subnet mask
d) Now try to do tracert 10.0.0.1 you should see that it reaches the local router 192.168.1.1 then it reaches the other side of tunnel Site B router 192.168.2.1. Then surprisingly you see that it goes to internet why?
e) This is again a configuration issue at the Site B router because it doesn’t know 10.0.0.X is towards its LAN side and to reach 10.0.0.X he has to give the traffic to ISA 2004 External interface (e.g. 192.168.2.2)
f) For this you have to add a static route on the router at Site B will again take e.g. of Draytek.

While adding this route Make sure that you select the network Interface as LAN because the subnet is towards the LAN Side and the gateway IP would be of the ISA 2004 External Interface.

Check the routing table to see if route is successfully added. From the Diagnostic -> Routing options

These configurations would address most of the issue the last thing is to check if the client machines on the remote sites should point to correct default gateway.

* Examples and Screen shots of router shown in this blog are for illustration sake only. We do not support any 3rd part firewall or router. Please refer to your manufacturers documentation if you have any doubts or concerns.

Essential Business Server 2008 (EBS) - Security Server Installation fails on Forefront Threat Management Gateway.

Team SBS — Mon, 09 Feb 2009 14:12:05 GMT

[This post comes to us courtesy Vikramjit Singh.]

Issue

You have installed the first server of Essential Business Server 2008 – Management Server. Now while installing the Security the setup fails on Forefront TMG with he following error:

“An error occurred while configuring the certificate for the server.”

Here’s a screenshot:

*Apologies for the poor screenshot, we will update it with a better one the next time we come around the error. :)

Cause

This could be caused due to a time difference between the Management Server and the Security Server. All EBS servers install on PST time zone by default. If the time/time zone is altered during the installation of these servers you could expect a few failures. Also the Security server may synchronize time with its BIOS. As a result, Kerberos tickets expiry because of the time change which causes the conflict/authentication failure eventually resulting in a failure of installation which cannot be resumed.

MMSSetup.log can confirm that the failure was caused because of a time difference. Please use Shift+F10 to open the command prompt on the security server. Go to c:\Program Files\Windows Essential Business Server\Logs\MMSSetup.log

You can view the time as marked in yellow in the log below:-

[1008],"2021.09.22 18:37:11.812","MMSNet","Information","**********************************"
[1008],"2021.09.22 18:37:12.843","MMSNet","Information","Entering IsDomainJoined()"
[1008],"2021.09.22 18:37:12.843","MMSNet","Information","status = 'NetSetupWorkgroupName’
[1008],"2021.09.22 18:37:12.843","MMSNet","Information","Return value of this method = 'False'"
[1008],"2021.09.22 18:37:12.875","MMSSetup","Information","SETUP STARTING: 09/22/2021 18:37:12"

In the log above we can see that the year mentioned above 2021 which is incorrect. This is due to the wrong date in the BIOS which needs to be changed.

Resolution

Unfortunately reinstallation of security server cannot be avoided! Therefore turn the machine off, reboot it and go into the BIOS. Under the BIOS settings please make sure that the date and time are the same as that on the Management Server (most likely PST). Once the changes have been made exit setup and use the Security Server disk to restart the Installation.

Please format the system drive and the data drive as well and proceed with the Installation of the Security Server. Once the setup wizard occurs you would reach a stage where it would prompt for the domain name and details. After this is entered the setup might go into a replacement mode state where it knows that the security server was already installed previously and was part of the domain. Therefore the user might be prompted to run the installation is replacement mode. If yes, please click on “Prepare Replacement”

Now follow the simple instructions on the screen and continue.

Note: You are not required to do any cleanup to remove Security Server’s objects and attributes in Active Directory or on the existing servers in the domain. The setup would automatically detect that and do necessary changes and continue the installation.

SBS2008 Migration: Source Tool may fail to ADPREP on Source Server (SBS 2003).

Team SBS — Thu, 29 Jan 2009 21:58:26 GMT

[Today’s post comes to us courtesy Girish Rajan and Ketan Upgade.]

During migration, one of the most important steps on the source server is running the Source Tool also know as Migration Preparation Tool. The Source Tool does the following things;

1> Runs Adprep.exe, which extends the AD DS schema and updates permissions as necessary to prepare a forest and domain for a domain controller that runs Windows SBS 2008. The AD DS schema in Windows SBS 2008 is not the same as the AD DS schema in Windows SBS 2003 or in Windows Server 2003. To successfully complete the migration process, you must update the AD DS schema on the Source Server if it is running Windows SBS 2003 or Windows Server 2003.

Important : You should back up your Source Server before you run the Migration Preparation Tool. All changes that the Migration Preparation Tool makes to the schema are irreversible. If you experience issues during the migration, the only way to return the Source Server to the state before you ran the Migration Preparation Tool is to restore the system backup.

2> Installs an update that extends the time limit for finishing the migration. Normally, only one server running Windows SBS 2008 or Windows SBS 2003 is allowed to be a domain controller on your network, but there is a limited exception for a migration. The update extends the time limit for the exception to 21 days.

3> Prepares the server to migrate from Exchange Server 2003. For the migration to succeed, Exchange Server must be in native mode, not mixed mode. For more information about converting from mixed mode to native mode, see “How to convert from mixed mode to native mode in Exchange” at the Microsoft Web Site (http://go.microsoft.com/fwlink/?LinkId=104943).

The Source Tool may fail to complete successfully because ADPREP fails.

You may see the following error in the SourceTool.log;

01/14/2009 10:50:53 Adprep returned: UnableToModifyError(6)
01/14/2009 10:50:53 Skipping domain prep, since ADPrep failed.

If you run adprep manually you may get the following error message;

Error message: C:\WINDOWS\debug\adprep\logs\20080923153448\LDIF.log The process cannot access the file because it is being used by another process.
(0x80070020).
[User Action]
Check the log file ADPrep.log, in the C:\WINNT\debug\adprep\logs\2008092315344 8 directory for more information.

You may also see the following errors in adprep.log;

[Status/Consequence]

Error message: Error(110) while running ""C:\WINDOWS\system32\LDIFde.exe" -o ObjectGuid –d "CN=interSiteTransportContainer-Display,CN=404,CN=DisplaySpecifiers,CN=Configuration,DC=BrinkerTechnology,DC=local" -u -f "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TMP2BA2.tmp" -j "C:\WINDOWS\debug\adprep\logs\20090114112842" -s bt-1.BrinkerTechnology.local". Could not move file C:\WINDOWS\debug\adprep\logs\20090114112842\LDIF.err to C:\WINDOWS\debug\adprep\logs\20090114112842\DisplaySpecifierUpgradeLdifError.001.txt. The system cannot find the file specified.

(0x80070002).

At this point, even if you run DCDIAG and NETDIAG they might not show any obvious errors.

RESOLUTION:

Important: To run the Migration Preparation Tool, you must be a member of the Enterprise Admins group, the Schema Admins group, and the Domain Admins group. Check this first!

If you have any Antivirus Software Running, its likely that the AV might be using these files. Disable them completely, as in stop the services. If that does not help, try uninstalling them.

The Source Tool should run successfully now.

Related KB: SBS 2008 Migrations Fail When The Migration Preparation Tool Has Not Been Run
http://blogs.technet.com/sbs/archive/2008/12/19/sbs-2008-migrations-fail-when-the-migration-preparation-tool-has-not-been-run.aspx

SBS 2008, Backup and Time Zone (GMT+2) Jerusalem. What’s cooking?

Team SBS — Mon, 26 Jan 2009 11:49:00 GMT

[Today’s post comes to us courtesy Girish Rajan. Special thanks to Justin Crosby.]

On a Windows Small Business Server 2008 the backup wizard may not work from SBS 2008 Administrator console and you may also receive errors trying to open the Windows Server 2008 Native Backup Console. Your backups may still work and you should be able to take backups via command line, that is wbadmin.

Error while trying to run the Configure backup Wizard from SBS 2008 Administrator’s Console:

[Window Title]
Configure Server Backup

[Main Instruction]
The wizard cannot retrieve backup settings.

[Content]
An unknown problem is preventing the wizard from retrieving backup settings. Please try again. If this problem persists, contact the person or company who provides you with technical support.

[OK]

You may also see the following error (if you delete the schedule task created by backup wizard):

Microsoft Windows
Windows SBS 2008 Server Backup Configuration Wizard has stopped working

Windows can check online for a solution to the problem.

Description:
Stopped working
Problem signature:
Problem Event Name:        CLR20r3
Problem Signature 01:        sbcw.exe
Problem Signature 02:        6.0.5601.0
Problem Signature 03:        48a22618
Problem Signature 04:        mscorlib
Problem Signature 05:        2.0.0.0
Problem Signature 06:        475777fa
Problem Signature 07:        f46
Problem Signature 08:        7
Problem Signature 09:        N3CTRYE2KN3C34SGL4ZQYRBFTE4M13NB
OS Version:        6.0.6001.2.1.0.305.9
Locale ID:        1037.

If you open the native Windows Server 2008 Backup Console, you may see the following error:

In C:\Program Files\Windows Small Business Server\Logs\SBCW.txt you will find the following error;

SyemTimeToTzSpecifiLocalTime failed due to error: The parameter is incorrect, (0x80070057)..

CAUSE:

This issue occurs if the following conditions are true:

1> The time zone on the computer is set to Jerusalem.
2> The Automatically adjust clock for Daylight Saving Time option is selected.

SOLUTION:

Download and install the hotfix as per the following Knowledge Base Article;

Error message when you try to perform a backup on a Windows Server 2008-based computer on which the time zone is set to "Jerusalem": "The parameter is incorrect, 0x80070057"

http://support.microsoft.com/kb/953406.

* By default SBS 2008 installs itself on (GMT-8) Pacific Time (US & Canada). If you don’t change the time zone during install and have configured your server completely using wizards then, later when you change it, you must wait for some time until SBS behaves normally.

SBS2008- “Cannot Configure Backup Schedule” error when you run Configure Server Backup wizard on Small Business Server 2008.

Team SBS — Mon, 26 Jan 2009 11:32:37 GMT

[Today’s post comes to us courtesy Vikramjit Singh.]

We have seen a couple of issues with SBS 2008 Backup now and here is one of them. You may receive the following error while running SBS 2008 Backup Wizard.

CAUSE:

This error may occur if the amount of data which is being backed up is more than the actual size of the backup drive.
For example - If we have 3 partitions as below:-

C Drive – Used Space 124 GB
D Drive – Used Space 83 GB
E Drive – Used Space 103 GB

Total Data to backup is 310 GB. However, if the backup disk has a capacity of 310 GB or lesser then we would receive the above error message.

Also if we look at the SBCW.log under C:\Program Files\Windows Small Business Server 2003\logs the following error can be seen:-

[11220] 090121.120151.1246: WizardChainEngine Next Clicked: Going to page {0}.: LabelPagePresenter[11220] 090121.120156.0074: WizardChainEngine Next Clicked: Going to page {0}.: SourcePagePresenter
[11220] 090121.120158.6282: Storage: Volume (MountPoint=\\?\Volume{186b47b0-c800-11dd-958a-806e6f6e6963}, MountPath=C:) is selected as source
[11220] 090121.120158.6282: Storage: Volume (MountPoint=\\?\Volume{186b47b2-c800-11dd-958a-806e6f6e6963}, MountPath=D:) is selected as source
[11220] 090121.120158.6282: Storage: Volume (MountPoint=\\?\Volume{186b47b1-c800-11dd-958a-806e6f6e6963}, MountPath=E:) is selected as source
[11220] 090121.120158.6282: WizardChainEngine Next Clicked: Going to page {0}.: SchedulePagePresenter
[11220] 090121.120200.6250: Storage: 17:00 is selected as schedule time
[11220] 090121.120200.6250: Storage: 23:00 is selected as schedule time
[11220] 090121.120200.6250: WizardChainEngine Next Clicked: Going to page {0}.: SummaryPagePresenter
[11220] 090121.120204.5406: Wizard: WizardChainEngine Next Clicked: Last page, so the wizard isdone, closing wizard frame and returning
[10564] 090121.120204.7902: AdminTME: AdminDataLink Running Task: CommitterSequenceTask
[10564] 090121.120204.9150: Storage: Remove backup target: Label=Backup Drive 1
[10564] 090121.120204.9306: Storage: Create backup target disk: DiskName=Seagate FreeAgent Go USB Device, Label=Backup Drive 2
[10564] 090121.120204.9306: Storage: Add backup target: Label=Backup Drive 2
[10564] 090121.120218.0658: Storage: Terminating error in Set-WBPolicy: Microsoft.SnapIns.Backup.UI.Proxy.BlockLevelBackupException: IBlbEngine::ModifyTemplate failed due to Blb error: EBackupTargetSpaceNotEnough (0x80780048).

Resolution:

You could add a backup drive which has more space capacity than the data which has to be backed up. Else could deselect one of the data drives from the backup list and then continue.

SBS 2008: CTIW fails to complete successfully.

Team SBS — Fri, 16 Jan 2009 13:53:02 GMT

[Today’s post comes to us courtesy Moloy Tandon.]

Recently we have seen few cases where the Connect To Internet Wizard (CTIW) may fail to complete successfully.

When you run the CTIW it may fail to detect the router and you may be presented with the following screen to type the IP of the router and server.

When you click next after typing the IP details, the wizard may fail with the following error. Additionally, you would notice that the wizard removes the Default Gateway entry from the NIC properties and may also change the IP address of the server.

[Internet connection is incomplete - Windows SBS has encountered an unknown error. For more information, contact Microsoft Product Support.]

If you analyze the CTIW.log file, you may see something similar

[9744] 090107.141539.6875: CoreNet: netsh: interface ip set address 10 static address=192.168.0.1 mask=255.255.255.0

[9744] 090107.141540.8107: CoreNet: WSA ERR# 10022 when binding a socket to 192.168.0.1 to check for address availability

[9744] 090107.141540.8107: CoreNet: Exception System.Net.Sockets.SocketException:

[9744] 090107.141540.8263: Exception:

---------------------------------------

An exception of type 'Type: System.Net.Sockets.SocketException, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' has occurred.

Timestamp: 01/07/2009 14:15:40

Message: An invalid argument was supplied

Stack: at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)

at System.Net.Sockets.Socket.Bind(EndPoint localEP)

at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.WaitForNewIp4sToPropagate(Ip4Address32[] newIp4Addresses, Int32 deadlineSeconds)

[9744] 090107.141540.8263: CoreNet: Exception Microsoft.WindowsServerSolutions.CoreNetworking.CNetException:

HR: 0

[9744] 090107.141540.8263: Exception:

---------------------------------------

An exception of type 'Type: Microsoft.WindowsServerSolutions.CoreNetworking.CNetException, CNetManagement, Version=6.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' has occurred.

Timestamp: 01/07/2009 14:15:40

Message: Couldn't bind a socket to the new address after several retries.

Stack: at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.EnableStatic(AddressAndMask[] Ip4AddressesAndMasks, Int32 deadlineSeconds)

at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.EnableStatic(IPAddress[] IpAddresses, IPAddress[] IpNetMasks, IPAddress[] Gateways, UInt16[] GatewayMetrics)

at Microsoft.WindowsServerSolutions.CoreNetworking.NetworkDiscovery.SaveLocalNicAndRouter(CNetNic nic, CRouter router, Boolean findBetterIP)

[9200] 090107.141540.8263: CoreNet: Exception caught in network detection

[9200] 090107.141540.8263: CoreNet: Exception Microsoft.WindowsServerSolutions.CoreNetworking.CNetException:

HR: 0

[9200] 090107.141540.8419: Exception:

---------------------------------------

An exception of type 'Type: Microsoft.WindowsServerSolutions.CoreNetworking.CNetException, CNetManagement, Version=6.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' has occurred.

Timestamp: 01/07/2009 14:15:40

Message: Couldn't bind a socket to the new address after several retries.

Stack: at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.EnableStatic(AddressAndMask[] Ip4AddressesAndMasks, Int32 deadlineSeconds)

at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.EnableStatic(IPAddress[] IpAddresses, IPAddress[] IpNetMasks, IPAddress[] Gateways, UInt16[] GatewayMetrics)

at Microsoft.WindowsServerSolutions.CoreNetworking.NetworkDiscovery.SaveLocalNicAndRouter(CNetNic nic, CRouter router, Boolean findBetterIP)

at Microsoft.WindowsServerSolutions.Networking.Wizards.CTIWizard.DetectNetworkPagePresenter.RouterWasFound(BackgroundWorker worker, NetworkDiscovery nd, CNetNic nic, CRouter theRouter, Boolean useCurrentSetting)

at Microsoft.WindowsServerSolutions.Networking.Wizards.CTIWizard.DetectNetworkPagePresenter.detection_DoWork(Object sender, DoWorkEventArgs e)

at System.ComponentModel.BackgroundWorker.WorkerThreadStart(Object argument)

Using Time Travel Tracing (TTT) we discovered a third-party DLL associated with an antivirus software was blocking our request of binding the socket to the IP address.

After we uninstalled the third-party antivirus software, the CTIW ran and completed successfully.

SBS 2008: Some key changes in Terminal Services

Team SBS — Fri, 16 Jan 2009 13:34:21 GMT

[Today’s post comes to us courtesy Moloy Tandon]

In this post I would highlight some key changes in Terminal Services in SBS 2008 which may affect user experience and how system administrators remotely manage the server.

Change 1:

By default, SBS 2008 restrict each user to a single Terminal Services session. What that means if someone is already logged on to the console or RDP session using User Account A, another session with the same user account would overtake the first session. So at any given point you will have only 1 session (Terminal Services or Console) to the server with User Account A.

However, you can edit this default setting and can have 2 simultaneous connection using the same user account.

Change 2:

When connected to SBS 2008 via RDP client, you can now remote control or shadow the console session. You can achieve this from Terminal Services Manager. However, you cannot shadow an RDP session from a console session (the Remote Control and Connect options are grayed out).

Note: The changes discussed here are Windows Server 2008 feature and not just SBS-specific.

You receive a Vbscript error while connecting to the client/server computer using RWW in SBS 2008.

Team SBS — Sat, 10 Jan 2009 09:41:08 GMT

[Today’s post comes to us courtesy Bhushan Gokhale.]

In SBS 2003, we receive the request from remote machine on port 4125 (which opens Dynamically on the server), and after validating the request, we redirect it to the appropriate client machine. Unlike SBS 2003, we do not use port 4125 redirection anymore. In SBS 2008, Remote Web Workplace is based on the TS gateway technology (TS gateway is a part of Windows Server 2008 role suite). However, if the certificates are not configured correctly, you may experience the following issue.

You may get the following error while connecting to the client or server computer, which is inside SBS 2008 network, using Remote Web Workplace:

---------------------------
VBScript: Remote Desktop Disconnected
---------------------------
An internal error has occurred (error 50331688). For more information, please contact your network administrator or Microsoft Product Support.
---------------------------
OK
---------------------------

To isolate the issue, you must try to connect to the internal computer using Remote Desktop Client (RDP). To connect using Remote Desktop Client, follow the steps given below:

-Open the RDP client.
-Click on Options.
-Go to Advanced tab,
-Click on Settings.
-Select “Use these TS gateway server settings”.
-Type the External URL that you use to connect to RWW (without https://). For Eg.: Remote.contoso.com
-Click on General Tab.
-Type the name of the internal computer you want to connect to. For Eg.: computer1.contoso.local
-Fill in other details and click on connect.

When you try to connect to the client machine, with SBS 2008 as TS gateway, you get the error:

This issue occurs if you do not have the certificate installed on the TS Gateway. To resolve this issue you must add the certificate on TS gateway. To do this, follow the steps given below:

- Open TS gateway manager. (Start-Administrative Tools-Terminal Services-TS gateway manager).
- Click on Server name.
- Click on Properties on the right most pane.
- Click on SSL certificate Tab.
- If you have the correct certificate installed, you should see the Window as shown below.

If the certificate is not installed, you should see the Window as shown below:

To install the certificate, you must first ensure that the correct certificate is available on the server.
You should find this certificate in the personal store of SBS 2008. To check the certificate in the personal store:

· Click on Start-Run
· Type mmc and click on ok
· Click on File and select Add/Remove Snap-in from the menu.
· Select Certificate Snap-in from the list an click on Add
· Select Computer Account and click on Next.
· Select Local Computer and click on Finish.
· Click on OK again.
· Expand Certificate Snap-in
· Expand Personal and click on Certificates.
· You should see the certificate issued by your Certificate Authority to your External domain name (For Eg: remote.contoso.com)
· If you do not see this certificate, run the “Setup your internet Address” or “Fix my Network” wizard again.
· If you are using the 3^rd Party Certificate, make sure that the certificate is a part of Computer’s Personal Store.

To add this certificate on the TS Gateway, follow the steps given below:

- Open the TS Gateway Manager.
- Right Click on the <servername> and click on properties.
- Click on SSL Certificate Tab.
- Click on Browse Certificates Button.
- Select the certificate that corresponds to your External domain name (remote.contoso.com)
- Click on Install.

After making these changes, you should be able to connect to the internal machines from Remote Web Workplace.

Intermittent Outlook Anywhere Connectivity issue in SBS 2008.

Team SBS — Wed, 10 Dec 2008 13:30:24 GMT

The Official SBS Blog: Slow Connectivity for Outlook Anywhere and Sites that use the SBS Web Applications App Pool.
http://blogs.technet.com/sbs/archive/2009/02/10/slow-connectivity-for-outlook-anywhere-and-sites-that-use-the-sbs-web-applications-app-pool.aspx

The post below is a workaround, for the official solution to this issue, please refer to the link above.

[This post comes to us courtesy Rituraj Choudhary]

You may experience the following issue in SBS 2008:
Outlook Anywhere is very inconsistent and hardly connects. If you look at Outlook connection Status, it waits at Type Directory or Mail.

In the HTTPERR (under C:\Windows\System32\LogFiles) logs, you may find something like:

2008-11-13 16:55:10 124.124.68.131 40652 10.0.1.201 443 HTTP/1.1 RPC_IN_DATA /rpc/rpcproxy.dll?SBSDC1.CONTOSO.local:6004 400 0 BadRequest SBS+Web+Applications+application+pool
2008-11-13 16:56:01 124.124.68.131 40652 10.0.1.201 443 HTTP/1.1 RPC_IN_DATA /rpc/rpcproxy.dll?SBSDC1.CONTOSO.local:6004 400 0 Connection_Dropped SBS+Web+Applications+application+pool
These errors may appear for port 6001, 6002 and 6004.

If you enable Failed Request Tracing Rules on the /Rpc Virtual Directory, in the %SystemDrive%\inetpub\logs\FailedReqLogFiles\W3SVC3 xml files you may find something like:

Url: https://remote.contoso.com:443/rpc/rpcproxy.dll?SBSDC1.CONTOSO.local:6004
App Pool: SBS Web Applications application pool
Authentication: NOT_AVAILABLE
User from token:
Activity ID: {00000000-0000-0000-7827-0080000000D6}
Site: 3
Process: 7476
Failure Reason: STATUS_CODE
Trigger Status: 400
Final Status: 400
Time Taken: 70593 msec
Warning: SET_RESPONSE_ERROR_DESCRIPTION
ErrorDescription: ASP.NET detected invalid characters in the URL.
Warning: MODULE_SET_RESPONSE_ERROR_STATUS
ModuleName: HttptoHttpsRedir
Notification: 1
HttpStatus: 400
HttpReason: Bad Request
HttpSubStatus: 0
ErrorCode: 2147952454
ConfigExceptionInfo
Notification: BEGIN_REQUEST
ErrorCode: An existing connection was forcibly closed by the remote host. (0x80072746).

Resolution:
The IIS thinks the above mentioned URL to be malformed (Bad Request) and does not process the request further. This usually happens because of the corrupt configuration settings in the web.config file.

Renaming/deleting the web.config referred in the SBS Web Application application pool should resolve the issue.

Alternately, if a web.config is referred to by the /Rpc virtual directory, modify the <modules> .. .. ..<\modules> section in C:\Windows\system32\RpcProxy\web.config from:

<modules>
<remove name="HttptoHttpsRedir" />
<add name="HttptoHttpsRedir" type="Microsoft.WindowsServerSolutions.IWorker.IIS.Modules.HttpToHttpsRedir,HttpToHttpsRedir,Version=6.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="" />
</modules>

to:

<modules>
<remove name="HttptoHttpsRedir" />
</modules>

Migrating Companyweb Website (WSS 2.0) from SBS 2003 to SBS 2008 (WSS 3.0).

Team SBS — Tue, 09 Dec 2008 11:14:00 GMT

[Today’s post comes to us courtesy Bhushan Gokhale]

With the recent release of SBS 2008, most of the administrators are quite comfortable with migrating Exchange and Active Directory. However, SharePoint migration is also one of the important migration tasks and even though there are whitepapers it isn’t always as easy as it seams.

This blogs guides you through the step by step procedure to Migrate your Companyweb website from SBS 2003 to SBS 2008. As you might be aware, upgrading Companyweb from WSS 2.0 to WSS 3.0 is not supported in SBS 2003. So this blog specifically talks about Migrating Companyweb (WSS 2.0) website on SBS 2003 to a WSS 3.0 website on SBS 2008.

Note: Do not use this post to migrate any WSS 3.0 website from SBS 2003 to SBS 2008.

Note: When you finish the procedures in this blog, the links from the previous Companyweb Web site to Outlook Web Access (OWA) and to Helpdesk will no longer resolve correctly. This is by design.

Source Server: Small Business Server 2003

Destination Server: Small Business Server 2008

Steps to be performed on the Source Server:

Configure Companyweb on SBS 2003 to allow access from Windows Small Business Server 2008

> Log on to the Source Server with an administrator account, and then open the Internet Explorer®

> In Address bar, type https://companyweb, and then click GO.

Make sure you include the "s" after "http," and verify that you are accessing the encrypted Windows SharePoint Services Web site.

> On the Home page, click Site Settings.

> On the Site Settings page, in the Administration section, click Manage users, and then click Add Users.

> On the Add Users page, do the following:

1. In the text box in Step 1: Choose Users, type Windows SBS SharePoint_OwnersGroup.
2. In Step 2: Choose Site Groups, select the Administrator check box, and then click Next.
3. Click Finish to accept the default entries. Note that the new group is added to the users list on the Manage Users page.

> On the Manage Users page, again click Add User.

> On the Add Users page, do the following:

1. In the text box in Step 1: Choose Users, type Windows SBS SharePoint_MembersGroup.
2. In Step 2: Choose Site Groups, select the Contributor check box, and then click Next.
3. Click Finish to accept the default entries. Note that the new group is added to the users list on the Manage Users page.

> On the Manage Users page, click Add User.

> On the Add Users page, do the following:

1. In the text box in Step 1: Choose Users. type Windows SBS SharePoint_VisitorsGroup.
2. In Step 2: Choose Site Groups, select the Reader check box, and then click Next.
3. Click Finish to accept the default entries. Note that the new group is added to the users list on the Manage Users page.

> Close the Companyweb page.

> Notify users that the internal Web site is going to be migrated to Windows SBS 2008 and that the Source Server will be offline during this process.

Run the Prescan tool on the Source Server

> Log on to the Destination Server.

> Copy the Windows SharePoint Services 3.0 prescan.exe utility from the folder %Program Files%\Common Files\Microsoft Shared\Web Server Extensions\12\Bin to removable media.

> Save the file on the Source Server.

> On the Source Server, click Start, click Run, type cmd in the text box, and then click ENTER.

> In the Command Prompt window, switch to the folder where you saved prescan.exe

> Type:- prescan.exe /V http://companyweb at the command prompt, and then press ENTER.

Note any messages about errors, and review the log files that are created by prescan.exe. If there are errors, make the necessary corrections, and then run prescan.exe again.

Stop Companyweb on the Source Server

> On the Source Server, click Start, and then click Server Management.

> In the navigation pane, click Advanced Management, click Internet Information Services, click <ServerName> (local), and then click Web Sites.

> Right-click the Companyweb, and then click Stop.

Connect to Windows SharePoint Services WMSDE instance on the source server

> On the Source Server, click Start, click All Programs, click Microsoft SQL Server 2005, and then click SQL Server Management Studio Express.

> In the Server name dropdown list, click <ServerName>\SHAREPOINT, and then click Connect.

Back up the content database for the companyweb

> In SQL Server Management Studio Express with SP2 (MSSMSE), in the navigation pane, expand Databases.

> Right-click the content database for the internal Web site, click Tasks, and then click Backup.

Note: The content database for the internal Web site is named STS_<SourceServerName>_1 by default.

> In the Back Up Database dialog box, do the following:

1. Leave the defaults in the Source and Backup set sections.
2. In the Destination section, make sure Backup to is set to Disk, and then add the <full path location>.bak for the backup set (for example, c:\backup\CompanyWeb.bak).
3. Click OK to create the backup set.
4. Click OK in the Backup completed successfully dialog box.

If you receive an error stating "Property BackupDirectory is not available for Settings 'Microsoft.SqlServer.Management.Smo.Settings'. This property may not exist for this object, or may not be retrievable due to insufficient access rights. (Microsoft.SqlServer.Express.Smo)," you must add the following value to the Registry via the Regedit tool:

Registry key: HKLM\Software\Microsoft\Microsoft SQL Server\SharePoint\MSSQLServer

Name: BackupDirectory
Type: Reg_SZ
Value: C:

Detach the database

> In Microsoft SQL Server Management Studio Express SP2 (MSSMSE), in the navigation pane, expand Databases.Right-click the content database for the internal Web site, click Tasks, and then click Detach.

> In the Detach Database dialog box, do the following:

1. Select the check box in the Drop Connections column.
2. Clear the check box in the Update Statistics column.
3. Click OK.
4. In the navigation pane, in the Databases folder, verify that the STS_<Windows SBS 2003ServerName>_1 database is no longer displayed.
5. Close MSSMSE.

> Copy the database files to the Destination Server.

> By default, the files are in the folder C:\ Program Files\Microsoft SQL Server\MSSQL$SharePoint\Data folder on the Source Server.

> By default, the files are named as follows:

STS_<ServerName>_1.mdf
STS__<ServerName>_1_Log.ldf

Important: Ensure that these files are included when you take the backups on the Destination Server.

Steps performed on the Destination Server

> Verify that the version of the Companyweb that is running on the Destination Server is Windows SharePoint Server 3.0.

> In Internet Explorer, in the address bar, type https://sites:987. The icon next to the title of the internal Web site should be for Windows SharePoint Server 3.0, and the site description should be “Organization internal Web site."

Configure the forward lookup zone for Companyweb on the Destination Server

> Open the DNS Management Console in Windows SBS 2008. To open the console, click Start, click Administrative Tools, and then click DNS.

> Click Continue in the User Account Controls dialog box.

> In the navigation pane, expand the server name, expand Forward Lookup Zones, and then expand the internal domain name (for example, server.local).

> Right-click the Companyweb alias (CNAME) resource record, and then click Properties.

> Replace the FQDN for the target host entry with the name of the Destination Server (for example, NewServer.contoso.local).

Attach the content database

> Click Start, click All Programs, click Microsoft SQL Server 2005, right-click SQL Server Management Studio Express, and then click Run as Administrator.

> Click Continue in the User Account Control dialog box.

> To connect to the content database that the Destination Server uses, do the following:

1. In the Server name text box, type \\.\pipe\mssql$microsoft##ssee\sql\query.
2. Click Connect.

> To attach the content database, do the following:

1. In the navigation pane, right-click Databases, and then click Attach.
2. In the Attach Databases dialog box, in Databases to attach, click Add.
3. In the Locate Database Files dialog box, navigate to the TS_<SourceServerName>_1.mdf file that you copied from the Source Server to the Destination Server, and then click OK.
4. In the Attach Databases dialog box, in <DatabaseName> database details, confirm that the STS_<SourceServerName>_1.mdf file and the STS_<SourceServerName>_1_Log.ldf file are listed.
5. Click OK.
6. If you see a warning dialog box from MSSMSE, which asks about locating full text catalogs, click No.
7. Verify that the STS_<SourceServerName>_1 database is listed in the Databases folder in the navigation pane.
8. Close MSSMSE.

Create a new Web site to host the new internal Web site

> Click Start, click Administrative Tools, and then click Internet Information Services (IIS) Manager.

> Click Continue in the User Account Control dialog box.

> In the navigation pane, expand the <DestinationServerName>, right-click Sites, and then click Add Web Site.

In the Add Web Site dialog box, do the following:

1. In Site name, type CompanyWebv2.
2. In Application pool, accept the default CompanyWebv2.
3. In Physical path, browse to C:\inetpub, click Make New Folder, and then type CompanyWebv2 as the new folder name.
4. In the Binding section, in Host name, type CompanyWebv2.
5. Click OK.
6. Verify that CompanyWebv2 is added to the Sites folder.
7. Close IIS Manager.

Create an alias (CNAME) resource record for CompanyWebv2.

> Click Start, click Administrative Tools, and then click DNS.

> Click Continue in the User Account Control dialog box.

> In the navigation pane, expand the Forward Lookup Zones.

> Right-click <DomainName>.local, and then click New Alias (CNAME).

In the New resource Record dialog box, do the following:

1. In Alias name (uses parent domain if left bank), type CompanyWebv2.
2. In Fully qualified domain name (FQDN) for target host, type <ServerName>.<DomainName>.local (for example, NewServer.contoso.local).
3. Click OK.
4. Note that the CompanyWebv2 alias (CNAME) resource record is now listed in the Forward Lookup Zone.
5. Close DNS Manager.

Create a new Windows SharePoint Services Web application named CompanyWebv2

> Click Start, click Administrative Tools, and then click SharePoint 3.0 Central Administration.

> Click Continue in the User Account Control dialog box.

> On the Home page, in the navigation bar, click the Application Management tab.

> On the Application Management page, in the Windows SharePoint Services Web Application Management section, click Create or extend Web application.

> On the Create or Extend Web Application page, click Create a new Web application.

On the Create New Web Application page, in the IIS Web Site section, do the following:

> Click Use an existing IIS Web site.
> Click CompanyWebv2 in the dropdown list box.
> Accept the default entries in the remaining text boxes in the section.

On the Create New Web Application page, in the Security Configuration section, accept the default settings:

> In Authentication provider, click NTLM.

> In Allow Anonymous, click No.

> In Use Secure Sockets Layer (SSL), click No.

On the Create New Web Application page, in the Load Balanced URL section, do the following:

1. Verify that the URL text box contains http:// CompanyWebv2:80/.
2. Accept Default in the Zone text box.

On the Create New Web Application page, in the Application Pool section, do the following:

> Click Use existing application pool.

> Select CompanyWebv2 or the name of the application pool that you created in Step 4 of the “To create a new Web site to host the older version of Companyweb” procedure.

> On the Create New Web Application page, in the Reset Internet Information Services section, accept the default settings.

On the Create New Web Application page, in the Database Name and Authentication section, do the following:

> In Database Server, accept the default <SourceServerName>\Microsoft##SSEE.

> In Database Name, type STS_<SourceServerName>_1.

> In Database authentication, click Windows authentication (recommended).

On the Create New Web Application page, in the Search Server section, do the following:

> In Windows SharePoint Services search server, click the Destination Server name in the dropdown list box.

> Click OK.

> If you receive a warning message, click OK.

The Operation in Progress page is displayed. This operation may take approximately 30 minutes. The new Windows SharePoint Services Web application is created, and the Windows SharePoint Services 2.0 Companyweb database is upgraded to Windows SharePoint Services 3.0.

The Application Created page is displayed. It notes that you need to reset IIS to finish creating the new Web site. You will do this in a later procedure. Close Central Administration for Windows SharePoint Services 3.0.

To set or confirm the Site Collection Administrator for the CompanyWebv2 Web site

> Click Start, click Administrative Tools, and then click SharePoint 3.0 Central Administration.

> Click Continue in the User Account Control dialog box.

> On the Home page, in the navigation bar, click the Application Management tab.

> On the Application Management page, in the SharePoint Site Management section, click Site Collection Administrators.

On the Site Collection Administrators page, in the Site Collection section, if http:// CompanyWebv2 is not displayed in the Site Collection box, do the following:

1. Click the Site Collection dropdown arrow, and then click Change Site Collection.
2. On the Select Site Collection page, in the tool bar, click the Web Application dropdown arrow, and then click Change Web Application.
3. On the Select Web Application page, in the Name column, click CompanyWebv2, and then click OK.
4. On the Site Collection Administrators page, confirm that the Primary site collection administrator text box contains a valid user account name in your Windows SBS 2008 domain. If it does not, type a valid user account name.

Important The built-in Administrator account is not a valid user account name in your Windows SBS 2008 domain.

You can also enter a user account name in the Secondary site collection administrator text box.
Click OK, and then close Central Administration for Windows SharePoint Services 3.0.

To reset IIS

· Click Start, right-click Command Prompt, and then click Run as administrator.
· Click Continue in the User Account Control dialog box.
· At the command prompt, type iisreset.
· When you see the message Internet services successfully restarted, close the Command Prompt window.

You now have a working Windows SharePoint Services 3.0 Web site that is named CompanyWebv2 and that contains the structure and documents of your old Windows SBS 2003 Companyweb Web site. This is a good time to review the contents of your Windows SBS 2003 Companyweb Web site and to reorganize or archive items, if appropriate. You can open the new Windows SBS 2008 internal Web site and the Windows SBS 2003 CompanyWebv2 site side-by-side.

If you open document libraries and use the Explorer view, you can copy and paste documents and folders from one site to the other.

Note

The Explorer view in Windows SharePoint Services depends on WebDAV. Typically, WebDAV is installed on client operating systems, but not on server operating systems. To use the Explorer view to finish migrating your content to the new Windows SBS 2008 internal Web site, either access the sites from a client computer on the network, or install the Desktop experience from Server Manager on your Destination Server.

Troubleshooting System Hang.

Team SBS — Tue, 09 Dec 2008 11:07:00 GMT

[Today’s post comes to us courtesy Moloy Tandon.]

In this post we are focusing on one of the most common issue, system hang. Specifically the following event which are reported by the server service whenever there is a leak in the non-paged pool system memory.

Event ID:           2019
Event Source:    Srv
Description:       The server was unable to allocate from the system nonpaged pool because the pool was empty.

The following event is reported by the Server service whenever there is a leak in the paged pool memory.

Event ID:           2020
Event Source:    Srv
Description:       The server was unable to allocate from the system paged pool because the pool was empty.

The above events are recorded whenever there is a depletion in the pool resources; which is one of the most common reason for system hang. So what do these events mean?

Definition:

Paged Pool: The portion of shared system memory that can be paged to the disk paging file.
NonPaged Pool: The portion of shared system memory that cannot be paged to the disk paging file.

To learn more about memory management check out the following post from the Windows Server Performance team.

Memory Management - Understanding Pool Resources

Identify characteristics of the hang (Hard Hang vs Soft Hang):

1.) Does the mouse/keyboard respond?

2.) Does the machine respond over the network?

3.) Does Task Manager show a particular process taking up CPU?

4.) How frequently does the hang occur?

5.) Does the hang occur at a particular time of the day?

6.) Does the machine eventually recover from the hang on its own?

7.) What do you do to recover from the hang?

Data Gathering:

MPS Reports: The first step involves collecting MPS Reports from the server. The Setup/Perf version of MPSReports (MPSRPT_SETUPPerf.EXE) can be downloaded from the following link.

Microsoft Product Support's Reporting Tools

Perfmon/PerfWiz: Gathering performance data is the next thing we usually do. You can use the Performance Monitor Wizard which greatly simplifies the process of creating and gathering perfmon logs. The PerfWiz leverages the native Performance Monitor to capture the data.

Enable Pool Tagging: In Windows Server 2003 and later, Pool tagging is enabled by default. This feature collects and calculates statistics about the pool memory sorted by the tag value of the memory allocation. To enable Pool tagging on Windows 2000/XP/NT4, you can either use the GFlags.exe utility or directly edit the registry. For more info on how to do this, please refer to the following KB article.

How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks

Memory Dump: We configure the system for memory dump when there is a hard hang issue. We usually do this by manually generating a memory dump file using the keyboard. However, there are certain consideration to keep in mind before configuring a system to collect memory dump such as sufficient drive space, Pagefile location and size, type of memory dump you want to capture (mini/kernel/complete).

Windows feature lets you generate a memory dump file by using the keyboard

Overview of memory dump file options for Windows Server 2003, Windows XP, and Windows 2000

Analyzing Data:

MPS Reports: Given that MPSReports contain an overwhelming amount of information about a system it is important to have a good understanding of the problem. Once you have a clear problem description it becomes easier to determine which report files to review. For system hang issues you should start looking at the System event logs. Place careful attention to the frequency of the events. For unresponsive servers caused by a memory leak you can estimate the interval before the next hang by the correlating Event ID 2019, 2020.

Perfmon: Perfmon logs can be helpful to confirm a resource depletion that results in a server becoming un responsive. Load the necessary counters in Perfmon to quickly determine if the hang is a result of a memory leak, handle leak, etc. The mostly commonly used objects and their counters are Memory, Process, Processor, Thread, Physical Disk, Logical Disk, and System. You can also use Task Manager or Process Explorer to view the number of open handles for a process.

Poolmon: Poolmon.exe is available in the Windows NT 4.0 Resource Kit and in the \Support\Tools folder of Windows 2000, Windows XP, and Windows Server 2003 CD-ROMs. You can refer to the following link for some examples on how to display the driver names and detect memory leak using poolmon.exe.

Pool Mon Examples

Memory Dump: Debugging is a specialized skill that is learned over years of study in many areas and is outside the scope of this blog post. However, if you are still interested in learning these skills you can start here.

Recommendations:

There are number of reasons which can lead to a system hang. Some of the most common reasons include disk issues, interference with third-party applications, filter drivers, outdated hardware drivers & firmwares, leak in an application or service, etc. Before you jump to advance data gathering/analysis its always best to isolate the problem first by taking a logical and linear approach.

References:

How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks

How to find pool tags that are used by third-party drivers

How to monitor and troubleshoot the use of paged pool memory in Exchange Server 2003 or in Exchange 2000 Server

How to Troubleshoot Memory Leaks in IIS

How to create a log using System Monitor in Windows

Overview of the Microsoft Configuration Capture Utility (MPS_REPORTS)

Description of the Microsoft Platform Support Reporting Utility

Understanding Pool Consumption and Event ID: 2020 or 2019

Troubleshooting Common VPN issues.

Team SBS — Fri, 05 Dec 2008 12:51:43 GMT

[Today’s post comes to us courtesy Lavinder Kumar]

In this Blog some of the common VPN issues and steps to resolve are discussed. We will be going through some of the issues based on the errors that a client encounters. Please keep in mind that the steps discussed in this blog are basic steps towards resolution.

Issue:- Client receives Error 691. On the server the following events were logged:

Event Source: RemoteAccess
Event Category: None
Event ID: 20189
Date: 11/18/2007
Time: 2:33:04 PMConnection attemp did not match any connection request policy.
User: N/A
Computer: SBS
Description:
The user Domain\User01 connected from 208.29.145.24 but failed an authentication attempt due to the following reason: Authentication was not successful because an unknown user name or incorrect password was used.

Event Type: Warning
Event Source: RemoteAccess
Event Category: None
Event ID: 20189
Date: 11/18/2007
Time: 5:46:01 PM
User: N/A
Computer: SBS
Description:
The user Domain\test connected from 192.168.16.2 but failed an authentication attempt due to the following reason: The connection attempt did not match any connection request policy.

File “c:\windows\system32\ias\ias.mdb” may be corrupt.

STEPS TO RESOLVE

1. Stop RemoteAccess service and close the RRAS console
2. Rename c:\windows\system32\ias\ias.mdb to ias.old
3. Expand a good copy from CD 1 and place in the c:\windows\system32\ias\ directory
4. Restart IAS.
5. Run the SBS RAS wizard.

Issue:- Error 721: The remote computer is not responding.

STEPS TO RESOLVE

This is usually caused if GRE is not properly allowed on the router or on one of the hops.

About GRE protocol:
VPN Tunnels - GRE Protocol 47 Packet Description and Use
http://support.microsoft.com/kb/241251

Issue:- TCP/IP CP reported error 733: A connection to the remote computer could not be completed. You might need to adjust the protocols on this computer.

On the server we may get the following event:-

Event Type: Error
Event Source: RemoteAccess
Event Category: None
Event ID: 20050
Date: 11/7/2008
Time: 3:26:08 PM
User: N/A
Computer: SBS2003
Description:
The user Domain\Admin connected to port VPNx-x has been disconnected because no network protocols were successfully negotiated.

STEPS TO RESOLVE

1. Make sure is there is DHCP Server Running on the network. If yes make sure the SBS Internal IP is excluded from the scope of IP range.
2. Try assigning static IP pool in RRAS for VPN users.
3. Take a system state back of the server.
4. Try resetting TCP/IP stack first:
How to reset "Internet Protocol (TCP/IP)" in Windows Server 2003
http://support.microsoft.com/default.aspx/kb/317518/

5. If the above does not help then reinstall TCP/IP stack using the following knowledge base article.
How to remove and reinstall TCP/IP on a Windows Server 2003 domain controller
http://support.microsoft.com/kb/325356
*please be careful while doing this, if possible call PSS for the same.

6. Reboot the server after the reboot it normal for the server to boot up a bit slow once the server is up test to see if VPN connect from within the network and then externally

Issue:- You receive an "Unable to establish the VPN connection" error message when your Windows Small Business Server 2003-based client computer try to make an outgoing PPTP connection

Error 800: Unable to establish the VPN connection. The VPN server may be unreachable, or security parameters may not be configured properly for this connection.

STEPS TO RESOLVE

Method 1:

1. On the Small Business Server 2003-based server, click To Do List in the left pane of the Server Management console.
2. Under Network Tasks, click Configure Remote Access.
3. Click Next, click Enable Remote Access, click to select the VPN Access check box, and then click Next.
4. Type the fully qualified public domain name (FQDN) of your server, click Next, and then click Finish.
5. When the wizard is completed, click Close.
6. Check if KB 936594 is installed.

Issue:- After connecting to VPN client is unable to access resources .

On ISA 2004 (which is part of SBS 2003 Premium Edition) Event 14147 is logged that the IP is spoofed.

Event Type: Error
Event Source: Microsoft Firewall
Event Category: None
Event ID: 14147
Computer: SBS
Description:
ISA Server detected routes through the network adapter LAN that do not correlate with the network to which this network adapter belongs. When networks are configured correctly, the IP address ranges included in each array-level network must include all IP addresses that are routable through its network adapters according to their routing tables. Otherwise valid packets may be dropped as spoofed. The following ranges are included in the network's IP address ranges but are not routable through any of the network's adapters x.x.x.x- x.x.x.x ;. Note that this event may be generated once after you add a route, create a remote site network, or configure Network Load Balancing and may be safely ignored if it does not re-occur.

STEPS TO RESOLVE

Step 1. Configure the Network setting on ISA 2004 correctly.

1.Start the ISA Server Management program. To do this, click "Start", point to "All Programs", point to "Microsoft ISA Server", and then click "ISA Server Management".
2. Expand "<name of your ISA Server computer>", and then click "Firewall Policy".
3. In the right pane, click the "Toolbox" tab, and then click "Network Objects".
4. Expand "Networks", and then click the network object that you want to modify. For example, click "Internal".
5. Click "Edit", and then click the "Addresses" tab.
6. Under "Address ranges", click the address range that you experience this issue with, and then click "Remove". For example, click the "192.168.0.1 to 192.168.254" address range.
7. Click "Add Adapter", click to select the check box of the network adapter that you want to add to this particular network, and then click "OK".

Step 2. Try giving static range on the DHCP server to the VPN clients . Try giving a different range of IP address which is different from the internal range of IP.

If the above steps do not help you resolve the issue please call Microsoft Technical Support.

How to obtain SBS 2000/SBS 2003 licenses now that SBS 2008 has released?

Team SBS — Fri, 07 Nov 2008 18:32:21 GMT

[This post comes to us courtesy Rituraj Choudhary]

We have had a couple of queries where people wanted to purchase SBS 2003 or SBS 2000 Client Access Licenses. We no longer have an option to purchase the same with the advent of SBS 2008. We can only purchase SBS 2008 CALs now. So, what do we do?

Well, we can exercise the Downgrade Rights. Downgrade Rights, with respect to SBS, is a way we can downgrade SBS 2008 licenses for the earlier versions of the SBS product offerings. Of course, you cannot separate out the components of the SBS solution. If you downgrade, you must downgrade all components of the software.

Please use the following chart to view the available downgrade options:

If you have purchased SBS 2008 CALs from the Volume Licensing (VL) channel, you will be given SBS 2003 CAL keys at the time of purchase; these keys can then be used for downgrade SBS 2008 CALs to SBS 2003 (R2).

For those of you who have purchased SBS 2008 CALs from channels other than VL, such as FPP and OEM, based on the country you are in, you can either call or e-mail to get the product keys for SBS 2003 CALs as you downgrade your SBS 2008 CALs. You must have the earlier version of the SBS media already available with you.

For EMEA region you need to email direct-mar@msdirectservices.com or call us at 0044 870 60 10 100 (UK) and ask the Customer Representative to transfer your call to the direct services. The complete list of the contact information for all the regions can be found at http://www.microsoft.com/sbs/en/us/contact.aspx

Reference:

A full-fledged document is already available on the following Microsoft site: http://www.microsoft.com/sbs/en/us/downgrade-rights.aspx. With this blog post we would just like to make it more visible.

Demonstration of E-Mail Receipt and E-Mail Archival by a SharePoint Library.

Team SBS — Mon, 03 Nov 2008 13:11:12 GMT

[This post comes to us courtesy Rituraj Choudhary]

Windows SharePoint Services version 3 supports Libraries to be able to receive emails. However, by default it does not have this feature enabled in SBS 2008, as Exchange and WSSv3 are installed on the same box. In SBS 2008, it is enabled by configuring an email domain to be used by the SharePoint site. Exchange creates a foreign connector to take care of the mail routing.

In order to demonstrate, let us create a new SharePoint library:

We can specify whether this document library is capable of receiving emails here:

If we do not enable the Incoming E-Mails setting above, we can do it later as well. We can also follow these steps for the existing libraries. Here is the procedure. Open the Library in question. Go to Settings \ Document Library settings.

On the Customize page, select Incoming E-Mail settings:

Let us enable both of these options:

Incoming E-Mail: Allow this document library to receive e-mail? Yes. Type a distinctive email address.

E-Mail Message: Save original e-mail? Yes. This will save the email as well.

Click OK to save the settings.

For users to be able to send e-mails to the SharePoint libraries, we need to create a Mail Enabled Contact in the Exchange Management Shell (you can also do this from the console). The following command creates the mail enabled contact:

[PS] C:\Windows\System32> New-MailContact -Name TestLib -ExternalEmailAddress Testlib@companyweb

Name                                      Alias                                RecipientType
----                                         -----                                 -------------
TestLib                                    TestLib                             MailContact

Let us wait for a few minutes for the Offline Address List to be updated in Outlook before attempting to send e-mail.

Now, let us send an email with an attachment to test the receipt of the emails in the Library:

The email should then go to the local C:\inetpub\mailroot\drop directory:

You should now see the e-mail dropping in to the library:

If we click on the attachment, it gives the option to save or open the file:

If we click on the email, we can see the email contents:

Archiving Emails:

You can also enable E-Mail Archival as per the steps above. Let us configure it on the Shared Documents in the Archived E-Mails site under the Companyweb.

Open the Shared Documents in the Archived E-Mails site, and configure the Settings > Document Library Settings > Incoming e-mail settings as:

Create the mail enabled contact on the Exchange Management Shell as:

New-MailContact -Name OldEmails -ExternalEmailAddress OldEmails@companyweb

Create a new Transport Rule under Organization Configuration in the Exchange Management Console:

Don’t choose any of the options on the conditions page, it should prompt that the rule will be applied to every message. Select Yes.

Under the Actions, select “Blind carbon copy (Bcc) the message to addresses”. Click addresses to select the Recipient as OldEmails mail-enabled contact we just created. Hit OK twice.

Keep clicking Next until you Finish.

Send an email to any one for testing.

A blind carbon copy should drop to the Companyweb > Archived E-Mails > Shared Documents as below:

Additionally, we can also view the Email Details (From, To fields etc) by selecting Edit Properties of the item.

Please also note that if we create an e-mail enabled Security Group using Windows SBS Console, there is an option of archiving e-mail messages to the group on the Windows SharePoint Services Web site (Companyweb > Archived E-Mails) on the server. This facility is not available for Distribution Groups.

Reference:

http://technet.microsoft.com/en-us/library/cc287879.aspx