Blog of the EMEA SBS Team

A New beginning and an end…

2009-03-17T12:19:00Z

Hello Readers,

With mixed feelings we are announcing the end of postings on this blog. The blog will continue to be here so that you may refer to old posts however we will contribute new posts to The Official SBS Blog and hope to contribute our bit to SBS world.

We hope that you saw value out of our blogging here and will continue to help us help you.

With Newsletters, things are still a bit undecided. While the right thing is clearly to continue it so that pure technical information reaches your door step, we would like to know what you feel about it. Hence we have a small poll below. Please let us know your thoughts on the news letter and we shall decide with that.

See you there. :)

SBS 2003: Configuring ISA 2004 behind a Router for Router to Router VPN Tunnel.

2009-02-16T20:28:37Z

[Today’s post comes to us courtesy Milind Bhavsar.]

Router to router VPN between sites is quite a common scenario. We have often see scenarios where on one side we have SBS 2003 with ISA 2004 installed in Edge firewall mode and on other side we have Windows 2003 Server Std. Edition running ISA 2004 Std. or just a Windows 2003 Server Std. without any firewall. So we have decided to blog about the same.

General Issue’s with this configuration.

1) Not able to access Internal Network (SBS) from remote site.
2) Traffic destined for Internal Network (SBS) doesn’t reaches the external interface of the ISA 2004.

Configuration and Troubleshooting discussed in this blog are to be done on ISA 2004 and some minute changes on your router however this blog does not cover router to router VPN. We are presuming your router-to-router VPN is working fine.

Configuration on ISA 2004.

1) Create a Computer Set in ISA 2004 with the range of remote network.
For e.g. on Site A ISA 2004 create a computer set specifying the range as 10.0.0.1 to 10.0.0.254
2) Then create a Access Rule in ISA 2004 which allows all traffic from computer set to Internal network and local host.
3) Do the same configuration on Site B with computer range 172.16.1.1 – 172.16.1.254.
4) You don’t have to make any changes on the other side if ISA 2004 is not installed and RRAS (NAT ) is also not in use.
5) However you will have to check the router configuration which we will discuss further in this blog.

1> Creating a Computer Set:

> Open ISA2004 Management Console and click on Firewall Policy under your ServerName.
> On the far right, click on Toolbox> Network Objects> New> Computer Set.

2> Creating the Access Rule:

> Right click on Firewall Policies> New> Access Rule.
> Type a name and then click next.
> Select “Allow” rule Action and select “All Outbound traffic”. Select the Computer Set created as source.
> Select Internal network and local host as destinations.
> Allow the rule for all users.

Apart from the ISA 2004 configuration you also have to make sure that the routers are aware about all the remote subnets, because if you see the example diagram on each site we have two network subnets.

In most of the configuration we see that traffic destined to internal network of router (e.g. Site A 192.168.1.x) is configured on the remote router (e.g. router B), But the remote router (Router B) doesn’t have any information of the subnet behind ISA 2004 (e.g. 172.16.1.X)

Same goes for Site A router which knows the router B internal network (e.g. 192.168.2.X) but doesn’t know the subnet behind the ISA 2004 on Site B (e.g. 10.0.0.0)

The best way to determine the configuration of router on both the sides is to do a tracert to reach the other subnet

For e.g

From Site A SBS server we ran following command

1) Tracert 192.168.2.2 (In Most situations this works fine)

a)First Hop would be the router on local site 192.168.1.1
b)Then instead of traffic going on to the Internet will go in vpn tunnel and reach the tunnel end point on the other side 192.168.2.1.
c) Finally reaches the External Interface of ISA 2004 192.168.2.2.

2) Tracert 10.0.0.1

a) First Hop would be the router on local site 192.168.1.1.
b) Now it can go to search 10.0.0.0 network on internet depending on the configuration of the router because if the router doesn’t know that 10.0.0.0 network also exist at the end of same VPN tunnel it will push the traffic to internet

We have taken e.g. of Draytek router how to configure the additional remote subnet however if you have a different router, please refer to your respective manufacturer’s product guide.

c) On site A router you see the remote network 192.168.2.0 which is the internal network for the Site B router click on more button and add the other subnet for Site B that is 10.0.0.X with correct subnet mask
d) Now try to do tracert 10.0.0.1 you should see that it reaches the local router 192.168.1.1 then it reaches the other side of tunnel Site B router 192.168.2.1. Then surprisingly you see that it goes to internet why?
e) This is again a configuration issue at the Site B router because it doesn’t know 10.0.0.X is towards its LAN side and to reach 10.0.0.X he has to give the traffic to ISA 2004 External interface (e.g. 192.168.2.2)
f) For this you have to add a static route on the router at Site B will again take e.g. of Draytek.

While adding this route Make sure that you select the network Interface as LAN because the subnet is towards the LAN Side and the gateway IP would be of the ISA 2004 External Interface.

Check the routing table to see if route is successfully added. From the Diagnostic -> Routing options

These configurations would address most of the issue the last thing is to check if the client machines on the remote sites should point to correct default gateway.

* Examples and Screen shots of router shown in this blog are for illustration sake only. We do not support any 3rd part firewall or router. Please refer to your manufacturers documentation if you have any doubts or concerns.

Essential Business Server 2008 (EBS) - Security Server Installation fails on Forefront Threat Management Gateway.

2009-02-09T14:12:05Z

[This post comes to us courtesy Vikramjit Singh.]

Issue

You have installed the first server of Essential Business Server 2008 – Management Server. Now while installing the Security the setup fails on Forefront TMG with he following error:

“An error occurred while configuring the certificate for the server.”

Here’s a screenshot:

*Apologies for the poor screenshot, we will update it with a better one the next time we come around the error. :)

Cause

This could be caused due to a time difference between the Management Server and the Security Server. All EBS servers install on PST time zone by default. If the time/time zone is altered during the installation of these servers you could expect a few failures. Also the Security server may synchronize time with its BIOS. As a result, Kerberos tickets expiry because of the time change which causes the conflict/authentication failure eventually resulting in a failure of installation which cannot be resumed.

MMSSetup.log can confirm that the failure was caused because of a time difference. Please use Shift+F10 to open the command prompt on the security server. Go to c:\Program Files\Windows Essential Business Server\Logs\MMSSetup.log

You can view the time as marked in yellow in the log below:-

[1008],"2021.09.22 18:37:11.812","MMSNet","Information","**********************************"
[1008],"2021.09.22 18:37:12.843","MMSNet","Information","Entering IsDomainJoined()"
[1008],"2021.09.22 18:37:12.843","MMSNet","Information","status = 'NetSetupWorkgroupName’
[1008],"2021.09.22 18:37:12.843","MMSNet","Information","Return value of this method = 'False'"
[1008],"2021.09.22 18:37:12.875","MMSSetup","Information","SETUP STARTING: 09/22/2021 18:37:12"

In the log above we can see that the year mentioned above 2021 which is incorrect. This is due to the wrong date in the BIOS which needs to be changed.

Resolution

Unfortunately reinstallation of security server cannot be avoided! Therefore turn the machine off, reboot it and go into the BIOS. Under the BIOS settings please make sure that the date and time are the same as that on the Management Server (most likely PST). Once the changes have been made exit setup and use the Security Server disk to restart the Installation.

Please format the system drive and the data drive as well and proceed with the Installation of the Security Server. Once the setup wizard occurs you would reach a stage where it would prompt for the domain name and details. After this is entered the setup might go into a replacement mode state where it knows that the security server was already installed previously and was part of the domain. Therefore the user might be prompted to run the installation is replacement mode. If yes, please click on “Prepare Replacement”

Now follow the simple instructions on the screen and continue.

Note: You are not required to do any cleanup to remove Security Server’s objects and attributes in Active Directory or on the existing servers in the domain. The setup would automatically detect that and do necessary changes and continue the installation.

SBS2008 Migration: Source Tool may fail to ADPREP on Source Server (SBS 2003).

2009-01-29T21:58:26Z

[Today’s post comes to us courtesy Girish Rajan and Ketan Upgade.]

During migration, one of the most important steps on the source server is running the Source Tool also know as Migration Preparation Tool. The Source Tool does the following things;

1> Runs Adprep.exe, which extends the AD DS schema and updates permissions as necessary to prepare a forest and domain for a domain controller that runs Windows SBS 2008. The AD DS schema in Windows SBS 2008 is not the same as the AD DS schema in Windows SBS 2003 or in Windows Server 2003. To successfully complete the migration process, you must update the AD DS schema on the Source Server if it is running Windows SBS 2003 or Windows Server 2003.

Important : You should back up your Source Server before you run the Migration Preparation Tool. All changes that the Migration Preparation Tool makes to the schema are irreversible. If you experience issues during the migration, the only way to return the Source Server to the state before you ran the Migration Preparation Tool is to restore the system backup.

2> Installs an update that extends the time limit for finishing the migration. Normally, only one server running Windows SBS 2008 or Windows SBS 2003 is allowed to be a domain controller on your network, but there is a limited exception for a migration. The update extends the time limit for the exception to 21 days.

3> Prepares the server to migrate from Exchange Server 2003. For the migration to succeed, Exchange Server must be in native mode, not mixed mode. For more information about converting from mixed mode to native mode, see “How to convert from mixed mode to native mode in Exchange” at the Microsoft Web Site (http://go.microsoft.com/fwlink/?LinkId=104943).

The Source Tool may fail to complete successfully because ADPREP fails.

You may see the following error in the SourceTool.log;

01/14/2009 10:50:53 Adprep returned: UnableToModifyError(6)
01/14/2009 10:50:53 Skipping domain prep, since ADPrep failed.

If you run adprep manually you may get the following error message;

Error message: C:\WINDOWS\debug\adprep\logs\20080923153448\LDIF.log The process cannot access the file because it is being used by another process.
(0x80070020).
[User Action]
Check the log file ADPrep.log, in the C:\WINNT\debug\adprep\logs\2008092315344 8 directory for more information.

You may also see the following errors in adprep.log;

[Status/Consequence]

Error message: Error(110) while running ""C:\WINDOWS\system32\LDIFde.exe" -o ObjectGuid –d "CN=interSiteTransportContainer-Display,CN=404,CN=DisplaySpecifiers,CN=Configuration,DC=BrinkerTechnology,DC=local" -u -f "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TMP2BA2.tmp" -j "C:\WINDOWS\debug\adprep\logs\20090114112842" -s bt-1.BrinkerTechnology.local". Could not move file C:\WINDOWS\debug\adprep\logs\20090114112842\LDIF.err to C:\WINDOWS\debug\adprep\logs\20090114112842\DisplaySpecifierUpgradeLdifError.001.txt. The system cannot find the file specified.

(0x80070002).

At this point, even if you run DCDIAG and NETDIAG they might not show any obvious errors.

RESOLUTION:

Important: To run the Migration Preparation Tool, you must be a member of the Enterprise Admins group, the Schema Admins group, and the Domain Admins group. Check this first!

If you have any Antivirus Software Running, its likely that the AV might be using these files. Disable them completely, as in stop the services. If that does not help, try uninstalling them.

The Source Tool should run successfully now.

Related KB: SBS 2008 Migrations Fail When The Migration Preparation Tool Has Not Been Run
http://blogs.technet.com/sbs/archive/2008/12/19/sbs-2008-migrations-fail-when-the-migration-preparation-tool-has-not-been-run.aspx

SBS 2008, Backup and Time Zone (GMT+2) Jerusalem. What’s cooking?

2009-01-26T11:49:00Z

[Today’s post comes to us courtesy Girish Rajan. Special thanks to Justin Crosby.]

On a Windows Small Business Server 2008 the backup wizard may not work from SBS 2008 Administrator console and you may also receive errors trying to open the Windows Server 2008 Native Backup Console. Your backups may still work and you should be able to take backups via command line, that is wbadmin.

Error while trying to run the Configure backup Wizard from SBS 2008 Administrator’s Console:

[Window Title]
Configure Server Backup

[Main Instruction]
The wizard cannot retrieve backup settings.

[Content]
An unknown problem is preventing the wizard from retrieving backup settings. Please try again. If this problem persists, contact the person or company who provides you with technical support.

[OK]

You may also see the following error (if you delete the schedule task created by backup wizard):

Microsoft Windows
Windows SBS 2008 Server Backup Configuration Wizard has stopped working

Windows can check online for a solution to the problem.

Description:
Stopped working
Problem signature:
Problem Event Name:        CLR20r3
Problem Signature 01:        sbcw.exe
Problem Signature 02:        6.0.5601.0
Problem Signature 03:        48a22618
Problem Signature 04:        mscorlib
Problem Signature 05:        2.0.0.0
Problem Signature 06:        475777fa
Problem Signature 07:        f46
Problem Signature 08:        7
Problem Signature 09:        N3CTRYE2KN3C34SGL4ZQYRBFTE4M13NB
OS Version:        6.0.6001.2.1.0.305.9
Locale ID:        1037.

If you open the native Windows Server 2008 Backup Console, you may see the following error:

In C:\Program Files\Windows Small Business Server\Logs\SBCW.txt you will find the following error;

SyemTimeToTzSpecifiLocalTime failed due to error: The parameter is incorrect, (0x80070057)..

CAUSE:

This issue occurs if the following conditions are true:

1> The time zone on the computer is set to Jerusalem.
2> The Automatically adjust clock for Daylight Saving Time option is selected.

SOLUTION:

Download and install the hotfix as per the following Knowledge Base Article;

Error message when you try to perform a backup on a Windows Server 2008-based computer on which the time zone is set to "Jerusalem": "The parameter is incorrect, 0x80070057"

http://support.microsoft.com/kb/953406.

* By default SBS 2008 installs itself on (GMT-8) Pacific Time (US & Canada). If you don’t change the time zone during install and have configured your server completely using wizards then, later when you change it, you must wait for some time until SBS behaves normally.

SBS2008- “Cannot Configure Backup Schedule” error when you run Configure Server Backup wizard on Small Business Server 2008.

2009-01-26T11:32:37Z

[Today’s post comes to us courtesy Vikramjit Singh.]

We have seen a couple of issues with SBS 2008 Backup now and here is one of them. You may receive the following error while running SBS 2008 Backup Wizard.

CAUSE:

This error may occur if the amount of data which is being backed up is more than the actual size of the backup drive.
For example - If we have 3 partitions as below:-

C Drive – Used Space 124 GB
D Drive – Used Space 83 GB
E Drive – Used Space 103 GB

Total Data to backup is 310 GB. However, if the backup disk has a capacity of 310 GB or lesser then we would receive the above error message.

Also if we look at the SBCW.log under C:\Program Files\Windows Small Business Server 2003\logs the following error can be seen:-

[11220] 090121.120151.1246: WizardChainEngine Next Clicked: Going to page {0}.: LabelPagePresenter[11220] 090121.120156.0074: WizardChainEngine Next Clicked: Going to page {0}.: SourcePagePresenter
[11220] 090121.120158.6282: Storage: Volume (MountPoint=\\?\Volume{186b47b0-c800-11dd-958a-806e6f6e6963}, MountPath=C:) is selected as source
[11220] 090121.120158.6282: Storage: Volume (MountPoint=\\?\Volume{186b47b2-c800-11dd-958a-806e6f6e6963}, MountPath=D:) is selected as source
[11220] 090121.120158.6282: Storage: Volume (MountPoint=\\?\Volume{186b47b1-c800-11dd-958a-806e6f6e6963}, MountPath=E:) is selected as source
[11220] 090121.120158.6282: WizardChainEngine Next Clicked: Going to page {0}.: SchedulePagePresenter
[11220] 090121.120200.6250: Storage: 17:00 is selected as schedule time
[11220] 090121.120200.6250: Storage: 23:00 is selected as schedule time
[11220] 090121.120200.6250: WizardChainEngine Next Clicked: Going to page {0}.: SummaryPagePresenter
[11220] 090121.120204.5406: Wizard: WizardChainEngine Next Clicked: Last page, so the wizard isdone, closing wizard frame and returning
[10564] 090121.120204.7902: AdminTME: AdminDataLink Running Task: CommitterSequenceTask
[10564] 090121.120204.9150: Storage: Remove backup target: Label=Backup Drive 1
[10564] 090121.120204.9306: Storage: Create backup target disk: DiskName=Seagate FreeAgent Go USB Device, Label=Backup Drive 2
[10564] 090121.120204.9306: Storage: Add backup target: Label=Backup Drive 2
[10564] 090121.120218.0658: Storage: Terminating error in Set-WBPolicy: Microsoft.SnapIns.Backup.UI.Proxy.BlockLevelBackupException: IBlbEngine::ModifyTemplate failed due to Blb error: EBackupTargetSpaceNotEnough (0x80780048).

Resolution:

You could add a backup drive which has more space capacity than the data which has to be backed up. Else could deselect one of the data drives from the backup list and then continue.

SBS 2008: CTIW fails to complete successfully.

2009-01-16T13:53:02Z

[Today’s post comes to us courtesy Moloy Tandon.]

Recently we have seen few cases where the Connect To Internet Wizard (CTIW) may fail to complete successfully.

When you run the CTIW it may fail to detect the router and you may be presented with the following screen to type the IP of the router and server.

When you click next after typing the IP details, the wizard may fail with the following error. Additionally, you would notice that the wizard removes the Default Gateway entry from the NIC properties and may also change the IP address of the server.

[Internet connection is incomplete - Windows SBS has encountered an unknown error. For more information, contact Microsoft Product Support.]

If you analyze the CTIW.log file, you may see something similar

[9744] 090107.141539.6875: CoreNet: netsh: interface ip set address 10 static address=192.168.0.1 mask=255.255.255.0

[9744] 090107.141540.8107: CoreNet: WSA ERR# 10022 when binding a socket to 192.168.0.1 to check for address availability

[9744] 090107.141540.8107: CoreNet: Exception System.Net.Sockets.SocketException:

[9744] 090107.141540.8263: Exception:

---------------------------------------

An exception of type 'Type: System.Net.Sockets.SocketException, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' has occurred.

Timestamp: 01/07/2009 14:15:40

Message: An invalid argument was supplied

Stack: at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)

at System.Net.Sockets.Socket.Bind(EndPoint localEP)

at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.WaitForNewIp4sToPropagate(Ip4Address32[] newIp4Addresses, Int32 deadlineSeconds)

[9744] 090107.141540.8263: CoreNet: Exception Microsoft.WindowsServerSolutions.CoreNetworking.CNetException:

HR: 0

[9744] 090107.141540.8263: Exception:

---------------------------------------

An exception of type 'Type: Microsoft.WindowsServerSolutions.CoreNetworking.CNetException, CNetManagement, Version=6.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' has occurred.

Timestamp: 01/07/2009 14:15:40

Message: Couldn't bind a socket to the new address after several retries.

Stack: at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.EnableStatic(AddressAndMask[] Ip4AddressesAndMasks, Int32 deadlineSeconds)

at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.EnableStatic(IPAddress[] IpAddresses, IPAddress[] IpNetMasks, IPAddress[] Gateways, UInt16[] GatewayMetrics)

at Microsoft.WindowsServerSolutions.CoreNetworking.NetworkDiscovery.SaveLocalNicAndRouter(CNetNic nic, CRouter router, Boolean findBetterIP)

[9200] 090107.141540.8263: CoreNet: Exception caught in network detection

[9200] 090107.141540.8263: CoreNet: Exception Microsoft.WindowsServerSolutions.CoreNetworking.CNetException:

HR: 0

[9200] 090107.141540.8419: Exception:

---------------------------------------

An exception of type 'Type: Microsoft.WindowsServerSolutions.CoreNetworking.CNetException, CNetManagement, Version=6.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' has occurred.

Timestamp: 01/07/2009 14:15:40

Message: Couldn't bind a socket to the new address after several retries.

Stack: at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.EnableStatic(AddressAndMask[] Ip4AddressesAndMasks, Int32 deadlineSeconds)

at Microsoft.WindowsServerSolutions.CoreNetworking.CNetNic.NicIpInfo.EnableStatic(IPAddress[] IpAddresses, IPAddress[] IpNetMasks, IPAddress[] Gateways, UInt16[] GatewayMetrics)

at Microsoft.WindowsServerSolutions.CoreNetworking.NetworkDiscovery.SaveLocalNicAndRouter(CNetNic nic, CRouter router, Boolean findBetterIP)

at Microsoft.WindowsServerSolutions.Networking.Wizards.CTIWizard.DetectNetworkPagePresenter.RouterWasFound(BackgroundWorker worker, NetworkDiscovery nd, CNetNic nic, CRouter theRouter, Boolean useCurrentSetting)

at Microsoft.WindowsServerSolutions.Networking.Wizards.CTIWizard.DetectNetworkPagePresenter.detection_DoWork(Object sender, DoWorkEventArgs e)

at System.ComponentModel.BackgroundWorker.WorkerThreadStart(Object argument)

Using Time Travel Tracing (TTT) we discovered a third-party DLL associated with an antivirus software was blocking our request of binding the socket to the IP address.

After we uninstalled the third-party antivirus software, the CTIW ran and completed successfully.

SBS 2008: Some key changes in Terminal Services

2009-01-16T13:34:21Z

[Today’s post comes to us courtesy Moloy Tandon]

In this post I would highlight some key changes in Terminal Services in SBS 2008 which may affect user experience and how system administrators remotely manage the server.

Change 1:

By default, SBS 2008 restrict each user to a single Terminal Services session. What that means if someone is already logged on to the console or RDP session using User Account A, another session with the same user account would overtake the first session. So at any given point you will have only 1 session (Terminal Services or Console) to the server with User Account A.

However, you can edit this default setting and can have 2 simultaneous connection using the same user account.

Change 2:

When connected to SBS 2008 via RDP client, you can now remote control or shadow the console session. You can achieve this from Terminal Services Manager. However, you cannot shadow an RDP session from a console session (the Remote Control and Connect options are grayed out).

Note: The changes discussed here are Windows Server 2008 feature and not just SBS-specific.

You receive a Vbscript error while connecting to the client/server computer using RWW in SBS 2008.

2009-01-10T09:41:08Z

[Today’s post comes to us courtesy Bhushan Gokhale.]

In SBS 2003, we receive the request from remote machine on port 4125 (which opens Dynamically on the server), and after validating the request, we redirect it to the appropriate client machine. Unlike SBS 2003, we do not use port 4125 redirection anymore. In SBS 2008, Remote Web Workplace is based on the TS gateway technology (TS gateway is a part of Windows Server 2008 role suite). However, if the certificates are not configured correctly, you may experience the following issue.

You may get the following error while connecting to the client or server computer, which is inside SBS 2008 network, using Remote Web Workplace:

---------------------------
VBScript: Remote Desktop Disconnected
---------------------------
An internal error has occurred (error 50331688). For more information, please contact your network administrator or Microsoft Product Support.
---------------------------
OK
---------------------------

To isolate the issue, you must try to connect to the internal computer using Remote Desktop Client (RDP). To connect using Remote Desktop Client, follow the steps given below:

-Open the RDP client.
-Click on Options.
-Go to Advanced tab,
-Click on Settings.
-Select “Use these TS gateway server settings”.
-Type the External URL that you use to connect to RWW (without https://). For Eg.: Remote.contoso.com
-Click on General Tab.
-Type the name of the internal computer you want to connect to. For Eg.: computer1.contoso.local
-Fill in other details and click on connect.

When you try to connect to the client machine, with SBS 2008 as TS gateway, you get the error:

This issue occurs if you do not have the certificate installed on the TS Gateway. To resolve this issue you must add the certificate on TS gateway. To do this, follow the steps given below:

- Open TS gateway manager. (Start-Administrative Tools-Terminal Services-TS gateway manager).
- Click on Server name.
- Click on Properties on the right most pane.
- Click on SSL certificate Tab.
- If you have the correct certificate installed, you should see the Window as shown below.

If the certificate is not installed, you should see the Window as shown below:

To install the certificate, you must first ensure that the correct certificate is available on the server.
You should find this certificate in the personal store of SBS 2008. To check the certificate in the personal store:

· Click on Start-Run
· Type mmc and click on ok
· Click on File and select Add/Remove Snap-in from the menu.
· Select Certificate Snap-in from the list an click on Add
· Select Computer Account and click on Next.
· Select Local Computer and click on Finish.
· Click on OK again.
· Expand Certificate Snap-in
· Expand Personal and click on Certificates.
· You should see the certificate issued by your Certificate Authority to your External domain name (For Eg: remote.contoso.com)
· If you do not see this certificate, run the “Setup your internet Address” or “Fix my Network” wizard again.
· If you are using the 3^rd Party Certificate, make sure that the certificate is a part of Computer’s Personal Store.

To add this certificate on the TS Gateway, follow the steps given below:

- Open the TS Gateway Manager.
- Right Click on the <servername> and click on properties.
- Click on SSL Certificate Tab.
- Click on Browse Certificates Button.
- Select the certificate that corresponds to your External domain name (remote.contoso.com)
- Click on Install.

After making these changes, you should be able to connect to the internal machines from Remote Web Workplace.

Intermittent Outlook Anywhere Connectivity issue in SBS 2008.

2008-12-10T13:30:24Z

The Official SBS Blog: Slow Connectivity for Outlook Anywhere and Sites that use the SBS Web Applications App Pool.
http://blogs.technet.com/sbs/archive/2009/02/10/slow-connectivity-for-outlook-anywhere-and-sites-that-use-the-sbs-web-applications-app-pool.aspx

The post below is a workaround, for the official solution to this issue, please refer to the link above.

[This post comes to us courtesy Rituraj Choudhary]

You may experience the following issue in SBS 2008:
Outlook Anywhere is very inconsistent and hardly connects. If you look at Outlook connection Status, it waits at Type Directory or Mail.

In the HTTPERR (under C:\Windows\System32\LogFiles) logs, you may find something like:

2008-11-13 16:55:10 124.124.68.131 40652 10.0.1.201 443 HTTP/1.1 RPC_IN_DATA /rpc/rpcproxy.dll?SBSDC1.CONTOSO.local:6004 400 0 BadRequest SBS+Web+Applications+application+pool
2008-11-13 16:56:01 124.124.68.131 40652 10.0.1.201 443 HTTP/1.1 RPC_IN_DATA /rpc/rpcproxy.dll?SBSDC1.CONTOSO.local:6004 400 0 Connection_Dropped SBS+Web+Applications+application+pool
These errors may appear for port 6001, 6002 and 6004.

If you enable Failed Request Tracing Rules on the /Rpc Virtual Directory, in the %SystemDrive%\inetpub\logs\FailedReqLogFiles\W3SVC3 xml files you may find something like:

Url: https://remote.contoso.com:443/rpc/rpcproxy.dll?SBSDC1.CONTOSO.local:6004
App Pool: SBS Web Applications application pool
Authentication: NOT_AVAILABLE
User from token:
Activity ID: {00000000-0000-0000-7827-0080000000D6}
Site: 3
Process: 7476
Failure Reason: STATUS_CODE
Trigger Status: 400
Final Status: 400
Time Taken: 70593 msec
Warning: SET_RESPONSE_ERROR_DESCRIPTION
ErrorDescription: ASP.NET detected invalid characters in the URL.
Warning: MODULE_SET_RESPONSE_ERROR_STATUS
ModuleName: HttptoHttpsRedir
Notification: 1
HttpStatus: 400
HttpReason: Bad Request
HttpSubStatus: 0
ErrorCode: 2147952454
ConfigExceptionInfo
Notification: BEGIN_REQUEST
ErrorCode: An existing connection was forcibly closed by the remote host. (0x80072746).

Resolution:
The IIS thinks the above mentioned URL to be malformed (Bad Request) and does not process the request further. This usually happens because of the corrupt configuration settings in the web.config file.

Renaming/deleting the web.config referred in the SBS Web Application application pool should resolve the issue.

Alternately, if a web.config is referred to by the /Rpc virtual directory, modify the <modules> .. .. ..<\modules> section in C:\Windows\system32\RpcProxy\web.config from:

<modules>
<remove name="HttptoHttpsRedir" />
<add name="HttptoHttpsRedir" type="Microsoft.WindowsServerSolutions.IWorker.IIS.Modules.HttpToHttpsRedir,HttpToHttpsRedir,Version=6.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="" />
</modules>

to:

<modules>
<remove name="HttptoHttpsRedir" />
</modules>