Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

The Official SBS Blog : Loss of Internet Connectivity After Installing 951748 and 951746

Thu, 17 Jul 2008 20:43:07 GMT

PingBack from http://blogs.technet.com/sbs/archive/2008/07/11/loss-of-internet-connectivity-after-installing-951748-and-951746.aspx

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

HandyAndy — Thu, 17 Jul 2008 22:09:33 GMT

Can you please clearify is we need to add just the 5 ranges you listed in text or the 10 ranges in the screen shot?

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

SBS Bloggers — Thu, 17 Jul 2008 23:07:03 GMT

Hi,

The screen shot shows the ReservedPorts value from an SBS server with ISA installed. ISA adds a few values to the key on its own.

You should just need to add the 5 ranges to your current ReservedPort values. Again, the values to add are:

1645-1646 - Used by IAS

1701-1701 - Used by L2TP

1812-1813 - Used by IAS

2883-2883 - Used by AUTD

4500-4500 - Used by IPSEC

Regards,

SBS

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

ALW — Thu, 17 Jul 2008 23:25:33 GMT

Some are suggesting removing the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\MaxUserPort registry entry as a fix. Is this also recommended?

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

SBS Bloggers — Thu, 17 Jul 2008 23:33:58 GMT

At this time, please do not remove the MaxUserPort registry key.

Before this update, if you did not have the MaxUserPort registry key, the dynamic port range was from 1024 to 5000.

With this update, and without the MaxUserPort registry key, the dynamic port range is now from 49152 to 65535.

The MaxUserPort is set by Exchange (to 60000) and by ISA (to 65535) and this would set the effective dynamic range from 1024 to MaxUserPort (with or without the update).

As you can see, those two products are setting the server up for many more dynamic ports than the ~16000 that you would get when the registry key is not present.

Regards,

SBS

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

Grateful — Fri, 18 Jul 2008 14:29:57 GMT

Thank you so much for this info!

This stopped IAS from starting which in turn stopped RRAS from starting. Applied the registy edit and IAS could start straight away but RRAS required server reboot.

SBS Services failing after MS08-037 - KB951746 and 951748

Nick Whittome - The Naked MVP — Fri, 18 Jul 2008 15:27:52 GMT

Direct copy from the SBS Blogpost here . One important comment to note is that the MaxUserPort registry

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

Roger — Fri, 18 Jul 2008 17:33:31 GMT

The link to kb article 812873 seems to be pointing to an internal MS alias.

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

SBS Bloggers — Fri, 18 Jul 2008 18:16:45 GMT

Good catch, we fixed the link, it now points to http://support.microsoft.com/default.aspx?scid=kb;EN-US;812873, thanks.

SBS

DNS Server Reserves 2500 Ports.

Tales from the Crypto — Sat, 19 Jul 2008 08:02:21 GMT

After applying the patch for MS08-037 - KB 953230 (the multi-OS DNS flaw found by Dan Kaminski ), you

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

isablog — Sun, 20 Jul 2008 17:09:19 GMT

If your SBS server also tuns ISA Server, then DO NOT change the MaxUserPorts registry value. The ISA installer sets this to 65535 to provide the maximum number of ports possible.

DNS Server Reserves 2500 Ports.

Tales from the Crypto — Mon, 21 Jul 2008 02:37:53 GMT

After applying the patch for MS08-037 - KB 953230 (the multi-OS DNS flaw found by Dan Kaminski ), you

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

Jeff — Wed, 23 Jul 2008 11:29:45 GMT

Cured my "AUTD failed to initialize" woes. Thanks!

New KB Articles Released Concerning Issues Around DNS Security Update 953230 (MS08-037)

The Official SBS Blog — Fri, 25 Jul 2008 23:00:27 GMT

Two new KB articles have been released that discuss the issue we first spoke about in our blog post entitled

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

Matthew Roberts — Sun, 27 Jul 2008 22:36:18 GMT

I believe this issue also occurs on Windows Server 2003 with ISA installed and is not just restricted to SBS.

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

Dave — Tue, 29 Jul 2008 05:50:20 GMT

Great article. Thank you very much! You saved me from a major headache. Our SBS was randomly unable to connect to the network after our nightly backup (thanks to the IPSec port conflict). Much appreciated!

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

Jim — Tue, 29 Jul 2008 21:11:30 GMT

I imagine SBS means Small Business Server. Does this blog entry also pertain to non Small Business Servers such as Server 2003 Standard, Enterprise, etc.?

re: Some Services May Fail to Start or May Not Work Properly After Installing MS08-037 (951746 and 951748)

Mark Hicks — Fri, 01 Aug 2008 17:24:47 GMT

MS needs to release a patch for SBS that, at least, avoids having DNS choose any ports that effect SBS-related services... I cannot belive they did not catch this in regression testing.

The way this is setup you are rolling the dice every time you reboot. If DNS starts before XYZ service and happens to grab a port that XYZ needs then XYZ will fail. The only way to gurantee clean reboot it to force DNS to start last (it appers to be smart enough to not grab ports already in use) and to exclude any and all ports that might be used by other thigns in the future.

We have not seen this effect Remote Desktop via RWW on SBS. It would not work until we stopped the DNS service. Once we had it working we restarted DNS and it continued to work but there is no guarnatee this will be the case next time we boot the server.

-/\/\ark

Can not reinstall SP2

Ola Benderius — Mon, 04 Aug 2008 23:46:13 GMT

I think this is the problem that I have. But in my case its a bit worse. I have done what the article suggests, but I can not reinstall SP2 since the "Cryptographic service" also is stopped. Neither can I uninstall SP2, I get a message "File not found".

Any advice?

Reminder: New Security Updates to be released tomorrow

The Official SBS Blog — Mon, 11 Aug 2008 22:15:56 GMT

[Today's post comes to us courtesy of Damian Leibaschoff] On August 12 th , Microsoft will release several