Re: Isa server not responding and Lan in trouble

If you had a trojan on one machine then you probably have it on others.
Clean them all up.

Hard to say what damage the virus may have done to the Server. It may
require a full OS reinstall.
ISA should be on its own dedicated server (unless SBS Premium).
Domain Controllers should not be multi-homed. Only use one Nic in Domain
Controllers.


--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.mspx

Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/edgesecurity/partners/hardwarepartners.mspx
-----------------------------------------------------

"Anna" <Anna@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:CB71D6F3-D3B3-4891-9D25-6D7F2C80B47C@xxxxxxxxxxxxxxxx
Phillip,
Thank you for the suggestion. I have discovered a trojan virus on the
server. I did a scan and clean in Safe mode and then after restarting
another
scan. it's now clean but the problems remain. I tried restarting manually
the
Firewall service but it couldn't start because depending services like
MSSQL$MSFW couldn't start.
So I unistalled ISA and LAN was at last ok with clients logging and having
access to the server with no problem. So I tried to reinstall ISA.
Installation went ok as far as core components went, but it coudn't
install
additional components, so installation failed.
Would you know what are the additional components of ISA? Is it SQL
server?
And should I persist in this path or should I reinstall the whole server
(which I am not sure I can do properly...)

Thanks anyway

Anna



"Phillip Windell" wrote:

"...number of connections per second allowed for the Allow server rule
was
exceeded.."

Means just what it says. Something is bombing the network with
traffic,...probably one or more virus infected machines.

Shut down all the Clients.
Shut down all Servers.
Start up one server at a time and clean up the virus on the server that
you
probably have.
Make sure the server has proper AV protection so that it is not
reinfected
when the next infected machine starts up.
Repeat the process with all machines and workstations until it is cleaned
up.

You might speed up the process if you can find out what machine is the
source and clean it up first.

That's my "guess"....


--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or
Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.mspx

Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/edgesecurity/partners/hardwarepartners.mspx
-----------------------------------------------------

"Anna" <Anna@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:2B89F8B2-966A-4AEB-B445-B3044B904CCE@xxxxxxxxxxxxxxxx
I am experiencing the following problem with a small LAN (server 2003
standard edition with ISA 2004 installed and 11 Win XP pro
workstations )

I had an alert with event Id: 15117 (The request was denied because the
number of connections per second allowed for the Allow server rule was
exceeded) and as a result :
- the Microsoft Firewall service has gone down and is stopped since
then
- In ISA server management I get the msg "server not responding" and
therefore cannot start the firewall service
- my workstations can't log on to the server and join the domain( I
have
Active directory), they can't use server shared files or printer
- even my server cannot use proxy server.
- server can ping itself and clients, but clients cannot ping server

Could anyone help?






.

Relevant Pages

  • RE: Sercond ISA on SBS Member Server
    ... ISA on a SBS member server. ... Without a good backup, it's difficult to have the server ... - This is often used for ISA server configuration recovery. ...
    (microsoft.public.windows.server.sbs)
  • RE: Internet Usage Reports
    ... There is no other application on the SBS server box that can monitor ... internet activities as your needs rather than ISA server. ... Microsoft Internet Security and Acceleration Server 2004 is the ... Microsoft is providing this information as a convenience to you. ...
    (microsoft.public.windows.server.sbs)
  • Re: Nagging Autorization issue for Companyweb after ISA04 install
    ... Check the companyweb CNAME entry in the DNS Server. ... Does the situation occur when you access companyweb from the ISA ... > 'Microsoft Firewall' service. ... > This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • RE: OWA page not displayed Outside
    ... Open the ISA Server management console, ... On the ISA Server computer, stop the Microsoft Firewall service. ...
    (microsoft.public.windows.server.sbs)
  • Re: RWW Timing
    ... If you have installed ISA, ... Expand the server node and highlight ''Monitoring''. ... In the following website you can find many useful resources related to SBS ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
Loading