need some help from MS

From: RP (rp_at_nospam.com)
Date: 09/10/04 

Date: Fri, 10 Sep 2004 10:14:29 -0500

Hi all, its me again. I bet everyone here hates me, but this is my 4th post
on this problem. I have taken everyone's suggestions and still no avail.
Here are excerpts from prior posts:-

----------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------

Sorry for the alarm folks but this problem has me stumped and is proving to
be a nuisance and causing our users serious headaches. On a frequent basis
OWA & other https sites like RWW etc. will be unreachable with the following
error:-

      The page cannot be displayed
      There is a problem with the page you are trying to reach and it cannot
be displayed.

--------------------------------------------------------------------------

      Please try the following:

        a.. Click the Refresh button, or try again later.

        b.. Open the Web site home page, and then look for links to the
information you want.
        c.. If you believe you should be able to view this directory or
page, please contact the Web site administrator by using the e-mail address
or phone number listed on the Web site home page.
      500 Internal Server Error - The network logon failed. (1790)
      Internet Security and Acceleration Server

I have been through 2 rounds of posts and followed some suggestions from
some MS folks but to no avail. The remedy is simple: restart the MS Web
Proxy Service and all is good again until the next time it happens.

MS please help!!

thanks,
Param

----------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------

Cris, I am going to copy paste the latest excerpt from my previous post and
here are the answers to your questions:-

1. YES ISA. If you notice the error message below is being generated by ISA.
2. NO H/W FIREWALL
3. 2 NICS. External is on a C Class 192.168.1.254 hooked into a linksys
router which in turn connects to our ISP. Internal is on a A class 10.0.0.1.
4. DNS set to 10.0.0.1 on both NICs
5. No settings changed.

EXCERPT I:

John,

1. No they dont get the forms based logon screen.
2. I have not tried /connectcomputer but it happens even at /remote. I can
browse companyweb OK since it does not use SSL.
3. No events in the EventLog.
4. 30 mins was an estimate. I have not timed it since I dont know when
exactly to start timing it. Users usually call me when they notice it is
down.
5. I thought so too about the account lockout, but if I restart the
Microsoft Web Proxy Service it is back up immediately.
6. Let me check iusr_ next time it happens.

thanks!

"John Bay (MSFT)" <johnbay@online.microsoft.com> wrote in message
news:66AxFFXhEHA.740@cpmsftngxa06.phx.gbl...
> When the problem happens, do they see the forms based logon screen or do
> they get the error right away?
>
> Does the same problem happen if they try to browse to /connectcomputer?
>
> Are there any events logged in the application or security log at the time
> of the failure?
>
> You said it fixes itself after about 30 minutes.
>
> The error message is a logon failure.
>
> It sounds like an account is maybe being locked out.
>
> Our default lockup policy resets in 10 minutes so that may not be the
issue.
>
> The initial logon screen loads with the anonymous account.
>
> When the problem occurs, if you look at the properties of the
> iusr_computername account, is it locked out?
>
> Best Regards,
>
> John Bay, MCSE 2003
> Microsoft Support Engineer
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
>
>

EXCERPT II:

John, it just happened again and nothing in the EventLog, none of the
accounts were locked out including IUSR & IWAM. I restarted the Microsoft
Web Proxy Service and it is backup. What seems to be the problem?

thanks!!

"CRIS HANNA (SBS-MVP)" <crishannanospam@computingpossibilities.net> wrote in
message news:O0BMLmDjEHA.1348@tk2msftngp13.phx.gbl...
> I apologize that you've not gotten the solution but starting a new thread
> may not be the ideal rememdy as we then lost the history of what occurrs
>
> So now we go back to the basics
>
> Are you running ISA
> Do you have a hardware firewall
> How many nics, what are they connected too, what are their IP addresses
and
> what is the DNS settings assigned to each nic card?
>
> Have you changed any of the default settings following the install?
> --
> Cris Hanna (SBS-MVP)

----------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------

Have you actually run the MBSA (Microsoft Baseline Secuity Advisor) or the
Shavlik Free Tool to make sure you're fully patched. This sounds like the
old code red issue. What antivirus are you running on the server 

-- 
Cris Hanna (SBS-MVP)
----------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------
No A/V currently. This is a relatively new server. We are in the process of
purchasing Trend Micro which will happen in the next few weeks. Where can I
find the tool to check if I am infected?
thanks!
----------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------
Well this sure sounds like code red or code red II but 2003 supposedly
wasn't effected.
Go here
http://www.shavlik.com/pDownloadForm4.aspx
down load this on an xp workstation with admin priviledges and run again
your server
My guess is you are not patched the way you need to be.
Unpatched server will be shut down in 20 minutes or less when connected to
the net
Get patched stay patched and I bet this problem gets fixed
----------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------
Cris, well the server never goes down. All services run fine. Infact users
on the LAN can connect to OWA fine. The problem occurs for external users. I
am thinking the culprit is ISA and something to do with Web Publishing.
thanks!
----------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------
Hi RP
Go to Trend and Download the 30 Day free trial NOW. Install per Kevin's Blog
http://msmvps.com/kwsupport/archive/2004/03/23/4153.aspx and when you
purchase insert the activation code. You just CANT be without virus
protection.
Frank McCallister
COMPUMAC
----------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------
OK, got antivirus with Trend and still NO luck.Still having the same
problem. OWA/RWW still goes down with symptoms. What on earth is going
on????????
----------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------