Re: need some help from MS

From: Tester (Test_at_testthis.org)
Date: 09/10/04 

Date: Fri, 10 Sep 2004 08:57:23 -0700

Have you tried filemon, from www.sysinternals.com ?

My experience with internal 500 errors, is access denied to something, from
authentication or kerberos errors especially.
Have a look if there might be access denied to a file or dir all of a sudden
possibly. At any rate that is a great tool for troubleshooting permissions
and should be in everyone's tool kit if not already!

"RP" <rp@nospam.com> wrote in message
news:%23g8Cxj0lEHA.1644@tk2msftngp13.phx.gbl...
> Hi all, its me again. I bet everyone here hates me, but this is my 4th
post
> on this problem. I have taken everyone's suggestions and still no avail.
> Here are excerpts from prior posts:-
>
> -------------------------------------------------------------------------- 

--
> --------------------------------------------------------------------------
--
> -----------
>
> Sorry for the alarm folks but this problem has me stumped and is proving
to
> be a nuisance and causing our users serious headaches. On a frequent basis
> OWA & other https sites like RWW etc. will be unreachable with the
following
> error:-
>
>       The page cannot be displayed
>       There is a problem with the page you are trying to reach and it
cannot
> be displayed.
>
> --------------------------------------------------------------------------
>
>       Please try the following:
>
>         a.. Click the Refresh button, or try again later.
>
>         b.. Open the Web site home page, and then look for links to the
> information you want.
>         c.. If you believe you should be able to view this directory or
> page, please contact the Web site administrator by using the e-mail
address
> or phone number listed on the Web site home page.
>       500 Internal Server Error - The network logon failed. (1790)
>       Internet Security and Acceleration Server
>
> I have been through 2 rounds of posts and followed some suggestions from
> some MS folks but to no avail. The remedy is simple: restart the MS Web
> Proxy Service and all is good again until the next time it happens.
>
> MS please help!!
>
> thanks,
> Param
>
>
> --------------------------------------------------------------------------
--
> --------------------------------------------------------------------------
--
> -----------
>
> Cris, I am going to copy paste the latest excerpt from my previous post
and
> here are the answers to your questions:-
>
> 1. YES ISA. If you notice the error message below is being generated by
ISA.
> 2. NO H/W FIREWALL
> 3. 2 NICS. External is on a C Class 192.168.1.254 hooked into a linksys
> router which in turn connects to our ISP. Internal is on a A class
10.0.0.1.
> 4. DNS set to 10.0.0.1 on both NICs
> 5. No settings changed.
>
> EXCERPT I:
>
> John,
>
> 1. No they dont get the forms based logon screen.
> 2. I have not tried /connectcomputer but it happens even at /remote. I can
> browse companyweb OK since it does not use SSL.
> 3. No events in the EventLog.
> 4. 30 mins was an estimate. I have not timed it since I dont know when
> exactly to start timing it. Users usually call me when they notice it is
> down.
> 5. I thought so too about the account lockout, but if I restart the
> Microsoft Web Proxy Service it is back up immediately.
> 6. Let me check iusr_ next time it happens.
>
> thanks!
>
> "John Bay (MSFT)" <johnbay@online.microsoft.com> wrote in message
> news:66AxFFXhEHA.740@cpmsftngxa06.phx.gbl...
> > When the problem happens, do they see the forms based logon screen or do
> > they get the error right away?
> >
> > Does the same problem happen if they try to browse to /connectcomputer?
> >
> > Are there any events logged in the application or security log at the
time
> > of the failure?
> >
> > You said it fixes itself after about 30 minutes.
> >
> > The error message is a logon failure.
> >
> > It sounds like an account is maybe being locked out.
> >
> > Our default lockup policy resets in 10 minutes so that may not be the
> issue.
> >
> > The initial logon screen loads with the anonymous account.
> >
> > When the problem occurs, if you look at the properties of the
> > iusr_computername account, is it locked out?
> >
> > Best Regards,
> >
> > John Bay, MCSE 2003
> > Microsoft Support Engineer
> >
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> >
> >
> >
>
> EXCERPT II:
>
> John, it just happened again and nothing in the EventLog, none of the
> accounts were locked out including IUSR & IWAM. I restarted the Microsoft
> Web Proxy Service and it is backup. What seems to be the problem?
>
>
> thanks!!
>
> "CRIS HANNA (SBS-MVP)" <crishannanospam@computingpossibilities.net> wrote
in
> message news:O0BMLmDjEHA.1348@tk2msftngp13.phx.gbl...
> > I apologize that you've not gotten the solution but starting a new
thread
> > may not be the ideal rememdy as we then lost the history of what occurrs
> >
> > So now we go back to the basics
> >
> > Are you running ISA
> > Do you have a hardware firewall
> > How many nics, what are they connected too, what are their IP addresses
> and
> > what is the DNS settings assigned to each nic card?
> >
> > Have you changed any of the default settings following the install?
> > -- 
> > Cris Hanna (SBS-MVP)
>
> --------------------------------------------------------------------------
--
> --------------------------------------------------------------------------
--
> -----------
>
> Have you actually run the MBSA (Microsoft Baseline Secuity Advisor) or the
> Shavlik Free Tool to make sure you're fully patched.    This sounds like
the
> old code red issue.    What antivirus are you running on the server
>
> -- 
> Cris Hanna (SBS-MVP)
>
> --------------------------------------------------------------------------
--
> --------------------------------------------------------------------------
--
> -----------
>
> No A/V currently. This is a relatively new server. We are in the process
of
> purchasing Trend Micro which will happen in the next few weeks. Where can
I
> find the tool to check if I am infected?
>
> thanks!
>
> --------------------------------------------------------------------------
--
> --------------------------------------------------------------------------
--
> -----------
>
> Well this sure sounds like code red or code red II but 2003 supposedly
> wasn't effected.
> Go here
> http://www.shavlik.com/pDownloadForm4.aspx
> down load this on an xp workstation with admin priviledges and run again
> your server
> My guess is you are not patched the way you need to be.
> Unpatched server will be shut down in 20 minutes or less when connected to
> the net
>
> Get patched stay patched and I bet this problem gets fixed
>
> --------------------------------------------------------------------------
--
> --------------------------------------------------------------------------
--
> -----------
>
> Cris, well the server never goes down. All services run fine. Infact users
> on the LAN can connect to OWA fine. The problem occurs for external users.
I
> am thinking the culprit is ISA and something to do with Web Publishing.
>
> thanks!
>
> --------------------------------------------------------------------------
--
> --------------------------------------------------------------------------
--
> -----------
>
> Hi RP
>
> Go to Trend and Download the 30 Day free trial NOW. Install per Kevin's
Blog
> http://msmvps.com/kwsupport/archive/2004/03/23/4153.aspx and when you
> purchase insert the activation code. You just CANT be without virus
> protection.
>
> Frank McCallister
> COMPUMAC
>
> --------------------------------------------------------------------------
--
> --------------------------------------------------------------------------
--
> -----------
>
> OK, got antivirus with Trend and still NO luck.Still having the same
> problem. OWA/RWW still goes down with symptoms. What on earth is going
> on????????
>
> --------------------------------------------------------------------------
--
> --------------------------------------------------------------------------
--
> -----------
>
>
>