Re: PPTP misery


hehe, no you're not missing something. The issue is on the server end
(I believe)...*but* it only effects clients with certain patch levels.
The key you are editing/adding is only there at one of the patch levels
that will work with the server....thus...

If you prefer to work on the server side without confirming that this
is really the issue we can do that as well:


Here's the gist of where I'm going:

I suspect that it is an issue with the TCP/IP configuration on the
server, specifically the gateway setup. And more specifically I
believe a setup where it responds via a different IP address than it
supposedly received on.

Here's why:

If the gateway configuration is wrong on the server, it presents a
security risk by allowing easier access to hackers. Note that there is
nothing wrong with the server software, just the way it was configured
is a risk.

Now on to the client side. To make their VPN client more secure
Microsoft released a patch during one of their service packs I believe,
that updated the VPN client so that it checked the server to see if it
was configured incorrectly. If it was then it would not work.

So, what that leaves you with is any XP box that is *fully* patched
with that update would not work if your server gateway configuration is
wrong.

So, any XP boxes without that patch would work...and any with it would
not. Given that all of your domain boxes are not working..and that
they probably received the patch directly from the SBS server, this
sounds like a likely culprit to me.

The way to fix that would be to check the IP setup on the server and
resolve. One way to *test* that theory though would be to either apply
all patches and updates to one of the XP boxes that *is* working and see
if it *stops* working, or to take one of the non-working boxes and add
the registry key that makes it bypass doing that security check...which
in turn should make it start working.


Now that explained all of that though, if you've correctly entered the
registry key to bypass pptp ip checking and it's still not working then
my theory seems show to he** doesn't it? I apologize for having you go
through the registry again though, I didn't link to the kb article you
posted before and didn't realize it was the same issue I was posting
about.

I would still focus in on the tcp/ip setup on the server for a bit
though, and the second thing would be getting a larger sample of *non*
domain machines to try this on.

I'm more than happy to throw some machines in my lab at various OS's
and stages of patches at it if you want to temporarily set up and
account to test them on. It's certainly got me intrigued...and a bit
frustrated.

Matt Ridings - MSR Consulting


--
admin
------------------------------------------------------------------------
admin's Profile: http://forums.msrportal.com/member.php?userid=1
View this thread: http://forums.msrportal.com/showthread.php?t=13955

MSR Consulting SBS Support - support (at) msrportal.com

.

Relevant Pages

  • Problem joining Windows domain from remote VPN/PPTP box
    ... server OK with administrator rights (configured via Routing and Remote ... On client there exists static route for remote network that points to ... following information can help you troubleshoot your DNS configuration. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Outlook -> remote exchange -> always wants a password
    ... I have my server set to use Integrated Windows authentication over SSL. ... almost certainly "break" your existing users if the client setup does not ... Close out of these configuration dialogs, ...
    (microsoft.public.windows.server.sbs)
  • RE: ISA 2004 Firewall Client and ActiveSync 4.2
    ... though I was connected in a Wireless Lan I changed my configuration. ... that killing my default gateway is not the way ... gateway and the appropriate DNS server entries. ... server internal IP then your client works as a secureNAT client and you're ...
    (microsoft.public.isa.clients)
  • Re: 70-294 next week
    ... to another DNS ... server for at least ... client, which then ... configuration on the client. ...
    (microsoft.public.cert.exam.mcse)
  • Re: DHCP Server Question Debian Sarge
    ... In my network the dhcp ... When the client contacts to my dhcp server, ... to obtain other local configuration parameters. ...
    (comp.os.linux.networking)
Loading