Re: ConnectComputer Mystery

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Hi Claus,

Thanks for posting here.

According to your description, I understand that you cannot join the new
client computer into SBS 2003 Domain by using
http://SBSServerName/connectcomputer link. If I have misunderstood the
problem, please don't hesitate to let me know.

I.To narrow down this issue, please kindly answer and perform the following
questions and steps:

1.Regarding the SMB, you could use the following steps to disable it on the
SBS server.

A. On the SBS server, run "gpmc.msc" and make sure the following policies
(10 in total) are all ''Disable'' (instead of ''Not defined'') in BOTH
''Default Domain Security Policy'' and ''Default Domain Controller Security
Policy'':

NOTE: The polices are under ''Windows Settings'' -> ''Security Settings''
-> ''Local Policies'' -> ''Security Options''.

1) Microsoft network client: Digitally sign communications (always):
Disabled
2) Microsoft network client: Digitally sign communications (if server
agrees): Disabled
3) Microsoft network server: Digitally sign communications (always):
Disabled
4) Microsoft network server: Digitally sign communications (if client
agrees): Disabled
5) Network security: LAN Manager authentication level: Send LM & NTLM - use
NTLMv2 session security if negotiated

B. Restart the DC and client computer to take effect.

C. On the client computer, make sure the value of the following keys are
all ''0'':

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
\enablesecuritysignature
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
\requiresecuritysignature
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\param
eters\enablesecuritysignature
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\param
eters\requiresecuritysignature

2. What's the exact error message when you try to join the new client
computer into SBS 2003 Domain by using http://SBSServerName/connectcomputer
link? Please kindly send me the screen shot of the error message as an
email attachment.

To do this, please follow the steps below:

a) When the screen appears, press PrScrn (this key is located to the right
of the
F12 key on the keyboard)
b) Create a new Word document and open it.
c) Press Ctrl + V to paste the screen shot into the document.
d) Send this document as the mail's attachment to my mailbox:
v-jaluo@xxxxxxxxxxxxx

3.On the SBS Server, can you access this webpage by using
http://localhost/connectcomputer or http://SBSServerName/connectcomputer
link?

4.Have you run the CEICW? Please re-run the CEICW, go through all the steps
in the wizard to configure your SBS network and IIS as well. Reference:

825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763

5.Please run "ipconfig /all" (without the quotation marks) on the command
prompt on the specific problematic client computer and a working client
workstation, and then compare the output to verify the configuration of
TCP/IP on the specific problematic client computer.

6.Meanwhile, you may try the following steps on the client workstation and
see how it goes:

a. Log on locally as a local administrator to the client. In Control Panel,
double-click System. On the Computer Name tab, click Change, select
Workgroup, type a workgroup name and click OK. Click OK when prompted to
restart the computer.

b. On the SBS server, delete the user and computer accounts, click Add a
User in Server Management\Users. Follow the instructions to create user and
computer accounts.

c. On the client, open IE, go to http://SBSServerName/connectcomputer and
follow the instructions to join domain.

7.If the issue persists, you may try the steps below to manually join
domain:

a. Log on local as a local administrator to the client, add the domain user
to the local Administrators group.

b. In Control Panel, double-click System. On the Computer Name tab, click
Change, select Domain, type your domain name and click OK. You'll be
prompted to enter the domain admin's credential. Enter the credential,
click OK, wait a while and you'll see a dialog box with the message
"Welcome to the xxx domain". Restart the computer as prompted.

c. Log on as the domain user.

8.make sure to enable anonymous access and do not require SSL on the
ConnectComputer virtual directory.
to do so:
A. Go to IIS and expand servername -> Web Sites -> Default Web Site.
B. right click ConnectComputer,go to directory security tab.
C. in the authentication and access control panel,click edit,check "enable
anonymous access",uncheck integrated windows authentication.click OK.
D. in the secure communications panel,click edit,uncheck "require secure
channel(SSL)",click OK.

9.Reinstall ConnectComputer and see if it helps:

A. Go to IIS and expand servername -> Web Sites -> Default Web Site. Delete
the ConnectComputer vdir.
B. Rename the C:\Inetpub\ConnectComputer folder.
C. Create new folder named ConnectComputer under C:\Inetpub.
D. Copy all the files from the SBS2K3 media
cd3:\SBS\ClientSetup\ClientSetup to the C:\Inetpub\ConnectComputer
directory. Make sure to remove the "Read-only" attributes from the files.
E. Right-click on Default Web Site in IIS, choose New -> Virtual Directory.
F. In the Alias field, type in ConnectComputer and click Next.
G. In the path box, browse to C:\Inetpub\ConnectComputer.
H. Click Next through the wizard, the default permissions are the default
for ConnectComputer.
I. Once it is completed, right-click on ConnectComptuer and select
Properties.
J. Click Remove for the "Application name" under the "Application settings"
at the bottom of the Virtual Directory tab.
K. Click on the Directory Security tab, click Edit for "Authentication and
access control".
L. Uncheck "Integrated Windows authentication", click OK.
M. Click on the Edit button on the "IP address and domain name
restrictions".
N. Put the bullet next to "Denied access" and then click Add.
O. Add 127.0.0.1 and the internal subnet (192.168.16.2/255.255.255.0 is the
default). Click OK.
P. Click OK out of the ConnectComputer properties.


II.If the issue persists, please kindly help me collect the following
information for further analysis:

1.Please run "ipconfig /all >c:\ipconfig.txt" (Without the quotation marks)
on the command prompt on the SBS Server and the specific workstation, and
then send these files to me.

2.can you access owa and RWW by http://servername/exchange and
http://servername/remote

3.Send SBSNetSetup.log from C:\Program Files\Microsoft Windows Small
Business Server\Clients at the problematic client workstation to me

4.Send NetSetup.log from %windir%\debug at the problematic client
workstation to me.

5.Gather IIS Metabase from SBS Server
===========================
a. Install .NET Framework Version 1.1:
http://www.microsoft.com/downloads/details.aspx?FamilyID=262d25e3-f589-4842-
8157-034d1e7cf3a3&DisplayLang=en.
b. Install MBExplorer by installing IIS 6 Resource Kit Tools:
http://www.microsoft.com/downloads/details.aspx?FamilyId=56FC92EE-A71A-4C73-
B628-ADE629C89499&displaylang=en.
c. Once it is installed, access it from Start, Programs, IIS Resources,
Metabase Explorer.
d. In the left pane, right click ''LM'' (under your server computer name)
to choose ''Export to file'', and then save it as IIS.mbk.
e. Compress this mbk file and send it to me for analysis.

6.IIS logs
========
a. Open IIS.
b. Locate Default web site. Right-click it and then click Properties.
c. Click to selected Enable logging and then click properties.
d. Click Advanced.
e. Click to select every checkbox here.
f. Click OK to close these windows.
g. Reproduce this issue and send the logs to me.

NOTE: The log files are located at %systemroot%\System32\LogFiles by
default.

Please compress all the files and send to me at v-jaluo@xxxxxxxxxxxxx

I appreciate your time and cooperation. Please do not hesitate to let me
know if you have any further concerns, I am looking forward to hearing from
you.

Have a nice day!

Best regards,

Jacky Luo (MSFT)
Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
====================================================
PLEASE NOTE: The partner managed newsgroups are provided to
assist with break/fix issues and simple how to questions.
We also love to hear your product feedback! Let us know what you think by
posting

from the web interface: Partner Feedback
from your newsreader: microsoft.private.directaccess.partnerfeedback.

We look forward to hearing from you!
====================================================
When responding to posts, please "Reply to Group" via your newsreader
so that others may learn and benefit from this issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
====================================================




.

Quantcast