RE: ISA Server 2004 wspsrv error

Terence,
Further update. I already have SP3 on this machine. After some checking I
noticed that HTTP COmpression was never set anyway, strange. So I have
actually setup my External and Internal networks to use Compression and set
Cahing back on again. I have removed wspsrv from DEP as well and so far so
good. I will keep a close eye on this over the next few dadys to see how it
goes. If I get errors again I will try to disable Compression and will send
you the files you asked for. Thanks again for your help.

Regards

Simon

"Terence Liu [MSFT]" wrote:

Hello Simon,

Thank you for posting here. Let's also thank Claus for the input.

According to your description, I understand that the ISA firewall service
on your SBS keep failing with the following event error:
===============
Event ID: 1000
Event Type: Error
Event Source: Microsoft ISA Server 2004
Event Category: None
Event ID: 1000
Date: Date
Time: Time
User: Not applicable
Computer: ServerName
Description: Faulting application wspsrv.exe, version 4.0.2165.594, stamp
43cd50a5,faulting module ntdll.dll, version 5.2.3790.1830, stamp 424377d2,
debug? 0, fault address 0x00030115.
===============
If I have misunderstood the problem, please don't hesitate to let me know.

Based on my research, I suggest we try the following steps to see if we can
resolve this issue:

1. This is a known issue if you enable compression for HTTP content in
Microsoft Internet Security and Acceleration (ISA) Server 2004 with Service
Pack 2 (SP2). I suggest you install the following hotfix to resolve this
issue:

Description of the ISA Server 2004 hotfix package: August 23, 2006
http://support.microsoft.com/?id=924410

Note: You need to submit a request to Microsoft Online Customer Services to
obtain the hotfix. To submit an online request to obtain the hotfix, visit
the following Microsoft Web site:
http://go.microsoft.com/?linkid=6294451

2. If the hotfix does not resolve your issue, please try to install ISA
server 2004 sp3 on SBS to see if it help:

Microsoft? Internet Security and Acceleration (ISA) Server 2004 Standard
Edition Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=A05A074A-5033-4792-
AF8B-58B90D841436&displaylang=en

3. If apply ISA server 2004 sp3 cannot resolve your issue, we need to
disable compression for HTTP content in ISA:

a. Please open ISA server 2004 console
b. Extend to Configuration -> Add-ins
c. Select Web Filters tab in middle pane
d. Right click Compression Filter, select Disable
e. Click Apply button to save changes

If we cannot resolve the issue after we perform the above steps, please
help me collect some information for further investigation:

1. Please help to gather the ISA Info:

1) Download the file from the following URL:

http://www.isatools.org/tools/isainfo.zip

2) Extract all files to a folder on ISA server.

3) Double click Isainfo.js. This will generate 2 files
ISAInfo2004-<computer-name>.log and ISAInfo2004-<computer-name>.xml in the
current folder.

4) Please send these files to me at v-terliu@xxxxxxxxxxxxx

2. Gather MPS network report on SBS:

a. Download MPSrepot_network from
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
15706/MPSRPT_NETWORK.EXE

b. Run MPSRPT_NETWORK.exe on the server box.

c. The tool will automatically collect the information. This procedure will
take 10~15 minutes.

d. Open Windows Explorer, navigate to the folder:
%SystemRoot%\MPSReports\Network\Reports\Cab\

e. Send the .cab file directly to me at v-terliu@xxxxxxxxxxxxx

I hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| Thread-Topic: ISA Server 2004 wspsrv error
| thread-index: AcgZySCTYeNxbZtJTuaTj7e2qWw/xg==
| X-WBNR-Posting-Host: 207.46.19.168
| From: =?Utf-8?B?U2ltb24=?= <Simon@xxxxxxxxxxxxxxxxxxxxxxxxx>
| Subject: ISA Server 2004 wspsrv error
| Date: Sun, 28 Oct 2007 18:15:00 -0700
| Lines: 22
| Message-ID: <8139CBFC-88F6-45A7-A165-A2FA0C264039@xxxxxxxxxxxxx>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:72314
| NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Hi,
| I had a problem last week where the Windows Firewall Service on SBS
kept
| failing. The error was:
|
| Faulting application wspsrv.exe, version 4.0.2167.887, stamp 462cc525,
| faulting module ntdll.dll, version 5.2.3790.3959, stamp 45d70ad8, debug?
0,
| fault address 0x0002a754.
|
| After some extensive searching on Google I found an obscure error that
| someone had with explorer.exe, very similar to this.
| The fix involved me moving wspsrv.exe into DEP as an allowed application
and
| that fixed the problem. The only thing is I do not like this fix as it
| bypasses DEP now.
| Up to this point I have also noticed that wspsrv was starting to consume
| more and more resources, in fact it was up to over 1 Gig of memory before
it
| cracshed. It seems to be ok right now.
| Has anyone ever come across this one and has a fix for it rather than
| bypassing DEP?
|
| Regards
|
| Simon
|


.