Can't access OWA via internal server ip

Hi

Normally on any sbs server I can access OWA using <server-ip>/exchange which
brings the OWA web page. From other sbs servers I know that access via
<server-ip>/exchange works as standard and does not need any special
configuration.

However on this particular sbs 2003 server with isa server 2000, when I
enter <server-ip>/exchange I get a windows login box. Entering any
username/password combination including Administrator's fails after three
tries with error;

HTTP 407 Proxy Authentication Required - The ISA Server requires
authorization to fulfill the request. Access to the Web Proxy service is
denied. (12209)

What is this problem with this server and how can I fix it?

Many Thanks

Regards

Hi John:

We see two posts from you this morning? If both are from you are they both
the same SBS 2003? It maybe helpful to know, as the errors could be related.

Have you run the SBS BPA? www.sbsbpa

Have you rerun the CEICW, and if so are there any errors?

What specific errors are in the event logs that might be related?


-
Larry
Please post the resolution to your
issue so others may benefit
-
Get Your SBS Health Check at
www.sbsbpa.com


> Hi
>
> Normally on any sbs server I can access OWA using <server-ip>/exchange
> which brings the OWA web page. From other sbs servers I know that
> access via <server-ip>/exchange works as standard and does not need
> any special configuration.
>
> However on this particular sbs 2003 server with isa server 2000, when
> I enter <server-ip>/exchange I get a windows login box. Entering any
> username/password combination including Administrator's fails after
> three tries with error;
>
> HTTP 407 Proxy Authentication Required - The ISA Server requires
> authorization to fulfill the request. Access to the Web Proxy service
> is denied. (12209)
>
> What is this problem with this server and how can I fix it?
>
> Many Thanks
>
> Regards
>

Hi Larry

Thanks.

> Have you run the SBS BPA? www.sbsbpa

Yes. No errors just some typical minor warnings. Same as other sbs servers.

> Have you rerun the CEICW, and if so are there any errors?

Yes. Many times, a few times recently as well. This server was working fine
for years just started exhibiting this problem.

> What specific errors are in the event logs that might be related?

Following significant errors;

Event Type: Error
Event Source: SOCKS Filter
Event Category: None
Event ID: 20002
Date: 25/11/2009
Time: 22:57:33
User: N/A
Computer: MYSERVER
Description:
SOCKS filter: failed to bind IP address 192.168.16.2:1080 for listening.
Future SOCKS requests will be refused.

Data:
0000: 40 27 07 80 @'.€


Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 26/11/2009
Time: 09:11:43
User: NT AUTHORITY\SYSTEM
Computer: MYSERVER
Description:
Logon Failure:
Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Pb
Authentication Package: NTLM
Workstation Name:
Status code: 0x80090308
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -


Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 7
Date: 26/11/2009
Time: 10:39:32
User: N/A
Computer: MYSERVER
Description:
The Security Account Manager failed a KDC request in an unexpected way. The
error is in the data field. The account name was
exchangeRFR/MYSERVER.mydomain.local and lookup type 0x48.

Data:
0000: 17 00 00 c0 ...À


Event Type: Error
Event Source: dsrestor
Event Category: None
Event ID: 1005
Date: 25/11/2009
Time: 20:53:23
User: N/A
Computer: MYSERVER
Description:
The DSRestore Filter failed to connect to local SAM server. Error returned
is <id:997>.

Hi John,

Thanks for your post and Larry's input.

Based on my research of the error messages and symptoms, it seems there was an incorrect Protocol Rule Setting that prevented all users from accessing the OWA
website. ISA 2000 is configured to require authentication on all outgoing web requests Macintosh client are not logging onto the domain. They are not able to authenticate
with the SBS/ISA server and caused the issue.

However, I am sorry I don't have a ISA 2000 server at hand to verify the configuration and steps. The following are the steps I find just for your reference:
=========================
Open ISA Management:
Site and Content rules -
Small Business Server Internet Access Site and Content rule Changed "Applies To" option to "Any Request" or "Selected Protocols" based on your needs (do this for any
other Site and Content rule not so configured)
Protocol Rules -
Small Business internet Access Protocol Rule - Changed "Applies To" to "Applies To" option to "Any Request" or "Selected Protocols" based on your needs (do this for any
other Protocol rule not so configured)

Right clicked Servername, selected Properties. On Outgoing Web Requests (listener) Cleared the check mark from Connections\Connection Settings. When prompted,
select to restart the ISA services. Test the issue again.
=========================
Meanwhile, I am not sure what version of SBS 2003 you have(SBS 2003 Previoum version with built-in ISA 2004?) and why you have ISA 2000 installed. I suggest you also
submit this issue in our special ISA newsgroup for more information since it is an ISA server 2000 configuration issue.

Discussions in ISA Server General Newsgroup
http://www.microsoft.com/communities...blic.isaserver

Hope this helps.



Best regards,
Robbin Meng(MSFT)
Microsoft Online Newsgroup Support

================================================== ================
Please post your SBS 2008 related questions to the SBS newsgroup on Connect website:
https://connect.microsoft.com/sbs08/...i/default.aspx

Please post your EBS related questions to the EBS newsgroup on Connect website:
https://connect.microsoft.com/ebs08/...i/default.aspx

If you want to use a newsreader other than a web forum to access these newsgroups,
please refer to the following blog to apply NNTP password and configure a newsreader:
http://msmvps.com/blogs/bradley/arch...ewsgroups.aspx
================================================== ================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ================
This posting is provided "AS IS" with no warranties, and confers no rights.
================================================== ================