RWW: version=1 msgtype=status status=-3 message=Password Incorrec

Lately I've been getting the following error message in Internet Explorer
when trying to access RWW and OWA from the internet. Within the office
everything works great. I can't find any reference to this type of error
message anywhere. Your help is greatly appreciated.

Thanks,

--Shawn

 

Hi Shawn,

Thanks for posting here.

From your post, my understanding on this issue is: you cannot access RWW
and CompanyWeb from Internet and you receive the message below in IE.

version=1 msgtype=status status=-3 message=Password Incorrect

If I am off base, please feel free to let me know.

Based on my research, please refer to the following steps to solve this
issue:

1. Open Windows Explorer and find the C:\Program Files\Internet
Explorer\PLUGINS folder.

2. Create a new folder on the desktop and move all the plug-ins in the
PLUGINS
folder to the new folder.

3. Open Internet Explorer.

4. Click Tools and select Internet Options.

5. On the General tab, click Delete Files within the Temporary Internet
files section.

6. Select the Delete all offline content check box, click OK.

7. Click Delete Cookies, and click OK.

8. Click Clear History within the History section, click Yes.

9. Click the Advanced tab and uncheck Enable third-party browser
extensions.

10. Click OK.

11. Remove registry keys.

WARNING: Using Registry Editor incorrectly can cause serious problems that
may
require you to reinstall your operating system. Microsoft cannot guarantee
that
problems resulting from the incorrect use of Registry Editor can be solved.
Use
Registry Editor at your own risk.

Having said that, I would still like to provide assistance.

Step 1: Backup the Registry of the computer.

a) Click Start and select Run.

b) Type regedit in Open box and click OK.

c) Click File and select Export.

d) Below Export range select All.

e) Select Desktop in Save in box and type backup in File Name.

f) Click Save.

Note: The backup file is on the Desktop and named backup.reg.

Step 2: Find and delete the following registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r
Helper Objects

Step 3: Find and delete the all the sub keys in the following registry key
(don't
delete the following registry key).

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension

Step 4: Restart the computer.

If the issue still exists, please capture a screen shot of the error so
that I can understand the issue clearly.

To capture a screen shot, please follow the steps below:

Step 1: When the error message appears, press the Pr Scrn key located at
the
top-right corner of the keyboard to capture a screen shot.

Step 2: Click Start, select Run, type MSPAINT in the Open box, and then
click OK.

Step 3: Use Ctrl + V to paste the screen shot to the canvas. When we are
prompted
to enlarge the bitmap, press Y or Enter.

Step 4: Click the File (or press Alt+ F) menu and select Save.

Step 5: Select Desktop in the 'Save in' box and type 'screen' in the File
name
box.

Step 6: Select JPEG in the Save as type box and click OK.

The screen shot is located on the Desktop and named screen.jpg. Send the
file to .

Hope this helps! If you have further concern, feel free to let me know.

Have a great day.

Best Regards,

Steven Zhu
MCSE/MCDBA
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
======================================================
For urgent issues, you may want to contact Microsoft CSS directly.
Please check http://support.microsoft.com for regional support phone
numbers.
Any input or comments in this thread are highly appreciated.
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
======================================================

 

Thanks for your thoughtful and detailed response Steven. I haven't yet tried
the steps you suggested, but I can tell you I am 100% sure that will not
work. The issue is not just with my browser -- it happens on any machine
anywhere. Your solution is machine specific (I'll try it anyway, but I'm
very sure that won't solve the problem).

Also, I am offsite right and can't provide a screen capture just yet, but
the message in the subject line is all that appears in IE with trying to
access:
http://www.domainname.com/remote or
http://www.domainname.com/exchange
(from the intranet the companyweb and owa work fine)

First I get the message prompt about the security certificate. I accept to
continue on and then I get the following error:

version=1 msgtype=status status=-3 message=Password Incorrect

And that is it. Nothing else.

 

Hi Shawn,

Is there a DNS record for the FQDN, that your ISP must have created? Try
https://FQDN/exchange. If you don't have a DNS record, rerun CEICW and fill
in your public IP for the webcertificate. I assume you can telnet to your
public IP on port 443 from outside your network?

--
Regards,

Marina Roos
Microsoft SBS-MVP
One of the Magical M&M's
www.smallbizserver.net
Take part in SBS forum:
http://www.smallbizserver.net/Default.aspx?tabid=53

 

Marina,

I'm using a dynamic dns service for external access. However, I have been
using this same service with no change in configuration for almost 5 years
now. This issue has only recently cropped up.

I did try your suggestion though -- reran CEICW with my current public IP
address for the security certificate. Still no change. I'm getting the
exact same error message.

Would it have anything to do with the anonymous user account that IIS uses?
Perhaps IIS is expecting one thing and RWW is expecting another? I've seen
issues with this before, but never manifesting itself like this.

 

Steve,

As per your request I have attached a screen capture of the error message.
Let me be clear, it is not a browser specific issue. This occurs with IE,
Firefox, and any others you decide to use. It happens on my browser in the
office when trying to access the URL for remote desktop using the address
specified below. It happens from any other remote site from any browser when
trying to access that URL.

When it does NOT happen:
1. From within my network when I type: http://servername/remote
2. From within my network when I type: http://companyweb and the click on
the button to access web based email
3. From within my network when I type: http://servername/exchange

When it DOES happen:
1. From within my network when I type: http://FQDN/remote
2. From within my network when I type: http://FQDN/exchange
3. Using CEICW I tried changing the domain name for security certificate
generation to just the external IP address. I still get the error (and it
doesn't seem to reset the security certificate credentials). So when using
http://IPADDRESS/remote and http://IPADDRESS/exchange I still get the error.
4. Outside my network it always happens.

You will first get prompted to accept a security certificate.
(which is not mine -- this is another problem probably for a separate issue
-- no matter what I do the CEICW will not reset the security certificate. It
should say, "OFFICE.FQDN". It may be related to this issue).

Then you will see the error message.

My thought are:
1. It may be related to the security certificate issue -- but I think that
has been going on longer than this issue -- I'm not 100% sure though.
2. I don't know what the error message string is -- maybe someone at
Microsoft can point you in the right direction -- it is pretty specific. But
since it does mention an incorrect password before any password is input by
the user I wonder if this has to do with the IUSR accounts? I would think if
that were an issue I would be getting prompted internally for a username and
password when trying to access companyweb or owa or RWW.

Also, FYI -- I am running SBS2003 Premium Edition with ISA 2004.

Thanks in advance for your assistance.

Regards,

--Shawn

 

Steven, I went ahead and made the changes you suggested. They didn't work.

 

Hi Shawn,

If you are on dynamic dns service, you should be using that FQDN for the
webcertificate.
From inside the network you use http://servername/exchange, from outside
https://fqdn/exchange. The http://fqdn/exchange will never work from inside
the network, you should indeed get the page not found.

Why are you mentioning the anonymous user account in IIS? Have you been
playing around in IIS?

--
Regards,

Marina Roos
Microsoft SBS-MVP
One of the Magical M&M's
www.smallbizserver.net
Take part in SBS forum:
http://www.smallbizserver.net/Default.aspx?tabid=53

 

Marina,

Thanks for your interest and help so far. I guess we lost the microsoft guy.

FYI though --
You are wrong about http://fqdn/exchange not working from inside the
network. I usually setup a subdomain like office.domainname.com on the DNS
and use this address for the security certificate. It's been working great
for years.

But I digress.

Thanks for clearing up how the http://fqdn...etc. stuff works -- I believe I
posted how I was doing that pretty clearly in one of my previous posts. At
least we are on the same page. And indeed, I don't get the error message
"page not found". I never reported getting that message.

For the record, I am using the FQDN for the webcertificate -- and I did make
the change you suggested in your first post to use the IP address, but that
resulted in the same error message first reported.

And finally, instead of focusing on the FQDN which has been working for me
for the past 4-5 years now, I'd like to see if we couldn't shift our focus to
the error message. I provided a lot of detail about when the error occurs
and when it does not early on.

As for the IUSR account, most websites use this accont as they are by
default set for anonymous user access. In the case of RWW and OWA that is
still true up to the point where one is prompted for a password, upon which
they are then using integrated windows authentication. I mentioned the IUSR
account as it may be that it is at this point that there may be an issue --
because it is prior to being prompted for a user account.

And most importantly, I'm mentioning the anonymous user account because I'm
grasping at straws. And I'm posting to this forum because I'm hoping someone
has some insight that can point me in the right direction.

Thanks again for your help.

--Shawn



Hi Shawn,

If you are on dynamic dns service, you should be using that FQDN for the
webcertificate.
From inside the network you use http://servername/exchange, from outside
https://fqdn/exchange. The http://fqdn/exchange will never work from inside
the network, you should indeed get the page not found.

Why are you mentioning the anonymous user account in IIS? Have you been
playing around in IIS?

--
Regards,

Marina Roos
Microsoft SBS-MVP
One of the Magical M&M's
www.smallbizserver.net
Take part in SBS forum:
http://www.smallbizserver.net/Default.aspx?tabid=53

 

Hi Shawn,

Can you email me privately this fqdn so I can have a look for myself? As the
error doesn't even need a valid login, right?

--
Regards,

Marina Roos
Microsoft SBS-MVP
One of the Magical M&M's
www.smallbizserver.net
Take part in SBS forum:
http://www.smallbizserver.net/Default.aspx?tabid=53

 

If you are using ISA you "must" match the manner in which you enter RWW
to the cert name.

 

The MS guy just works diff hours is all.

 

Haven't received any response from Shawn yet. Not going to wait much longer,
I work different hours too ;-)

--
Regards,

Marina Roos
Microsoft SBS-MVP
One of the Magical M&M's
www.smallbizserver.net
Take part in SBS forum:
http://www.smallbizserver.net/Default.aspx?tabid=53

 

Hi Shawn,

Thanks for your update.

Sorry for delay. If the issue is urgent to your business, it is recommended
that you contact Microsoft Product Support Services via telephone so that
a dedicated Support Professional can assist you recover the server in a
more efficient manner. Please be advised that contacting phone support
will be a charged call.

To obtain the phone numbers for specific technology request please take a
look at the web site listed below.
http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

If you are outside the US please see http://support.microsoft.com for
regional support phone numbers.

From your description, please let me know whether you install ISA Server on
SBS server.

Regarding the current situation, I would like to suggest you check the
following settings on the IIS:

1. Open the IIS management console, navigate to Web Sites->Default Web
Site, double click it and select Properties.

2. Go to the Directory Security tab, click Edit button under the
Authentication and access control, double check if the "Enable anonymous
access" option is checked and only "Integrated Windows authentication" is
selected.

3. Click the Edit button under IP address and domain name restrictions,
double check the Granted access option is checked.

4. Click the View Certificate button, could you tell me the certificate
name which the web site is issued to?

5. Expand the tree of the Default Web Site, double check if the "Enable
anonymous access" option is checked on the Exchweb and the Remote virtual
directory.

Then, please perform the following steps to reset the anonymous account
password:

1. Click "Start", point to "Programs", point to "Administrative Tools", and
then click "Active Directory Users and Computers".

2. Under the full domain name click "Users".

3. Right-click "IUSR_ComputerName", and then click "Reset Password".

4. Type the password in the "New password" box and in the "Confirm
password" box, and then click "OK".

5. Right-click "IWAM_ComputerName", and then click "Reset Password".

6. Type the password in the "New password" box and in the "Confirm
password" box, and then click "OK".

7. Quit Active Directory Users and Computers console.

8. Click "Start", and then click "Run".

9. In the "Open" box, type "cmd" (without the quotation marks) and then
click "OK".

10. Type the following command and press ENTER:

cd \inetpub\adminscripts

11. To reset the password for the IUSR_ComputerName account, type the
following command (where <password> is the password that you set in step
4), and then press ENTER:

cscript.exe adsutil.vbs set w3svc/anonymoususerpass <password>

12. To reset the password for the IWAM_<omputerName account, type the
following command (where <password> is the password that you set in step
6), and then press ENTER:

cscript.exe adsutil.vbs set w3svc/wamuserpass <password>

13. After this, type iisreset and press ENTER to refresh the IIS settings.

After performing the above steps, will you be able to access the OWA/RWW
sites from internet users?

I am looking forward to your reply.

Thanks and have a good day.

Best Regards,

Steven Zhu
MCSE/MCDBA
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
======================================================
For urgent issues, you may want to contact Microsoft CSS directly.
Please check http://support.microsoft.com for regional support phone
numbers.
Any input or comments in this thread are highly appreciated.
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
======================================================

 

Marina -- I tried emailing you from my yahoo account but I got the following
error message: "Sorry, I couldn't find any host named
roos.nodontwantspam.nl.com".

I'll post back with the results from Steven's suggestions.

Thanks again.

--Shawn

 

It's a riddle, but you can probably solve it.

hint: read between the dots ;-).

 

Steve,

I checked everything you said to check. All was set the way it is supposed
to be.

I reset the IUSR accounts and ran the cscript administrative scripts. Reset
IIS and tried once more -- same error message.

What's next? --Thanks.

 

But he is a man Les, you know what the biggest problem with most men
is......

--
Regards,

Marina Roos
Microsoft SBS-MVP
One of the Magical M&M's
www.smallbizserver.net
Take part in SBS forum:
http://www.smallbizserver.net/Default.aspx?tabid=53

 

' Now you're getting a little personal. Besides, how do you know I'm a
man? Shawn could be a girls name also

--My androgenous self.

 

By the way, as was posted earlier -- I AM running ISA 2004 on this server.

Thanks,

--Shawn