The Microsoft Firewall service does not start after an ISA Server 2004 SP3 installation fails

Article translations Article translations
Article ID: 937028 - View products that this article applies to.
Expand all | Collapse all

On This Page

SYMPTOMS

You have a computer that is running Microsoft Internet Security and Acceleration (ISA) Server 2004. You install ISA Server 2004 Service Pack 3 (SP3) on this computer either manually or from the Microsoft Update Web site.

If the ISA Server 2004 SP3 installation fails, a rollback operation is performed to restore the ISA Server components to their pre-update versions. However, after the rollback operation is complete, the Microsoft Firewall service does not start. Additionally, the following error messages are logged in the Application log:

Error message 1
Event Type: Error
Event Source: Microsoft ISA Server 2004
Event Category: None
Event ID: 1000
Date: Date
Time: Time
User: Not applicable
Computer: ServerName
Description:
Faulting application wspsrv.exe, version 4.0.2165.594, stamp 43cd50a5, faulting module dnsfltr.dll, version 4.0.2165.594, stamp 43cd50bc, debug? 0, fault address 0x0000cce9
Error message 2
Event Type: Error
Event Source: Microsoft Firewall
Event Category: None
Event ID: 14056
Date: Date
Time: Time
User: N/A
Computer: ServerName
Description:
The application filter (DNS Filter, CLSID={49FE2B2F-3BB4-495C-87C8-3890C3C35756}) performed an illegal operation inside the Firewall service process at method FilterInit. The Firewall service terminated. To resolve this error, remove recently installed application filters and restart the service. If this does not resolve the problem, contact the component vendor.

CAUSE

This issue occurs if the rollback operation is not successful and if the computer contains ISA Server 2004 components from the pre-update version and from ISA Server 2004 SP3.

The most common installation and rollback failures occur in the following scenario:
  • You have the ISA Server Management Microsoft Management Console (MMC) snap-in open in a separate Remote Desktop Protocol (RDP) session.
  • You use an unattended installation to install ISA Server 2004 SP3. For example, ISA Server 2004 SP3 is installed from the Microsoft Update Web site.
The Microsoft Update installer cannot prompt a user to close the ISA Server Management MMC snap-in. Therefore, the installation fails. Then, it starts a rollback of all changes to this point. If the rollback also fails, the computer will contain ISA Server 2004 components from the pre-update version and from ISA Server 2004 SP3.

WORKAROUND

To work around this issue, use one of the following methods.

Method 1: Reinstall ISA Server 2004 SP3

  1. Download ISA Server 2004 SP3.

    For more information about how to download ISA 2004 SP3, visit the following Microsoft Web site:
    http://technet.microsoft.com/en-us/forefront/edgesecurity/bb734854.aspx
  2. Exit all ISA Server utilities, and then close all ISA Server user interface components. For example, close the ISA Server Management Microsoft Management Console (MMC) snap-in.
  3. Exit all other RDP sessions on the server. To do this, follow these steps:
    1. Open Task Manager, and then click the User tab.
    2. Right-click a user account that does not represent your current connection, and then click Log Off.
    3. When you are prompted to verify the action, click Yes.
    4. Repeat steps 3b through 3c for each RDP connection.
  4. At a command prompt, type the following command to reinstall ISA Server 2004 SP3, and then press ENTER:
    msiexec /p Full_Path_To_SP3_Package REINSTALL=all REINSTALLMODE=omus /l*v c:\sp3.log
Note We recommend that you reinstall ISA Server 2004 SP3 in repair mode.

Method 2: Reregister the ISA Server administration component

  1. Click Start, click Run, type cmd, and then press ENTER.
  2. At the command prompt, type the following commands. Press ENTER after each command.
    cd /d “%programfiles%\microsoft isa server”
    regsvr32 wspadmin.dll
  3. When you receive the "DllRegisterServer in wspadmin.dll succeeded" message, click OK.
  4. At the command prompt, type the following commands. Press ENTER after each command.
    md VPN\Netsh
    net start fwsrv

Properties

Article ID: 937028 - Last Review: December 4, 2007 - Revision: 1.5
APPLIES TO
  • Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition
  • Microsoft Internet Security and Acceleration Server 2004 Standard Edition
Keywords: 
kbtshoot kbexpertiseadvanced kbprb KB937028

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com