Installing ISA Server 2000 SP2
Microsoft recommends that you install ISA Server SP2 on every ISA Server computer that you deploy in your organization, including on computers that are running only ISA Management or the Message Screener.
Before you install ISA Server SP2 on a computer, make sure the computer is disconnected from the Internet. The computer must remain disconnected from the Internet until the ISA Server SP2 installation is completed successfully. After installation, the computer can be safely connected to the Internet.
To install ISA Server SP2 on ISA Server 2000 Enterprise Edition, you must be logged on with an account that has domain administrator credentials.
To install ISA Server SP2, follow these steps:
- Download the ISA Server SP2 self-extracting file from the Web. Use the file that matches the appropriate language, as described in the following table:
- Review the ISA Server SP2 Release Notes.
- To start the installation, run the ISA Server SP2 executable file.
- On the Welcome screen, click Next.
- In the ISA Server SP2 End-User License Agreement, click I Agree to accept the licensing terms and to run the installation. Click Next.
- ISA Server will inform you if it must restart any running services. Click Continue.
- ISA Server SP2 features a new installation tool.
- The installation process updates relevant files and saves the original files in a folder that is named $ISA2000UninstallServicePack2$. This folder is located in the Microsoft Windows folder.
- You cannot install ISA Server SP2 on the evaluation version of ISA Server.
- You must reinstall ISA Server SP2 after you do any one of the following tasks:
- Add or remove ISA Server components.
- Install ISA Server Feature Pack 1.
- Change the ISA Server installation mode.
- When you install ISA Server SP2 on a computer that is running Microsoft Windows Server 2003, and you have not previously installed ISA Server SP1, you must manually restart the ISA Server services after you install ISA Server SP2.
- If you quit the ISA Server SP2 installation, you must restart the computer before you start another ISA Server SP2 installation.
- You must remove ISA Server updates in the reverse order that they were installed in. Otherwise, the removal process will fail.
- When you install ISA Server SP2 on a computer that is running Microsoft Windows 2000 Server, you must first install Windows 2000 Server Service Pack 4 (SP4).
Removing ISA Server SP2
To remove ISA Server SP2, follow these steps:
- In Control Panel, double-click Add/Remove Programs.
- Click Microsoft ISA Server 2000 Service Pack 2 (KB 816460), and then click Change/Remove.
- Click Next.
- If you remove ISA Server SP2 from a computer that is running Windows Server 2003, make sure to install ISA Server SP1 and ISA Server hotfix 255. Hotfix 255 is described in the following Microsoft Knowledge Base (KB) article:
Running ISA Server on Windows Server 2003
- The 2r.htm and Pathmappingeditor.hta files are not deleted when you remove ISA Server SP2.
- When you remove ISA Server SP2, a warning message indicates that some applications may not work correctly after you remove ISA Server SP2. Ignore this message.
Upgrading Firewall Client for ISA Server SP2
ISA Server SP2 enhances the stability of the Firewall Client software. Microsoft recommends that Firewall Client computers be updated with the ISA Server SP2 client hotfixes.
The Firewall Client Setup program must be run directly from the mspclnt share. If you install the Firewall Client from any other location, the hotfixes that are included in ISA Server SP2 for the Firewall Client will not be installed. (This behavior also occurs if you install Firewall Client by using Add or Remove Programs
in Control Panel.)
To upgrade Firewall Client with the ISA Server SP2 hotfixes, follow these steps:
- Install ISA Server SP2 on the ISA Server computer.
- On the client computer, run the Setup.exe program from the client share folder, and then click Repair. The client share folder is \\ISA_Server\mspclnt\setup.exe, where ISA_Server is the server name of the ISA Server.
Running ISA Server 2000 on Windows Server 2003
The following issues apply when you run ISA Server 2000 on Windows Server 2003:
- ISA Server can be installed on computers that are running Windows Server 2003. However, the packet filter extension driver (Mspfltex.sys) in the release version of ISA Server is incompatible with computers that are running Windows Server 2003. The driver does not load when you install ISA Server on a Windows Server 2003-based computer. Because ISA Server SP1 includes a compatibility fix for the driver, you may ignore all error messages that are related to this issue and that are displayed during ISA Server installation. After ISA Server installation, some services will not start. ISA Server SP1 or ISA Server SP2 solves the issue with this driver.
- You must install ISA Server SP1 or ISA Server SP2 before you upgrade an ISA Server computer that is running Windows 2000 Server or Windows 2000 Advanced Server to Windows Server 2003.
- ISA Server 120-Day Evaluation is supported only on Windows 2000 Advanced Server. ISA Server 120-Day Evaluation must be removed from any computer that is running Windows 2000 Server or Windows 2000 Advanced Server before you upgrade to Windows Server 2003.
- If you plan to run ISA Server on computers that are running Windows Server 2003, make sure that the Internet Connection Firewall (ICF) is disabled when you install ISA Server. The Firewall service cannot start if ICF is enabled. If this condition occurs, the Firewall service will generate an event that indicates that the Firewall service will not start if the ICF is enabled. Follow the instructions in the event log to start the Firewall service.
- Performance alerts in the ISA Server Performance Monitor snap-in must run under an account that is a member of the Administrators group. By default, Windows Server 2003 performance alerts are configured to run under the Network Service account. The Network Service account lacks sufficient credentials. To resolve this issue, follow these steps:
- Run the ISA Server Performance Monitor.
- Expand Performance Logs and Alerts, and then click Alerts.
- In the right pane, right-click an alert, and then click Properties.
- In the Properties dialog box, click the General tab.
- In the Run As text box, type the user name of an account that belongs to the Administrators group on the computer, and then click the Set Password button.
- In the Set Password dialog box, type the password, and then click OK.
- In the Properties dialog box, click OK.
- ISA Server SP2 includes the updates that are mentioned on the following Microsoft Web site: If you install ISA Server SP2, you do not have to install ISA Server hotfix 255. Hotfix 255 is described in the following Microsoft Knowledge Base (KB) article:
Running ISA Server on Windows Server 2003
Configuring H.323 application filter settings
For security reasons, ISA Server SP2 configures the H.323 application filter to stop listening for incoming and outgoing calls. Therefore, ISA Server SP2 minimizes the risk of introducing potential vulnerabilities, such as those described in the following Microsoft Security Bulletin:
The updates that are described in the bulletin are included in ISA Server SP2.
To configure the H.323 application filter settings after you install ISA Server SP2, follow these steps:
- In ISA Management, click Internet Security and Acceleration Server, click Servers and Arrays, click the name of the applicable array, click Extensions, and then click Application Filters.
- In the details pane, right-click H.323 Filter, and then click Properties.
- On the Call Control tab, click to select one or both of the following options:
- Allow incoming calls
- Allow outgoing calls
ISA Server SP2 hotfixes
ISA Server SP2 includes all ISA Server SP1 hotfixes and also hotfixes that were released after the release of ISA Server SP1. Hotfixes that are included in ISA Server SP1 are listed in ISA Server SP1 Release Notes
The following table lists the Microsoft Knowledge Base (KB) articles that are associated with some of the hotfixes that are included in ISA Server SP2:
The ISA Server Control service may report Event 14158 after you have installed ISA Server
Cannot relay mail through ISA Server if authentication is required
Web proxy sends TCP reset instead of only closing session
Problems with Web browser if ISA Server 2000 is chained to an upstream Web proxy server
ISA Firewall service cannot start with more than 85 IP addresses on the external network adapter
Access violations occur in the Web proxy service if an impersonation failure occurs
Web Proxy service stops responding
The CERT_CONTEXT structure variable is not available for Web filters in ISA
How to automatically authenticate a user against all trusted domains in ISA
ISA Server 2000 Feature Pack 1 overview
Server-side playlists do not work with ISA Server
ISA Server may cause non-paged pool memory peaks
Incorrect canonicalization in Rules engine
Unchecked buffer in Gopher protocol handler can run code of attacker's choice
Macintosh clients who use MAPI cannot connect to Exchange 2000 with ISA Server
Running ISA Server on Windows Server 2003
ISA reports may span unexpected date range or show incomplete data
MS03-009: A problem in the ISA Server DNS intrusion detection filter may cause denial of service
MS03-012: Flaw in Winsock Proxy service can cause denial of service
ISA reports may contain negative numbers in the 'All Others' row
ISA Firewall causes handle leak in LSASS
Hotfix to permit URL path redirection in Web publishing rules
Authentication does not succeed when the user name contains a space
Description of the standard terminology that is used to describe Microsoft software updates
Update rollup for ISA Server services
Slow responses and failures when you use server publishing UDP protocols
RemoveAllProxyAuthorization not applied to SSL tunneling (CONNECT) requests
Site and content rules do not filter based on file name extensions
Multiple registered Web filters in Active Directory are handled incorrectly
The Firewall Client does not support the ConnectEx and WSARecvMsg APIs
Proxy service logs an Event ID 14146 message after link translation rules are enabled
MS03-028: Flaw in ISA Server error pages could allow cross-site scripting attack
Description of ISA Server changes that are included in Small Business Server 2003 Premium Edition
MS04-001: A vulnerability in an Internet Security and Acceleration Server 2000 H.323 filter could allow remote code execution
ISA Server 2000 hotfix for invalid FTP PORT command
Message Screener causes handle leak in Lsass.exe
"Permission Denied" error message when you use rlogin to log on to a server on the Internet
Passive mode FTP may break with multiple IP addresses on external interface
Web Proxy service may crash when it processes a redirect action
No links to navigate up through directory levels in FTP sites when accessed through Internet Explorer
ISA Firewall service stops responding on DNS resolution
"414 Request-URI Too Large" error message from ISA Server
Content cache issues on downstream ISA Server computer
Basic credentials may be sent over an External HTTP connection when SSL is required
ISA Server Web Proxy service stops responding when the CacheConnectSize registry value is set to 0
ISA Server Web Proxy service maintains a connection after a client session is closed
Cannot read ISA Server performance data by using an SNMP program
Web Proxy Service returns "The User Name Was Not Allowed" error message after the FTP Server returns the "User Logged In" message
ISA Server Web Proxy does not append the domain name suffix to the credentials that are passed to an FTP server
ISA Server forces CERN FTP connections to the Root directory
Response that contains the cache-control: s-maxage=0 header does not expire immediately
ISA Server intermittently stops responding to Web Proxy client requests
You cannot connect to external FTP Sites by using a WRQ reflection FTP client through ISA Server 2000
RSA SecurID cookie expires frequently, and clients are repeatedly prompted to authenticate
SSL bridging request fails with HTTP/1.1 500 (Operation would block. ...)
Web content does not appear, or clients receive an "HTTP 502 Proxy Error" message when they try to access external Web sites with ISA Server 2000
Outbound PPTP connections may disconnect after 60 seconds if the ISA Firewall Service is running
SecurID does not redirect to the requested page after successful logon
ICMP traffic is not blocked during startup period with ISA Server
White spaces in URL are not correctly encoded or decoded when you log on