Problem: When trying to open ISA Server Management, the ISA Server 2004 Setup program starts and then fails. An error message, indicating that Setup cannot modify or create the registry entry, SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, is displayed.

Cause: This problem occurs when either of the following conditions is true:

• ISA Server Management is started using an account that does not have the required permissions.
  
• ISA Server Management is started using an account that is already a member of the appropriate security groups, but the user's access token does not contain the required groups.
  

Solution: To resolve this problem, do one of the following:

• If ISA Server Management was started using an account that does not have the required permissions, add the user to the appropriate security groups.
  
• If ISA Server Management was started using an account that is already a member of the appropriate security groups, but the user's access token does not contain the required groups, log the user off. Then, log the user back on.
  

Problem: When you try to install ISA Server 2004, you are unexpectedly prompted to insert disc 1 to continue the installation process. This symptom occurs after you have already inserted disc 1 to start the installation process.

Cause: This issue may occur if an evaluation version of ISA Server 2004 is already installed on your computer when you try to install the original release version of ISA Server 2004.

Solution: To resolve this issue, copy the contents of the ISA Server 2004 CD to a folder on your computer's hard disk. Then, run the ISA Server 2004 Setup program from your hard disk.

Problem: When you run the ISA Server 2004 Setup program, the following components may not install correctly:

• Advanced Logging (MSDE)
  
• Firewall Client share
  

Cause: This problem may occur because the Server service is not running on your computer when you run the ISA Server 2004 Setup program.

Solution: To resolve this problem, follow these steps:

1. Click Start, point to Administrative Tools, and then click Computer Management.
   
2. Expand Services and Applications, and then click Services.
   
3. In the right pane, view the Server service to make sure that the service has been started.
   
   • If the Server service has been started, quit Computer Management, and then run the ISA Server 2004 Setup program.
     
   • If the Server service has not been started, right-click Server, and then click Start.
     

Problem: When installing ISA Server, the following error message is displayed:

Setup failed while registering Wspadmin.dll

Details: The function My_LoadLibrary failed at the function Registrator::RegisterComControl

Cause: This may occur when ISA Server 2004 is installed on a computer where a previous installation of one of the following programs was not completely removed:

• A pre-release version of ISA Server 2004
  
• Microsoft ISA Server 2000
  
• Microsoft Proxy Server 2.0
  

Solution: To resolve this issue, remove the remnants of the previous ISA Server installation or the previous Proxy Server installation, and then reinstall ISA Server 2004. To do this, follow these steps:

1. Start Microsoft Windows Explorer.
   
2. Remove the following folder if it exists:
   %programfiles%:\Microsoft ISA Server
   
3. Locate the %WINDIR%\System32 folder, and then remove all the following files if they exist:
   
   • Cachctrs.h
     
   • Cachctrs.ini
     
   • Latui.dll
     
   • Mspapi.dll
     
   • Msfpc.dll
     
   • Msfpcui.dll
     
   • Msphlpr.dll
     
   • Msplog.dll
     
   • Mspmon.dll
     
   • Mspmsg.dll
     
   • Mspsec.dll
     
   • Mspui.dll
     
   • Pfctrs.h
     
   • Pfctrs.ini
     
   • Ratlib.dll
     
   • Msfpcstg.dll
     
   • W3papi.dll
     
   • W3pctrs.h
     
   • W3pctrs.ini
     
   • W3pmib.dll
     
   • Wspapi.dll
     
4. Run the ISA Server 2004 Setup program.
   

Problem: ISA Server installation fails on a Microsoft Windows Server 2003 domain controller.

Cause: When ISA Server is installed, it adds the Network Service account to the Network Configuration Operators group. In some cases, when installing ISA Server on a domain controller, Setup does not find the Network Configuration Operators group, and Setup fails.

Solution: Perform the following steps:

1. Demote the Windows Server 2003 domain controller to a member server.
   
2. Install ISA Server.
   
3. Promote the computer to a domain controller.
   

At some point after installing or modifying ISA Server Setup, the Microsoft Firewall service may fail to start. This section describes the cause and recommended actions to take when the Firewall service cannot start.

After Installation

After Repair or Modify

Problem: During installation, the following error message appears:

None of the IP addresses of this ISA Server computer are included in the Internal Network for this array.

Cause: The ISA Server installation uses name resolution to determine the local Internet Protocol (IP) addresses required for constructing the Internal network. However, a line in the Hosts file also contains that information.

Solution: Check the Hosts file, located in the %windir%\system32\drivers\etc\hosts folder. Remove the following line:

IP ISA_Server_Name

Problem: When joining the ISA Server computer to a domain, certificate autoenrollment fails. Automatic certificate enrollment may be required by other applications running on the ISA Server computer.

Cause: Autoenrollment uses DCOM and by default, ISA Server system policy rules prohibit DCOM traffic from the ISA Server computer to the Internal network, allowing only strict remote procedure call (RPC) traffic.

Solution: To allow DCOM traffic, perform the following steps:

1. In the console tree of ISA Server Management, click Firewall Policy:
   
   • For ISA Server 2004 Enterprise Edition, for array-level firewall policy, expand Microsoft Internet Security and Acceleration Server 2004, expand Arrays, expand Array_Name, and then click Firewall Policy.
     
   • For ISA Server 2004 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Server_Name, and then click Firewall Policy.
     
2. On the Tasks tab, click Edit System Policy.
   
3. From the Configuration Groups list, click Active Directory.
   
4. On the General tab, verify that Enforce strict RPC compliance is not selected.
   

Problem: After changing the domain or workgroup membership of the computer running ISA Server services, ISA Server is no longer functional on that computer.

Cause: Domain and workgroup membership should not be changed after you install ISA Server. Otherwise, ISA Server is no longer functional.

Solution: Repair the ISA Server installation. Perform the following steps:

1. On computers running Windows Server 2003, click Start, click Control Panel, and then double-click Add or Remove Programs.
   
2. In Microsoft ISA Server 2004, click Change/Remove.
   
3. On the Welcome page, click Next.
   
4. On the Program Maintenance page, select Repair.
   
5. On the Enterprise Deployment Environment page, choose the I am deploying in a workgroup or in domains without trust relationships. Then, do the following:
   
   1. In Server certificate, type the path and file name of the certificate.
      
   2. In Certificate password, type the password of the certificate file.
      
   3. Click Next.
      
6. Click Install.
   

Problem: When reinstalling ISA Server, the existing cache files are removed.

Cause: By design, when you reinstall ISA Server, the existing cache files are removed.

Solution: To preserve the cache file after reinstallation, perform the following steps:

1. Before you begin the reinstallation process, create a copy of the existing cache file, located in <drive:>\urlcache\Dir1.cdat.
   
2. Reinstall ISA Server.
   
3. Reconfigure cache settings, the same way they were previously configured.
   
4. Stop all the ISA Server services, by typing net stop fweng at a command prompt.
   
5. Copy the Dir1.cdat file to the \urlcache folder.
   
6. Restart the services.
   

Problem: When installing ISA Server Management for ISA Server 2004 on a computer that already has ISA Server 2000 installed, ISA Server 2004 Setup upgrades the existing ISA Server 2000 program. ISA Server Management for ISA Server 2000 will not remain installed alongside ISA Server Management for ISA Server 2004.

Cause: This problem occurs because Microsoft does not support a parallel installation of ISA Server 2004 Administration Tools and ISA Server 2000 Administration Tools on the same computer.

Solution: If you no longer require the ISA Server 2000 Administration Tools, install ISA Server 2004 Administration Tools. ISA Server 2000 Administration Tools will be removed during the Setup program. Only ISA Server Management for ISA Server 2004 will be available when Setup completes. If you still want the ISA Server 2000 program, install it on another computer.

Problem: When upgrading from ISA Server 2000, the migration tool failed with the following error:

Error: Failed while exporting the Remote Access Service VPN site-to-site connections.

Cause: This error sometimes occurs when you migrate the virtual private network (VPN) settings previously configured using ISA Server 2000.

Solution: Perform the following steps:

1. Note the existing VPN site-to-site connection configuration settings, as configured in ISA Server 2000.
   
2. Delete the VPN site-to-site connection from Routing and Remote Access.
   
3. In ISA Server, reconfigure the VPN settings, as detailed in the Site-to-Site VPN in ISA Server 2004 Standard Edition and Site-to-Site VPN in ISA Server 2004 Enterprise Edition documents, available on the VPN page at the Microsoft Windows Server System Web site.
   

Problem: After upgrading from ISA Server 2000, additional conditions for some alerts appear dimmed.

Cause: When an ISA Server 2000 configuration is upgraded to ISA Server 2004, the additional key in the definition of an alert for an event that is defined with no subevents may be set to 0, instead of to -1 (which indicates that there is no subevent).

Solution: Run the script described in the Correcting Upgraded Additional Keys document, available on the Coding Corner page at the Microsoft Windows Server System Web site.

Problem: Setup completed successfully, but no traffic is allowed to pass through ISA Server.

Cause: After you complete Setup, the firewall policy is configured so that no traffic from the External network is allowed to pass through ISA Server. Only a specific set of preconfigured system policy rules allows limited access to critical servers, such as authentication servers, name resolution servers, and others.

Solution: Configure a rule base, consistent with your corporate policy. For more information about getting started, see the Getting Started Guide on the Planning, Deployment, and Integration page at the Microsoft Windows Server System Web site.

Problem: After upgrading from ISA Server 2000, clients of ISA Server 2004 can no longer upload File Transfer Protocol (FTP) content.

Cause: In ISA Server 2000, when you allowed FTP access, clients were allowed to upload and download using FTP. When you upgrade, however, any rules that apply to FTP are created in ISA Server 2004 with the ISA Server 2004 defaults. By default, when you create an access rule that allows FTP, clients can only download FTP content.

Solution: To allow clients to upload FTP content, perform the following steps for all rules that were migrated and apply to FTP:

1. In the console tree of ISA Server Management, expand Microsoft Internet Security and Acceleration Server 2004, expand Server_Name, and then click Firewall Policy.
   
2. In the details pane, select the migrated rule that applies to FTP access.
   
3. On the Tasks tab, click Edit Selected Rule.
   
4. On the Protocols tab, in This rule applies to, select Selected protocols.
   
5. Click Add, expand All Protocols, select FTP, click Add, and then click Close.
   
6. Click Filtering, and then click Configure FTP.
   
7. On the Protocol tab, select Read Only.
   

Problem: When installing ISA Server on a computer running Windows 2000 Advanced Server, Setup fails with the following error message:

Setup failed registering ISA Server Performance monitoring

Cause: A security template was applied to the computer, modifying the permissions required to install ISA Server.

Solution: Do not apply security templates. Instead, follow the instructions for hardening the ISA Server computer that are detailed in the Hardening the Windows Infrastructure on the ISA Server 2004 Computer document, available on the Planning, Deployment, and Integration page at the Microsoft Windows Server System Web site.

When an array member loses connectivity with the Configuration Storage server, it will use the local copy of the configuration settings. However, connectivity to the Configuration Storage server is critical for maintaining the local copy, thereby providing the most up-to-date, timely protection for your network resources.

The array member cannot connect to its specified Configuration Storage server in any of the following scenarios:

• During installation, the array member cannot connect to the Configuration Storage server.
  
• ISA Server cannot authenticate with the Configuration Storage server.
  
• The Internal network was not configured properly.
  
• Setup did not complete successfully, and the Configuration Storage server is therefore inaccessible.
  

This section describes the cause and recommended actions to take when the array member cannot connect to its Configuration Storage server.

Cannot Access Configuration Storage Server

Inaccessible Configuration Storage Server

Windows Authentication Failure

SSL Encrypted Channel Failure

Using a Different Configuration Storage Server

Internal Network Not Configured Correctly

Setup Failure

Problem: The computer running ISA Server services belongs to a workgroup. However, there is no certificate installed on the Configuration Storage server to which it will connect.

Cause: When the computer running ISA Server services belongs to a workgroup or to an untrusted domain, certificate authentication must be enabled on the Configuration Storage server.

Solution: Use the ISACertTool, available on the ISA Server 2004 Downloads page at the Microsoft Windows Server System Web site, to install a certificate. Alternatively, run Repair. Perform the following steps:

1. On computers running Windows Server 2003, click Start, click Control Panel, and then double-click Add or Remove Programs.
   
2. In Microsoft ISA Server 2004, click Change/Remove.
   
3. On the Welcome page, click Next.
   
4. On the Program Maintenance page, select Repair.
   
5. On the Enterprise Deployment Environment page, choose the I am deploying in a workgroup or in domains without trust relationships. Then, do the following:
   
   1. In Server certificate, type the path and file name of the certificate.
      
   2. In Certificate password, type the password of the certificate file.
      
   3. Click Next, and then click Install.