• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Applying personal settings takes 4-5 minutes on ISA server login

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA 2006 Web Proxy] >> Unihomed >> Applying personal settings takes 4-5 minutes on ISA server login Page: [1]
Login
Message << Older Topic   Newer Topic >>
Applying personal settings takes 4-5 minutes on ISA ser... - 8.Aug.2007 4:54:52 PM   
dhgisa

 

Posts: 8
Joined: 4.Jan.2007
Status: offline
I've got an ISA 2006 server being used as web proxy (yes, I know, I know).

It takes about 4-5 minutes to login, hangs at "Applying Personal Settings ..."

Here's the relevant lines from the userenv debugging log:
USERENV(1130.1210) 14:44:39:611 ProcessGPOs:  Machine role is 2.
USERENV(1130.1210) 14:45:43:496 MyGetUserName:  GetUserNameEx failed with 1722.
USERENV(1130.1210) 14:45:43:496 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.
USERENV(1130.1210) 14:46:47:307 MyGetUserName:  GetUserNameEx failed with 1722.
USERENV(1130.1210) 14:46:47:307 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.
USERENV(1130.1210) 14:47:51:307 MyGetUserName:  GetUserNameEx failed with 1722.
USERENV(1130.1210) 14:47:51:307 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.
USERENV(1130.1210) 14:48:55:292 MyGetUserName:  GetUserNameEx failed with 1722.
USERENV(1130.1210) 14:48:55:292 ProcessGPOs: MyGetUserName failed with 1722.
USERENV(1130.1210) 14:48:55:292 ProcessGPOs: No WMI logging done in this policy cycle.


Here's the offending line from the ISA Firewall Log:
[isa-hostname-removed]    8/8/2007    20:41:38    TCP    [isa-ip-removed]:1834    [domain-controller-ip-removed]:135    [isa-ip-removed]    Local Host    Internal    Failed    0x8007274c    [System] Allow RPC from ISA Server to trusted servers    RPC (all interfaces)    0    0    0    0    20922    20922    -    -    1968    10375


Everything up to that point looks good, including messages like these:
[System] Allow Kerberos authentication from ISA Server to trusted servers
[System] Allow Microsoft CIFS from ISA Server to trusted servers
[System] Allow Kerberos authentication from ISA Server to trusted servers

Then the failure line regarding the system RPC from ISA to trusted

If I stop the Firewall Service, logins proceeed almost instantaneously.  This is setup as a single adapter firewall.  Private address range 10.0.0.0 - 10.255.255.255 is assigned in the Internal network.  I've tried disabling "Enforce Strict RPC Compliance" in the System policy editor, doesn't appear to make any difference.  I've added an access rule to allow all traffic from internal to local host, also no difference. 

Any help would be greatly appreciated.


WikipediaWictionaryChambers (UK)Google imagesGoogle defineThe Free DictionaryJoin exampleWordNetGoogleUrban DictionaryAnswers.comrhymezone.comMerriam-Webster<>0wvcidfjoguarm

< Message edited by dhgisa -- 8.Aug.2007 4:56:04 PM >
Post #: 1
RE: Applying personal settings takes 4-5 minutes on ISA... - 9.Aug.2007 6:42:55 PM   
dhgisa

 

Posts: 8
Joined: 4.Jan.2007
Status: offline
Anyone?

(in reply to dhgisa)
Post #: 2
RE: Applying personal settings takes 4-5 minutes on ISA... - 13.Aug.2007 10:27:36 AM   
dhgisa

 

Posts: 8
Joined: 4.Jan.2007
Status: offline
back to the top!

(in reply to dhgisa)
Post #: 3
RE: Applying personal settings takes 4-5 minutes on ISA... - 14.Aug.2007 4:38:26 PM   
pwindell

 

Posts: 2244
Joined: 12.Apr.2004
From: Taylorville, IL
Status: offline
1. Uninstall ISA from the machine.  I wouldn't bother saving the ISA config because at this point I would not trust it to be correct and you don't want to import a fouled up config back into ISA afterwards.

2. Unjoin it from the Domain, make it a workgroup machine

3. Assuming the TCP/IP config is already static, use the AD/DNS Server as the only DNS in the TCP/IP config.

4. Re-join the machine back to the Domain.  Leave it in the default Computers Folder and do not put it into an AD/OU until you know everything works correctly.  After it is joined make sure everything behaves normally during logins and such. Especially pay attention to the Event log for anything a miss.

5. Reinstall ISA using the Single Nic Caching Server template.  At least I am assuming that is what you were doing the first time around.

6. Recreate Access Policies.  Be familiar with these articles:
The features and limitations of a single-homed ISA Server 2004 computer
http://support.microsoft.com/kb/838364/en-us
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/single_adapter.mspx


_____________________________

Phillip Windell

(in reply to dhgisa)
Post #: 4
RE: Applying personal settings takes 4-5 minutes on ISA... - 14.Aug.2007 5:44:55 PM   
dhgisa

 

Posts: 8
Joined: 4.Jan.2007
Status: offline
From your response, it seems like you think it may be a group policy issue?  If that were true, I don't think stopping the firewall service would resolve the problem.  I've reinstalled it about 3 times now, I've even tried ISA 2004 with the same problem.

(in reply to pwindell)
Post #: 5
RE: Applying personal settings takes 4-5 minutes on ISA... - 14.Aug.2007 8:29:45 PM   
elmajdal

 

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
what OS you have ??

Win 2003 SP2 ?

_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to dhgisa)
Post #: 6
RE: Applying personal settings takes 4-5 minutes on ISA... - 15.Aug.2007 1:13:48 PM   
pwindell

 

Posts: 2244
Joined: 12.Apr.2004
From: Taylorville, IL
Status: offline
I don't know if it is GPO, I'm just trying to reduce the situation down to a minimum number of possible things to get in the way.

Eelmajdal's question about the OS is an important one. The SP2 for Server 2003 has caused a lot of trouble.

My only suggestion at this point is to look at these articles and verify you have dealt with this single-nic ISA properly.

The features and limitations of a single-homed ISA Server 2004 computer
http://support.microsoft.com/kb/838364/en-us
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/single_adapter.mspx



_____________________________

Phillip Windell

(in reply to dhgisa)
Post #: 7
RE: Applying personal settings takes 4-5 minutes on ISA... - 16.Aug.2007 10:56:28 AM   
dhgisa

 

Posts: 8
Joined: 4.Jan.2007
Status: offline
Yes - windows server 2003 sp2

I'm going to implement your recommendations today

Thanks for all your input so far

< Message edited by dhgisa -- 22.Aug.2007 5:56:25 PM >

(in reply to pwindell)
Post #: 8
RE: Applying personal settings takes 4-5 minutes on ISA... - 16.Aug.2007 11:35:58 AM   
elmajdal

 

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
Hi,

check this : http://blogs.technet.com/isablog/archive/2007/03/27/isa-server-and-windows-server-2003-service-pack-2.aspx

especially point # 3.

_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to dhgisa)
Post #: 9
RE: Applying personal settings takes 4-5 minutes on ISA... - 22.Aug.2007 5:55:26 PM   
dhgisa

 

Posts: 8
Joined: 4.Jan.2007
Status: offline
quote:

ORIGINAL: elmajdal

Hi,

check this : http://blogs.technet.com/isablog/archive/2007/03/27/isa-server-and-windows-server-2003-service-pack-2.aspx

especially point # 3.


Point #3 involves NAT and a multiple NICs - neither of which are involved in this scenario.

The have zero users, so #2 doesn't apply

It's ISA 2006 so #1 doesn't apply.


< Message edited by dhgisa -- 23.Aug.2007 11:19:20 AM >

(in reply to elmajdal)
Post #: 10
RE: Applying personal settings takes 4-5 minutes on ISA... - 22.Aug.2007 5:58:15 PM   
dhgisa

 

Posts: 8
Joined: 4.Jan.2007
Status: offline
quote:

ORIGINAL: pwindell

1. Uninstall ISA from the machine.  I wouldn't bother saving the ISA config because at this point I would not trust it to be correct and you don't want to import a fouled up config back into ISA afterwards.

2. Unjoin it from the Domain, make it a workgroup machine

3. Assuming the TCP/IP config is already static, use the AD/DNS Server as the only DNS in the TCP/IP config.

4. Re-join the machine back to the Domain.  Leave it in the default Computers Folder and do not put it into an AD/OU until you know everything works correctly.  After it is joined make sure everything behaves normally during logins and such. Especially pay attention to the Event log for anything a miss.

5. Reinstall ISA using the Single Nic Caching Server template.  At least I am assuming that is what you were doing the first time around.

6. Recreate Access Policies.  Be familiar with these articles:
The features and limitations of a single-homed ISA Server 2004 computer
http://support.microsoft.com/kb/838364/en-us
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/single_adapter.mspx



Yes - single nic template

Went through this to the letter and with the firewall service logons still take 4 to 5 minutes.

Uninstalled ISA, removed from domain (verified on all DC's it was removed), cleaned up WINS/DNS, etc - totally gone.

Rejoined domain, reinstalled ISA, chose single NIC config, rebooted, logged in - waited 4 to 5 minutes. 

At this point I'm almost ready to open a ticket with microsoft support.  This is just getting ridculous.

(edit: that last bit wasn't directed at anyone here.  I really appreciate the advice.)

(in reply to pwindell)
Post #: 11
RE: Applying personal settings takes 4-5 minutes on ISA... - 16.Sep.2007 9:16:26 PM   
elmajdal

 

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
 Hi,

quote:

ISA Server takes a long time to apply changes to the firewall configuration, or changes may not be applied to members of the array in ISA Server 2006 Enterprise Edition



Download the latest update for ISA 2006 from here : http://support.microsoft.com/?kbid=939455

HTH,
Tarek

_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to dhgisa)
Post #: 12
RE: Applying personal settings takes 4-5 minutes on ISA... - 24.Sep.2007 9:47:39 AM   
groosens

 

Posts: 5
Joined: 6.Mar.2007
Status: offline
Hello
 
I've got the same problem over here!

I've 2 ISA 2006 Enterprise Windows 2003 R2 servers and this problem occurs after SP2 is installed.

I installed the latest supportability update for 2006 (no success)
and
disabled RSS for Windows 2003 - this was #3 in the blog. (also no success, although it had fixed some other problems we had)

It has to be a SP2 bug!?

(in reply to elmajdal)
Post #: 13
RE: Applying personal settings takes 4-5 minutes on ISA... - 28.Sep.2007 8:01:17 AM   
elmajdal

 

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
Hi,

install the following hotfix : http://support.microsoft.com/default.aspx?scid=kb;EN-US;936594

_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to groosens)
Post #: 14
RE: Applying personal settings takes 4-5 minutes on ISA... - 1.Oct.2007 7:30:17 AM   
groosens

 

Posts: 5
Joined: 6.Mar.2007
Status: offline
Hi Tarek

I installed the package for kb936594, and tried all the workarounds but I still have the same problem.

The problem in my testlab doesn't occur when I turn off my domain controller...

Regards

Guy


(in reply to elmajdal)
Post #: 15

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA 2006 Web Proxy] >> Unihomed >> Applying personal settings takes 4-5 minutes on ISA server login Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts