• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

How do I edit "Domain Controllers" Computer Set?

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 General ] >> Installation >> How do I edit "Domain Controllers" Computer Set? Page: [1] 2   next >   >>
Login
Message << Older Topic   Newer Topic >>
How do I edit "Domain Controllers" Computer Set? - 20.Apr.2006 8:31:38 AM   
mrladyboy

 

Posts: 3
Joined: 20.Apr.2006
Status: offline
Hi,

I have just installed ISA 2004 on a Win 2003 R2 server. The server contains 2 NICs - one has an IP address, one is currently disconnected.

I defined the internal network during the install, and ISA warned me that it had found DCs elsewhere. That's fine - there are (because this ISA server is a back end machine, and is currently sitting on the internal network. It will be inserted into the network once it is configured).

Once the install completed, I reviewed the "Domain Controllers" Computer Set. It found 4 of the 5 DCs:

2 of 2 at site A (which is a remote site, not in the internal range).
1 of 1 at site B (which is a remote site, not in the internal range).
1 of 2 at site C (which is in the internal network range, connected directly to the NIC).

Two questions:

1) Why did it miss the second Domain Controller at site C - when both DCs are on the same (local) subnet, and both in DNS, and both responding?

2) How do I force ISA 2004 to recognise the final Domain Controller (and also future Domain Controllers when we reorganise)?

The Computer Set is auto-generated, and is marked read-only.
I tried exporting the config and examining the XML file, but there are GUIDs defined and I don't know where to find the GUID for my other DC.

This is particularly worrying because I'm planning to decommission the one local DC that ISA found, and I don't want it defaulting to using another DC in a remote site (across a slow link).

I also tried reinstalling. Finding 4 out of 5 is an improvement - first time it found only one DC in a remote site.

Applying SP2 makes no difference.

Thanks in advance for any assistance. I have read through Tom Shinder's Configuring ISA Server 2004 and can't see any reference to altering an auto-generated Computer Set. And I can't delete it, so I can't recreate it (because it is used in the System Policy presumably).

Cheers,

Gary
Post #: 1
RE: How do I edit "Domain Controllers" Comput... - 23.Apr.2006 5:46:06 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Gary,

I didn't mention it because I've never seen it :)

Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to mrladyboy)
Post #: 2
RE: How do I edit "Domain Controllers" Comput... - 23.Apr.2006 7:20:18 PM   
elmajdal

 

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
hi ladyboy,

check this : http://forums.isaserver.org/m_200287500/mpage_1/key_edit%2cDomain%2cControll/tm.htm#2002009305

HTH

_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to mrladyboy)
Post #: 3
RE: How do I edit "Domain Controllers" Comput... - 24.Apr.2006 1:44:31 PM   
mrladyboy

 

Posts: 3
Joined: 20.Apr.2006
Status: offline
Hi elmajdal,

Thanks for the reply. I'm using ISA Statndard - I don't think it uses Actve Directory the same as Enterprise does it? I found a hack - see my response to Tom.

Cheers,

Gary

(in reply to elmajdal)
Post #: 4
RE: How do I edit "Domain Controllers" Comput... - 24.Apr.2006 1:57:38 PM   
mrladyboy

 

Posts: 3
Joined: 20.Apr.2006
Status: offline
Hi Tom,

Thanks for the reply - but it doesn't help me much!

I found a hack - and it really is a hack, so hopefully it won't blow up.

First, it is consistent with the theory in the other thread, since I joined the server to our domain, then installed ISA 2004 Standard. A few extra system rules were created relating to domain authentication. I think it's a reasonable assumption that the read-only group was created because the server was a domain member at that point.

I searched the registry (bear in mind that this is ISA Std, not Ent, so no use of AD for configuration) and found references, one for each of the 4 DCs that the ISA install had found. I exported this section, and hacked the XML file (creating a fifth section) and re-imported it, and hey presto, the extra DC was there.
BUT - the XML file had GUIDs for each DC, and they were all different, and I didn't know where they were generated. So I took he GUID for the other DC in the local AD site, added 1, and change the IP address to that of the other DC. It seemed to work - but I'm a bit reluctant to go live with this server (it's a new install to provide extra functionality) in case it screws up, either now or when I decommission or add a DC.

I have a couple of support calls available via our TehNet subscription, but don't see why I should have to 'spend' on what I regard as a clear bug in ISA. But I'd prefer an official solution - at least Microsoft can check where the GUID is generated, and supply an 'official' workaround.
Tom, would you agree that the symptoms I have described are a genuine bug? Surely ISA should use DNS to identify DCs so it remains adaptive, like every workstation does? It appears to carry out a one-off lookup (and it gets it wrong).

Thanks for any further comments. Glad I didn't miss it in your book!

Cheers,

Gary

(in reply to tshinder)
Post #: 5
RE: How do I edit "Domain Controllers" Comput... - 24.Apr.2006 2:04:47 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Gary,

Yes, I agree this is a bug. I can honestly say that I've never been able to create an ISA firewall with a Domain Controllers computer sets, no matter when I join the ISA firewall to the domain.

Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to mrladyboy)
Post #: 6
RE: How do I edit "Domain Controllers" Comput... - 26.May2006 3:49:30 PM   
rick_d_lc

 

Posts: 9
Joined: 17.Mar.2006
Status: offline
Rats - when I saw this I was hoping I had found my answer.

FYI it happens with Enterprise and Standard. In Enterprise it creates it at the Array.

I would attach a screen shot but the only one I have at the moment is belongs to a customer.

This is a a Computer set that gets created during the ISA install. 

There is a screen that comes up "System Policy Configuration" that states "The domain this server belongs to is located outside the address range specified for the Internal Network" rem - This statement is incorrect.

"when you click Next, Setup will configure ISA Server to allow the following: - AD connectivity with IP address"

And then it will list all of the Domain Controller addresses it can find...

"Click Back if you want to change the Internal network IP range, or click Next to continue." rem - clicking back is useless.

The kicker is that all of the System Policy rules that use the Domain Controllers computer set also use the Internal network so it seems kind of redundant. BUT ISA seems to have many little hidden gems so who knows really what impact this might really have.

I'm a bit picky - and a minimalist - I don't like having config items that are either unnecessary or look incorrect so I'm looking for a way to make these changes so maybe together we can find an answer!
 


(in reply to tshinder)
Post #: 7
RE: How do I edit "Domain Controllers" Comput... - 26.May2006 4:00:45 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Rick,

1. When did the ISA firewall join the domain? Before or after the ISA firewall software was installed?

2. Where are the DCs? Are they defined on the default Internal Network?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to rick_d_lc)
Post #: 8
RE: How do I edit "Domain Controllers" Comput... - 26.May2006 4:36:40 PM   
rick_d_lc

 

Posts: 9
Joined: 17.Mar.2006
Status: offline
The ISA boxes were definitly members of the domain before the install.

In my cases, the networks have multiple subnets, all of which are defined in the Internal networks, so this might be subject to the 'network behind a network' issue.

In the Enterprise case, all Private IP address ranges are in the Internal network. If I don't do this I get a bunch of errors. The array is predefined before the server is added.

In the Standard case, the internal address ranges were added during the install.

I will get more info on this shortly, I'm working on a system sonw problem at the moment.

back soon!
 

(in reply to tshinder)
Post #: 9
RE: How do I edit "Domain Controllers" Comput... - 26.May2006 5:37:35 PM   
rick_d_lc

 

Posts: 9
Joined: 17.Mar.2006
Status: offline
Couldn't add a screen shot.

The Domain Controllers Computer set is used in System policy rules 1, 6, 15, 22,  along with the Internal Network set. To me this says if the networks are defined in the Internal Network object, I should be able to communicate with them, and I have verified that this is the case.

In my DC computer set, I have three DC's listed that are definitly on the direct internal network (same subnet as the ISA box) and also two others that are located in other subnets, but are internal to my operation (via VPN connection - branch offices)

I need to get my head around this subnet thing - I was under the impression that putting all of the internal networks into the Internal network definition worked like the old LAT did - I've seen a reference to it as such.

(in reply to rick_d_lc)
Post #: 10
RE: How do I edit "Domain Controllers" Comput... - 29.May2006 5:08:32 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Rick,

Configuring the default Internal Network to use all Private addresses is generally a bad thing. You should define the default Internal Network based on the adapter, since that takes the routing table on the ISA firewall into account.

Can't help with the DC computer group, I still can't get one to create :(

Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to rick_d_lc)
Post #: 11
RE: How do I edit "Domain Controllers" Comput... - 29.May2006 8:31:22 PM   
rick_d_lc

 

Posts: 9
Joined: 17.Mar.2006
Status: offline
The network thing is probably a little out of scope for this thread and it probably could be tightened up some like you suggest. Again - I need to get my head around the subnet thing.
Thanks

(in reply to tshinder)
Post #: 12
RE: How do I edit "Domain Controllers" Comput... - 7.Jul.2006 9:22:15 PM   
sbmoore

 

Posts: 2
Joined: 7.Jul.2006
Status: offline
I called Microsoft Support to resolve this issue.  It maybe too late for you but here's the fix.

PROBLEM: Cannot add domain controllers in the 'Domain Controllers' Computer set.
 
CAUSE: Bug with ISA.
 
RESOLUTION:
Modified the following registry value.
 
HKLM\Software\Microsoft\Fpc\Storage\Array-Root\Arrays\{GUID}\RuleElements\ComputerSets and found the GUID for the "Domain Controllers" computer set.
Changed the msFPCPredefined from TRUE to FALSE.

You can now edit the "Domain Computers" computer set.

If you look at other pre-defined Computer Sets you will notice the same key exists.

< Message edited by sbmoore -- 7.Jul.2006 9:24:14 PM >

(in reply to mrladyboy)
Post #: 13
RE: How do I edit "Domain Controllers" Comput... - 9.Jul.2006 7:01:09 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi SB,

GREAT!

Thanks for the tip!

Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to sbmoore)
Post #: 14
RE: How do I edit "Domain Controllers" Comput... - 22.Nov.2006 4:04:22 PM   
ButlerKevinD

 

Posts: 21
Joined: 28.Mar.2003
From: Little Rock, Ark
Status: offline
quote:

ORIGINAL: sbmoore

I called Microsoft Support to resolve this issue.  It maybe too late for you but here's the fix.

PROBLEM: Cannot add domain controllers in the 'Domain Controllers' Computer set.
 
CAUSE: Bug with ISA.
 
RESOLUTION:
Modified the following registry value.
 
HKLM\Software\Microsoft\Fpc\Storage\Array-Root\Arrays\{GUID}\RuleElements\ComputerSets and found the GUID for the "Domain Controllers" computer set.
Changed the msFPCPredefined from TRUE to FALSE.

You can now edit the "Domain Computers" computer set.

If you look at other pre-defined Computer Sets you will notice the same key exists.


Is this pre or post ISA 2004 Service Pack 2, because I do not see that registry value on my server. I am currently running ISA 2k4 EE SP2, and the only sub-keys I have under HKLM\Software\Microsoft\Fpc\Storage are Cache, EffecTree1, and EffecTree2. Any ideas?? Thanks in advance.

(in reply to sbmoore)
Post #: 15
RE: How do I edit "Domain Controllers" Comput... - 14.Jun.2007 5:23:25 AM   
trotterd

 

Posts: 34
Joined: 3.Aug.2004
From: England
Status: offline
Hello,

I have just installed a new ISA Server 2006 Standard for a customer. I have also got the problem described here.

I built the server, added it to the domain, fully patched it, then installed ISA Server 2006.

During the install it detected the Domain Controllers and created a Pre Defined Domain Controllers Computer Set which I cannot ADD/EDIT/DELETE.

I have the Standard edition installed so I don't have the registry key described and wondered if there is a fix for it.

Thanks in advance

Dave

(in reply to mrladyboy)
Post #: 16
RE: How do I edit "Domain Controllers" Comput... - 20.Jun.2007 8:50:58 AM   
gjstroom

 

Posts: 1
Joined: 20.Jun.2007
Status: offline
quote:

ORIGINAL: trotterd

Hello,

I have just installed a new ISA Server 2006 Standard for a customer. I have also got the problem described here.

I built the server, added it to the domain, fully patched it, then installed ISA Server 2006.

During the install it detected the Domain Controllers and created a Pre Defined Domain Controllers Computer Set which I cannot ADD/EDIT/DELETE.

I have the Standard edition installed so I don't have the registry key described and wondered if there is a fix for it.

Thanks in advance

Dave


You can edit the domain controller computer set by changing de following dword in the registry:
[HKEY_LOCAL_MACHINE\IsaStg_Eff1\Arrays\{81E62296-6301-447F-93BC-54968719D311}\RuleElements\ComputerSets\{07297493-22DB-4228-9FAD-8C00AF066855}]
"createTimeStamp"=hex:00,00,00,00,00,00,00,00,9e,20,4e,26,32,26,e3,40
"modifyTimeStamp"=hex:00,00,00,00,00,00,00,00,9e,20,4e,26,32,26,e3,40
"msFPCDescription"="Domain Controllers in domain in which the ISA Server is a member."
"msFPCName"="Domain Controllers"
"msFPCPredefined"=dword:00000000
"objectClass"="msFPCComputerSet"

This one "msFPCPredefined"=dword:00000000 is standard dword:00000001

I think the keys will not be the same (mostly the numbers), but with this info you can find it.

(in reply to trotterd)
Post #: 17
RE: How do I edit "Domain Controllers" Comput... - 27.Jun.2007 5:01:27 AM   
elmajdal

 

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
anyone tried the above mentioned steps to edit the Domain Controllers Computer Set?

_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to gjstroom)
Post #: 18
RE: How do I edit "Domain Controllers" Comput... - 27.Jun.2007 3:09:09 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Tarek,

I haven't tried it, but you don't really need to edit it. Instead, create your own domain controllers comupter set and use that in System Policy instead of the built in one.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to elmajdal)
Post #: 19
RE: How do I edit "Domain Controllers" Comput... - 27.Jun.2007 6:39:39 PM   
elmajdal

 

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
Hi Tom,

actually  i've never seen these Domain Controllers Computer Set with all my previous ISA Server installs !!  i was just interested if this fix does the trick , so that i can refer this thread to other ppl hoping to solve this issue.

Now i have your feedback with will do the trick for some ppl.

Thanks for your input.

Tarek.

_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to tshinder)
Post #: 20

Page:   [1] 2   next >   >> << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 General ] >> Installation >> How do I edit "Domain Controllers" Computer Set? Page: [1] 2   next >   >>
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts