• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

MS ISA server 2K6

T

tay829

Gawd
Joined
May 12, 2000
Messages
523
I am going to try and explain this to the best of my ability, because I really do not know what this guy has done and I have never used ISA server before today.



I have a customer that is a satellite of a larger customer based in another state. The company IT guy has installed a server running ISA server 2006 in the local office. The way it is configured, the server is keeping the client machine names stored on the server even when the connection is no longer present. This posed a problem for me, because they sent new workstations to be installed and I had to join the domain with those machines, but because they named the machines incorrectly when I tried to change the name and join the domain, it said there was already a machine by that name, even though it had already been taken off the network. This was not a big deal, once I figured out why I was getting the error and logged into the server and removed the pc name from the server.

Is this a function of ISA server or does he have something configured incorrectly? There was more than an hour between removal and installation of old/new machines. Should that not have been enough time for the machine name to drop off of the domain?

Please excuse my memory if I did not name something correctly, today was the first time I have ever used ISA server.
 
Try removing the systems from the domain with the administrative tools on the DC.
 
I did that, I am just wondering if the DC is supposed to store the machine name even after the machine has disconnected from the network?
 
Yes, the DC will store it till it has been removed from the AD. You will need to delete the computer from the AD, and refresh it to make sure it is gone. If the IT dude did ISA correctly, it will be using the proxy ad gets the computer info from the AD, if not, he is a knuckle head.
 
I am not sure how he set it up, all I know was that I could not change the computer name and join the domain, because a nonexistent pc was still listed. I kept getting something like that pc name already exists.
 
yeah before you decomission pcs you need to remove them from the domain, either on the client side or through activedirectory users and computers.
 
This doesn't sound like an ISA problem, it sounds like an Active Directory problem.

In Active Directory (aka AD), computers have accounts that the computer itself uses to log in, just like people have accounts that they use to log in. (and yes, the computers even have passwords,but them manage the passwords without intervention..most of the time... :) )These computer accounts can be used to provide the computer access to resources, provide the installation of programs through AD and a lot of other functions... Just as you can't have user accounts with the same name, you can't have two computer accounts with the same name.

Now I have a question or two: What makes you believe the accounts were named improperly from the corporate HQ? If the machines came preconfigured from the HQ, why weren't they joined to the domain prior to arrival? What made you believe this was an ISA problem?
 
da sponge said:
yeah before you decomission pcs you need to remove them from the domain, either on the client side or through activedirectory users and computers.
Click to expand...

What this guy said.

And btw, your issue has nothing to do with ISA. Your domain controllers store the computer accounts in active directory.
 
To: da sponge, jpochedl

Like I was saying, I am not sure what he has setup. The machines were sent with no information and the guy is already in trouble for screw-ups. He has already cost the company over $40K due to errors and I wanted to make sure this was not another one.

da sponge, I am aware of that now, I was just wondering if the setup sounded correct.


jpochedl, The ISA server runs everything in the local office. What he did when he came to work for the company was replace the hardware routers with ISA servers. He had 2 ISA servers, one runs the corp HQ and the other is in the local office, which is another whole set of issues. I just wondered why the server stored the pc name when the computer was no longer on the network. That prevented me from changing the machine name and joining the domain.

See above for the first part of your question. He has a domain for the local office and a domain for the corp hq and the two do not talk. As far as the naming goes, the names had to be changed, because when I put the machines on the domain with the preconfigured names, they were not pulling the proxy script he made. After correcting the machine names, the script came back and I was able to complete the install. As far as what made me wonder if it were an ISA problem, I never did, I asked if anyone thought the configuration was correct.
 
It sounds like you're embroiled in a mess.

ISA is a good firewall product, and it's very likely being used for Internet access and potentially to create a site-to-site VPN. This is good, and exactly what ISA is meant for... However, if you say that there's a domain at each site, and neither talk, then maybe there is no VPN (to that fact, I'd ask 'why the heck not?' ) Aside from being a firewall and VPN appliance, ISA can do a lot of application level filtering that a PIX, netscreen or linux based firewall is generally incapable of (not that any of those solutions is bad, but ISA is often overlooked and denegrated when people don't understand how capable it is, anyhow, I digress).

Anyway, if the server running ISA is also running Active Directory and other services, then things really are messed up. I won't go into the whole tirade of how stupid it is to run other services 'on' your firewall, but it's just not something you do. Let just say that in my opinion such a configuration would count as another screw up against who-ever set things up that way...

Finally I'll just re-state that it's not really an ISA problem here, but an issue with how things are set up in general. I have to say I don't know how much of the problem is technical vs the admin at the remote office vs how little you understand of the enviorment or Active Directory in general (understand, I'm not trying to be mean, but so far I wouldn't have confidence in your expertise either, but you're here and you're trying to learn, so I do give you credit for that!)
 
tay829 said:
As far as the naming goes, the names had to be changed, because when I put the machines on the domain with the preconfigured names, they were not pulling the proxy script he made. After correcting the machine names, the script came back and I was able to complete the install. As far as what made me wonder if it were an ISA problem, I never did, I asked if anyone thought the configuration was correct.
Click to expand...

Sorry, just had to respond to this part individually, since this is the meat of the topic...

There should be no reason you need to rename computers to match the machine they're replacing. What you need to do is correct the script / configuration distribution mechanism.

First, you do need to understand how the ISA proxy script is being distributed... Is it WebDAV, GPO or a login script?

Once you know how the config should being passed, you need to determine why the script isn't being passed to the machines. Is it a GPO processing problem (machines not in the proper OU, etc)...
 
jpochedl said:
Sorry, just had to respond to this part individually, since this is the meat of the topic...

There should be no reason you need to rename computers to match the machine they're replacing. What you need to do is correct the script / configuration distribution mechanism.

First, you do need to understand how the ISA proxy script is being distributed... Is it WebDAV, GPO or a login script?

Once you know how the config should being passed, you need to determine why the script isn't being passed to the machines. Is it a GPO processing problem (machines not in the proper OU, etc)...
Click to expand...

agreed. there's no need to change machine names.

additionally, you need to learn a bit about AD. It's not going to magically know that a machine isn't 'registered' on the network anymore unless you 'unregister' it. how is it supposed to tell whether its just powered off or no longer in commission? you need to tell it :)
 
No offense taken, I have no idea of how any of it works and I freely admit that. I am not a hypersensitive person and relish constructive criticism when proper procedures are also offered.

I have no idea how the script is being distributed. All I know is that when the machine name was different from the original, the IE automatic configuration script was missing and there was a red x on the ISA server icon. Again, it was my first time ever dealing with it and I cannot remember all of the details. However, I have taken this opportunity to research AD and ISA server.
 
da sponge said:
agreed. there's no need to change machine names.

additionally, you need to learn a bit about AD. It's not going to magically know that a machine isn't 'registered' on the network anymore unless you 'unregister' it. how is it supposed to tell whether its just powered off or no longer in commission? you need to tell it :)
Click to expand...

In this case, there was a need to change the name, please see my above post. Now if there were an issue with his script, I cannot answer for that. In regards to your 2nd sentence, thinking outside of the box here, but would that not make more sense? If the machine is not on the network, would it not be better to unregister the connection and then reapply on the next authentication? Generally, you are not going to run into machines with the same name on a business network with an IT department, no matter how lacking. I only work on the hardware side of things and I miss the decommissioned CISCO routers, but it was not my call and the company I work for only works for their company when they need us.
 
sounds like there is multiple issues.

1. No trust relationships set up between domains, which is causing your two domains not to talk to each other

2. Routes are not set up between the sites

3. Poor AD management.

I am truly sorry that you inherited such a mess. Is it fixable, sure, but you need to breakdown each issue and see if it can be resolved in an order that wouldn't cause more of a mess.

It is difficult for us to troubleshoot the issue effectively without being there to see what else maybe lurking in the background.
 
I'm glad you weren't offended... In today's society, all too often people do get offended when their lack of knowledge is pointed out to them. :)

Anyhow, my take is this: When you changed the machine names, did you also change the domain association in the process? If you did, then it's most likely the machine's weren't named incorrectly, but were part of the wrong domain...?

I dunno. Just grasping at straws. We know something has been misconfigured, and it's either giong to take a game of 20 (40, 60, 80, 100) questions, or being hands on to pinpoint what it is.
 
I am not going to worry about it. I completed the tasks my company was hired to do. He has to explain what went wrong and my lack of understanding of the setup would not be helpful in trying to resolve the issue.

Thanks horndog, if he gets canned, I will pass along the possible issues so whomever replaces him will have a heads up.
 
You must log in or register to reply here.
Back
Top