About Events Help

About this Help file

This Help file contains information about common events generated by Microsoft Internet Security and Acceleration (ISA) Server 2004. To find more information about a specific event, in Type in the word(s) to search for in the help viewer, type the event number.


Event 1

ISA Server 2004: Event 1

Event Message:

The %1 was unable to load Odbc32.dll for SQL logging due to the following error: %2. The data is the error code.

Explanation:

Open Database Connectivity (ODBC) allows applications to access data in a DBMS (database management system). Odbc32.dll (dynamic-link library file) is required for this process and it could not be located in the current system path.

User Action:

Verify the existence of Odbc32.dll in the Windows system directory. The system directory is typically %systemroot%\system32. If the file does not exist, then reinstall ODBC.

Get latest ISA Server content at ISA Server Guidance.
Send feedback about this page Send feedback about this page.


Event 2

ISA Server 2004: Event 2

Event Message

The %1 was unable to open ODBC Data Source %2, Table: %3, under User Name [%4]. The ODBC Error description is: %5.

Explanation:

Open Database Connectivity (ODBC) allows applications to access data in a database management system (DBMS). It uses a data source to maintain connection information for the database. The ODBC-specified data source could not be opened because it does not exist or because the table and user name information is incorrect.

User Action:

Check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the console tree of ISA Server Management, select the server or array name, and then click Monitoring. In the details pane click the Logging tab, and then use the options in the task pane to view the properties where logging is enabled for this service.


Event 3

ISA Server 2004: Event 3

Event Message

The %1 was unable to create the log file directory %2. For more information about this event, see TOKEN_FAMILY_PRODUCT_NAME Help.

Explanation:

The log file folder specifies where log files should be saved. This information may be missing or incorrect.

User Action:

Check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the console tree of ISA Server Management, click the server or array name, and then click Monitoring. In the details pane click the Logging tab, and then use the options in the task pane to view the properties where logging is enabled for this service.


Event 4

ISA Server 2004: Event 4

Event Message

The %1 failed to log information. The log object was never created possibly due to an incorrect configuration. For more information about this event, see TOKEN_FAMILY_PRODUCT_NAME Help.%0

Explanation:

The server failed to find correct logging information. This information may be missing or incorrect.

User Action:

Check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the console tree of ISA Server Management, click the server or array name, and then click Monitoring. In the details pane click the Logging tab, and then use the options in the task pane to view the properties where logging is enabled for this service.


Event 5

ISA Server 2004: Event 5

Event Message

The %1 failed to log information to file %2 in path %3. The data is the error code. %0

Explanation:

The log file folder specifies where log files should be saved. The server failed to find the correct location for logging information. This information may be missing or incorrect.

User Action:

Check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the console tree of ISA Server Management, select the server or array name, and then click Monitoring. In the details pane click the Logging tab, and then use the options in the task pane to view the properties where logging is enabled for this service.


Event 6

ISA Server 2004: Event 6

Event Message:

The %1 failed to log information to ODBC Data Source %2, Table: %3, under User Name [%4]. The ODBC Error description is: %5. %0. IF TOKEN_FAMILY_PRODUCT_NAME is logging to an SQL server, the problem may be resolved by restarting the SQL Server service.

Explanation:

Open Database Connectivity (ODBC) allows applications to access data in a database management system (DBMS). It uses a data source to maintain connection information for the database. The ODBC-specified data source could not be opened because it does not exist or because the table and user name information is incorrect.

User Action:

Check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the console tree of ISA Server Management, select the server or array name, and then click Monitoring. In the details pane click the Logging tab, and then use the options in the task pane to view the properties where logging is enabled for this service.


Event 7

ISA Server 2004: Event 7

Event Message:

The %1 created the log file directory %2 due to logging configuration changes.

Explanation:

ActiveX Data Objects (ADO) allows applications to access data in a database management system (DBMS). It uses a connection object to access the data source. The ADO connection object could not be opened probably due to low memory resources.

User Action:

  1. Close other programs that are running.
  2. Use the Task Manager to check programs and processes that are using large amounts of system resources. For information about managing memory resources, see Windows help.


Event 8

ISA Server 2004: Event 8

Event Message:

T

he %1 failed to log information to MSDE Database %2 in path %3. The MSDE Error description is: %4. The problem may be resolved by restarting the MSSQL$MSFW service. For more information about this event, see TOKEN_FAMILY_PRODUCT_NAME Help.%0

Explanation:

The server failed to find the correct location for logging information, or there is no space on the disk drive. This information may be missing or incorrect.

User Action:

  1. Check the log properties in the corresponding logging service to verify that specified log folder is correct. To do this, in the ISA Server console tree, select the server or array name, select Monitoring, and then click Logging. Check the property sheet where logging is enabled for this service.
  2. Delete unnecessary files to free up disk space.


Event 10060

ISA Server 2004: Event 10060

Event Message

Permission is denied. The remote server refused access to the requested resource. Contact the administrator for the remote server and report the problem. %0

Explanation:

User Action:

Get latest ISA Server content at ISA Server Guidance.
Send feedback about this page Send feedback about this page.


Event 10061

ISA Server 2004: Event 10061

Event Message

An invalid IP address was encountered. %0

Explanation:

The system detected an invalid address used as an argument of a call. This error can occur if the length of the buffer is too small.

User Action:

Verify the return value from a memory allocation to be sure it succeeded. Always be sure to allocate enough space.


Event 11000

ISA Server 2004: Event 11000

Event Message

%1 failed to start. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed. Use the source location %6 to report the failure.

Explanation:

The service failed to start because the data in the storage is corrupt. This may be due to incorrect configuration of either the registry or Active Directory.

User Action:

  1. If a backup exists, use the ISA Server Restore option to overwrite the corrupt configuration. To do this, in the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore. For details about restoring an ISA Server configuration, see ISA Server Help.
  2. If you are unable to restore the configuration, or doing so does does not solve the problem, you should reinstall ISA Server. Before reinstalling, you must first uninstall ISA Server using the remove program applet avaialable from Control Panel. When you uninstall, you lose all the configuration parameters. Reinstalling ISA Server without first uninstalling the previous copy does not resolve this problem.


Event 11001

ISA Server 2004: Event 11001

Event Message:

%1 encountered a failure. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed. Use the source location %6 to report the failure. %2%0

Explanation:

The service failed to start because the data in the storage is corrupt. This may be due to incorrect configuration of either the registry or Active Directory.

User Action:

  1. If a backup exists, use the ISA Server Restore option to overwrite the corrupt configuration. To do this, in the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore. For details about restoring an ISA Server configuration, see ISA Server Help.
  2. If you are unable to restore the configuration, or doing so does not solve the problem, you should reinstall ISA Server. Before reinstalling, you must first uninstall ISA Server using the remove program applet available from Control Panel. When you uninstall, you lose all the configuration parameters. Reinstalling ISA Server without first uninstalling the previous copy does not resolve this problem.


Event 11002

ISA Server 2004: Event 11002

Event Message:

%1 failed to start. The failure occurred during %5 because the configuration property %4 of key %3 is not valid. Use the source location %6 to report the failure. %2%0

Explanation:

The service failed to start because the data in the storage is corrupt. This may be due to incorrect configuration of either the registry or Active Directory.

User Action:

  1. If a backup exists, use the ISA Server Restore option to overwrite the corrupt configuration. To do this, in the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore. For details about restoring an ISA Server configuration, see ISA Server Help.
  2. If you are unable to restore the configuration, or doing so does does not solve the problem, you should reinstall ISA Server. Before reinstalling, you must first uninstall ISA Server using the remove program applet avaialable from Control Panel. When you uninstall, you lose all the configuration parameters. Reinstalling ISA Server without first uninstalling the previous copy does not resolve this problem.


Event 11003

ISA Server 2004: Event 11003

Event Message

%1 encountered a failure. The failure occurred during %5 because the configuration property %4 of key %3 is not valid. Use the source location %6 to report the failure. For more information about this event, see TOKEN_FAMILY_PRODUCT_NAME Help. %2%0

Explanation

The service failed to start because the data in the storage is corrupt. This may be due to incorrect configuration of either the registry or Active Directory.

User Action:

  1. If a backup exists, use the ISA Server Restore option to overwrite the corrupt configuration. To do this, in the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore. For details about restoring an ISA Server configuration, see ISA Server Help.
  2. If you are unable to restore the configuration, or doing so does does not solve the problem, you should reinstall ISA Server. Before reinstalling, you must first uninstall ISA Server using the remove program applet avaialable from Control Panel. When you uninstall, you lose all the configuration parameters. Reinstalling ISA Server without first uninstalling the previous copy does not resolve this problem.


Event 11004

ISA Server 2004: Event 11004

Event Message

%1 failed to start. The failure occurred during %4 because the system call %3 failed. Use the source location %5 to report the failure. %2%0

Explanation

If you are running ISA Server 2004 Standard Edition, this error indicates a corrupted registry key. Otherwise, the error may result from a bad connection to the domain controller or from DNS errors.

User Action

  1. If you are running Standard Edition and a backup exists, try to restore the configuration. To do this, in the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore. For details about restoring an ISA Server configuration, see ISA Server Help.
  2. Otherwise, verify connectivity with the domain controller and check the DNS configuration.


Event 11005

ISA Server 2004: Event 11005

Event Message

%1 encountered a failure. The failure occurred during %4 because the system call %3 failed. Use the source location %5 to report the failure. %2%0

Explanation

The failure is due to a shortage of resources, probably memory resources.

User Action

  1. Close any other applications that are currently running.
  2. Use the Task Manager to check programs and processes that are using large amounts of system resources.
  3. Make sure that Active Directory is working.

For more information about managing memory resources, see Windows Help.


Event 11006

ISA Server 2004: Event 11006

Event Message:

%1 failed to start. A shortage of available memory caused the service to fail during %2. Use the source location %3 to report the failure.

Explanation:

Either the service or other processes are utilizing excessive memory resources.

User Action:

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For information on managing memory resources, see Windows Help.


Event 11007

ISA Server 2004: Event 11007

Event Message

A shortage of available memory caused the %1 to fail during %2. Use the source location %3 to report the failure.

Explanation:

Either the service or other processes are using excessive memory.

User Action:

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more advice on managing memory resources, see Windows Help.


Event 11008

ISA Server 2004: Event 11008

Event Message

%1 failed to start. The service failed to register for storage notification on key %3 during %4. Use the source location %5 to report the failure. %2%0

Explanation

The failure is probably due to insufficient memory or a problem accessing the storage.

User Action

  1. Close any other applications that are currently running.
  2. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows Help.
  3. Make sure that Active Directory is working.


Event 11010

ISA Server 2004: Event 11010

Event Message:

%1 encountered a failure. The storage of the current array %2 (or server %3) could not be accessed during %5. The error code in the event viewer indicates the source of the failure. Use the source location %6 to report the failure. If your server is a stand-alone ISA Server try to restore the TISA Server configuration, otherwise, check the connectivity to domain controller (DC), and the DNS configuration.%4%0

Explanation

If you are running ISA Server 2004 Standard Edition, this error indicates a corrupted registry key. Otherwise, the error may result from a bad connection to the domain controller or from DNS errors.

User Action

  1. If you are running Standard Edition and a backup exists, try to restore the configuration. To do this, in the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore. For details about restoring an ISA Server configuration, see ISA Server Help.
  2. Otherwise, verify connectivity with the domain controller and check the DNS configuration.


Event 12013

ISA Server 2004: Event 12013

Event Message

The user name was not allowed. Try a different name, or retry the same name after verifying that it is typed correctly.

Explanation

The user name was denied. Either the name was not entered correctly, or the user name is not allowed.

User Action

  1. User name is case sensitive. Verify that the name is entered correctly and retry.
  2. If the user name is still not allowed, try a different name.


Event 14010

ISA Server 2004: Event 14001

Event Message

Firewall Service failed to initialize. Previous event log entries might help determine the proper action.

User Action

Check the Firewall service configuration. You may need to restart the computer.


Event 140002

ISA Server 2004: Event 14002

Event Message

The Firewall service cannot initialize WinSock.

Explanation

The Firewall service cannot start. The system is probably out of memory, or the registry might be corrupt.

User Action

Check the Firewall service configuration. You may need to restart the computer.To do this, click Start, point to Programs, point to Administrative Tools, and then click Component Services. Try to stop and restart the service. If this does not work, restart the computer.


Event 14003

ISA Server 2004: Event 14003

Event Message

Firewall service started.

User Action

No user action is required.


Event 14004

ISA Server 2004: Event 14004

Event Message

The Firewall service cannot start due to a shortage of available memory.

Explanation

Either an application is using too much memory or the page file size is too small.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows Help.


Event 14006

ISA Server 2004: Event 14006

Event Message

The Firewall service cannot start the performance counters. Restart the Firewall service.

Explanation:

The performance counters can only start if the Firewall service is running.

User Action

Start the Firewall service. To to this, in the ISA Server Managment console, select Monitoring, and then select the Services tab. Select the Firewall service, and then in the tasks tab, click Start.


Event 14007

ISA Server 2004: Event 14007

Event Message

A shortage of available memory caused the Firewall service to fail. The Event Viewer Data window displays the number of active connections.

Explanation:

The ISA Server computer cannot support additional connections for the server.

User Action

  1. Check the number of current connections and reduce that number to an acceptable level.
  2. Close other programs that are running. Use the Task Manager to check programs and processes using large amounts of system resources. For more information about managing memory resources, see Windows Help.


Event 14010

ISA Server 2004: Event 14010

Event Message

The Firewall service did not start due to corrupt data in the registry or Active Directory, depending on the ISA Server configuration.

Explanation

The event occurs when Firewall service cannot start due to corrupted data in the registry or in the Active Directory configuration.

User Action

  1. Wait a few minutes and then restart the service.
  2. If a backup exists, use the ISA Server Restore option to overwrite the corrupt configuration. To do this, in the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore. For details about restoring an ISA Server configuration, see ISA Server Help.
  3. If you are unable to restore the configuration, or doing so does does not solve the problem, you should reinstall ISA Server. Before reinstalling, you must first uninstall ISA Server using the remove program applet avaialable from Control Panel. When you uninstall, you lose all the configuration parameters. Reinstalling ISA Server without first uninstalling the previous copy does not resolve this problem.


Event 14011

ISA Server 2004: Event 14011

Event Message

The Firewall service failed to bind its socket to %1, port %2. This could be caused by another service that is already using the same port or by a network adapter that is not functional.

Explanation

Either the requested service port is already in use or there is a problem with the network adapter.

User Action

  1. Click Start, click Run and then type netstat -a to display statistics for the current TCP/IP connections. For more information about the netstat command, see Windows Help.
  2. Check for port conflicts or network problems. Close the other application that is using the requested port.


Event 14012

ISA Server 2004: Event 14012

Event Message

Firewall client from %1 attempted to access ISA Server using control protocol version %2. The server supports version %3.
The version of the Firewall client software is incompatible with the server version. If the Firewall client software is older than the server software, upgrade the Firewall client software. If the server software is older, either upgrade the server or direct the client to a different server that uses the newer software.

Explanation

Firewall Client for ISA Server 2004 uses a protocol that encrypts the channel between the Firewall client and ISA Server. Firewall clients running earlier versions of the Firewall Client software are supported only if the option allowing them to connect is enabled. Encryption will not be used for these connections.

User Action

  1. If the Firewall client software is older than the ISA Server software, upgrade the Firewall client software.
  2. Alternatley, you can enable Firewall clients running older versions of the Firewall Client software to connect to ISA Server 2004. To do this, in the ISA Server Management console, click Configuration, and then click General. In the General page details pane, click Define Firewall Client Settings, click the Application Settings tab, and then select Allow non-encrypted Firewall Client connections.


Event 14014

ISA Server 2004: Event 14014

Event Message

The Firewall service requires Windows 2000 Server with Service Pack 4 or Windows Server™ 2003.

Explanation

The version of Windows running on this computer does not support the Firewall service.

User Action:

Install Windows 2000 Server with Service Pack 4 or Windows Server 2003 on this computer. For best practice, always install the latest service packs and updates on your computer.


Event 14015

ISA Server 2004: Event 14015

Event Message

The Firewall service failed to load a security dynamic-link library (DLL). The required DLL is missing or cannot be found. Make sure that the Security.dll is located in the Windows system directory (typically, %systemroot%\System32 directory), and then restart the Firewall service.

User Action:

  1. Verify that the Security.dll is in the Windows system directory.
  2. Restart the Firewall service. To do this, in the ISA Server Management console, click Monitoring, and then select the Services tab. In the Services details pane, right-click Firewall service, and then click Start.


Event 14016

ISA Server 2004: Event 14016

Event Message

The Firewall service failed to determine the network addresses, either due to improper network connections or insufficient memory. Check the network connections and then restart the service. If this problem occurs again, close some applications, stop the service, and then restart the service.

User Action:

To restart the service, in ISA Server console tree, click Monitoring, and then select the Services tab. Select the service, and then on the tasks pane click Stop. When the service has stopped, select the service, and then on the tasks pane, click Start Service.


Event 14017

ISA Server 2004: Event 14017

Event Message

The network is not properly configured. The server address is not internal and is not in the local address table (LAT).

Explanation

An Internet Protocol (IP) address configured for the internal network adapter for the server needs to be included within the Local Address Table (LAT) for the server.

User Action

To configure the Local Address Table (LAT) for the network, do the following:

  1. In the ISA Server Management console, click Configuration and then click Networks.
  2. Select the Internal network, and then on the tasks pane, click Edit Selected Network.
  3. In the Networks property page edit the IP addresses configured for the network.


Event 14018

ISA Server 2004: Event 14018

Event Message

ISA Server failed to load the firewall policy configuration. For details about this error, see the Windows event Viewer.

Explanation

The failure may be due to insufficient memory or a problem accessing the storage.

User Action

Restart the service. If the problem still occurs, close any other programs that are running. Use the Task Manager to check for programs and processes that are using large amounts of system resources. For information about managing memory resources, see Windows Help.


Event 14019

ISA Server 2004: Event 14019

Explanation

The failure is probably due to a problem in the storage of the firewall policy rule.

User Action

Verify that the rule properties are valid or delete the specified policy rule. Then apply the changes to the firewall policy.


Event 14020

ISA Server 2004: Event 14020

Event Message

ISA Server failed to load the firewall policy configuration. The failure occurred while loading the policy element "%1". For details about this error, see the event properties in the Windows Event Viewer.

Explanation:

The failure is probably due to a problem in the storage of the firewall policy rule element.

User Action:

Modify or delete the specified object, then apply the changes to the firewall policy.


Event 14021

ISA Server 2004: Event 14021

Event Message

The Firewall service failed to initialize because the system call %1 failed.

Explanation

The failure is probably due to insufficient memory or a problem accessing the storage.

User Action

  1. Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For information about managing memory resources, see Windows Help.
  2. Verify that Active Directory is working.


Event 14022

ISA Server 2004: Event 14022

Event Message

ISA Server Control Service failed to initialize because the system call %1 failed. The error occurred during %2. Use the source location %3 to report the failure.

Explanation

The failure is probably due to insufficient memory or a problem accessing the storage.

User Action

  1. Restart the service. To to this, in the console tree of ISA Server Management, click Monitoring. In the details pane click the Services tab, and then select the ISA Server Control Service. In the tasks tab, click Start Selected Services.
  2. If that does not resolve the problem, close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For information about managing memory resources, see Windows Help.


Event 14025

ISA Server 2004: Event 14025

Event Message

ISA Server Control service requires Windows Server™ 2003 or Windows® Server 2000 with Service Pack 4.

User Action

Install either Windows Server 2003, or Windows Server 2000 with Service Pack 4. For best practice, always install the latest service packs.


Event 14026

ISA Server 2004: Event 14026

Event Message

ISA Server Control service failed to initialize. You should restart the service.

User Action

Restart the service. To to this, in the console tree of ISA Server Management, click Monitoring. In the details pane click the Services tab, select Microsoft ISA Server Control service, and then on the Tasks tab, click Start Selected Services.


Event 14028

ISA Server 2004: Event 14028

Event Message

The Firewall service did not initialize the network dial-up entry. Try an alternative manual dial-up entry. If successful, retry the dial-up entry. If the problem still exists, restart the Firewall service. If this does not solve the problem, restart Windows.


Event 14029

ISA Server 2004: Event 14129

Event Message

The Firewall service failed to create a socket.


Event 14030

ISA Server 2004: Event 14130

Event Message

The Firewall service failed to associate a control socket with a completion port.

Explanation

This event indicates that the upstream proxy server is offline.

User Action

Verify the reason and predicted time frame for the continuation of the problem. If necessary, configure a backup route. To do this, in the Configuration node of ISA Server Management, click Networks, and then select the Web Chaining tab. Open the routing rule, and then click the Action tab. Or, you can route the request to an alternate destination.


Event 14031

ISA Server 2004: Event 14131

Event Message

The Firewall service failed to initialize control or refresh sockets.


Event 14032

ISA Server 2004: Event 14132

Event Message

The service was stopped. The evaluation period has expired. Refer to the ISA Server Web site for information on upgrading to the official version of ISA Server 2004.

Explanation

The installed copy of the product is an evaluation version and is no longer valid.

User Action

To continue working with this product, please refer to the ISA Server Web site for details about purchasing the product. When you purchase the product, you can upgrade from the evaluation copy to the official version.


Event 14034

ISA Server 2004: Event 14134

Event Message

The Firewall service did not listen on all Transmission Control Protocol (TCP) sockets. The reason for the failure of the service can be determined by examining previous event log entries.


Event 14036

ISA Server 2004: Event 14036

Event Message

The Firewall service failed to open a listener for Firewall clients on address %1.

Explanation:

The specified IP address cannot be used to connect to ISA Server.

User Action:

Use ISA Server Management to configure the IP address or DNS name to which Firewall clients should connect.


Event 14055

ISA Server 2004: Event 14055

Event Message

The Firewall service encountered an illegal operation (runtime error R6025), in a pure virtual function. To resolve this error, remove recently installed application filters and restart the service.

User Action

After removing any application filters, restart the Firwall service. To to this, in the console tree of ISA Server Management, click Monitoring. In the details pane click the Services tab, and then select Microsoft Firewall service. In the tasks tab, click Start Selected Services.


Event 14056

ISA Server 2004: Event 14056

Event Message

The Firewall service encountered an illegal operation (runtime error R6025), in a pure virtual function. To resolve this error, remove recently installed application filters and restart the service.


Event 14057

ISA Server 2004: Event 14057

Event Message

The Firewall service stopped because an application filter module %1 generated an exception code %3 in address %2 when function %4 was called. To resolve this error, remove recently installed application filters and restart the service.

User Action

To restart the service, in the ISA Server Managment console, click Monitoring, and then click the Services tab. In the details pane, select the Firewall service, and then in the tasks tab, click Start.


Event 14059

ISA Server 2004: Event 14059

Event Message

The Firewall service cannot connect to another proxy server. Authentication failed. A chained proxy server requires proxy-to-proxy authentication. Authentication failed because the credentials that were supplied were incorrect. Check authentication credentials and try again.


Event 14060

ISA Server 2004: Event 14060

Event Message

Cannot load an application filter %1 (%4). %2 failed with code 0x%3. To attempt to activate this application filter again, stop and restart the Firewall service.

User Action

Stop the service, and then restart the Firewall service.
To to this, in the console tree of ISA Managment, click Monitoring. In the details pane click the Services tab, and then select Microsoft Firewall service. The the tasks tab, click Stop Selected Services. When the service is stopped, click Start Selected Services.


Event 14061

ISA Server 2004: Event 14061

Event Message

The Firewall service detected that the upstream proxy server '%1' is not available. If the upstream proxy server %1 becomes available, you may proceed as usual. If it does not become available, check the status of the upstream proxy server.

User Action

Create a connectivity verifier to check that the upstream proxy server is responding. To to this, in the console tree of ISA Server Management, click Monitoring. In the details pane click the Connectivity tab, and then on the Tasks tab, click Create New Connectivity Verifier. Then, follow the instructions in the wizard.


Event 14063

ISA Server 2004: Event 14063

Event Message

The Firewall service failed to initialize because of a corrupted registry. Error Code %1, Key='%2' Value='%3'.

User Action

  1. If a backup exists, use the backup to restore the configuration.
  2. If this does not solve the problem, uninstall ISA Server using the Add/Remove Programs option available from Control Panel. When you uninstall, you lose all the configuration parameters and you have to reinstall ISA Server. Reinstalling ISA Server without uninstalling the previous copy does not resolve this problem.


Event 14064

ISA Server 2004: Event 14064

Event Message

An unknown event %1 was signaled. The reported event does not appear in storage. If you recently installed an application filter, this may be the source of the error. Remove any application filters that have been installed recently. If this does not solve the problem, reinstall ISA Server.

User Action

  1. If a backup exists, use the backup to restore the configuration.
  2. If this does not solve the problem, uninstall ISA Server using the Add/Remove Programs option available from Control Panel. When you uninstall, you lose all the configuration parameters and you have to reinstall ISA Server. Reinstalling ISA Server without uninstalling the previous copy does not resolve this problem.


Event 14065

ISA Server 2004: Event 14065

Event Message

One or more of the actions associated with alert %1 has failed, due to configuration settings. The mail server may be down, or the specified command may not exist. Check the Event Viewer for related errors and fix them accordingly.

User Action

View the alert properties. To to this, in the console tree of ISA Server Management, click Monitoring. In the details pane click the Alerts tab, and then on the Tasks tab, click Configure Alert Defintions Select the alert, and then click Edit to view the alert properties.


Event 14066

ISA Server 2004: Event 14066

Event Message

One or more of the actions associated with alert %1 has failed, due to configuration settings. The mail server may be down, or the specified command may not exist. Check the Event Viewer for related errors and fix them accordingly.

User Action

View the alert properties. To to this, in the console tree of ISA Server Management, click Monitoring. In the details pane click the Alerts tab, and then on the Tasks tab, click Configure Alert Defintions Select the alert, and then click Edit to view the alert properties.


Event 14067

ISA Server 2004: Event 14067

Event Message

Failed to read the dial-up entry configuration.

Explanation

This event is logged when the specified dial-up configuration or the Firewall service configuration cannot be recognized.

User Action

Check the configuration for dial-up entries in ISA Server Management and the Firewall service. To view the dial-up entries, in the ISA Server Management console tree, click General, and then click Specify Dial-up Preferences. For information about defining dail-up entries, see ISA Server Help. For information about creating dial-up connections, see Windows Help.


Event 14068

ISA Server 2004: Event 14068

Event Message

A network dial-up connection was assigned an incorrect IP address %1. The IP address must not be defined in the local address table (LAT). All traffic passing through this interface will be blocked. Check the LAT configuration, or contact your ISP to check the IP address pool.

Explanation

This event occurs when a dial-up connection was assigned an IP address that is defined in the Local Address Table (LAT).

User Action

  1. Modify the LAT so that the IP address used for the dial-up connection is external.
  2. Alternately, change the IP address pool for the dial-up connection. You may need to contact your Internet service provider (ISP).


Event 14069

ISA Server 2004: Event 14069

Event Message

More then one alert with the same event condition, server name, and additional key was detected. The duplicated alert '%1'will be ignored.

Explanation

The alert duplication is the result of one or more configuration settings that are inconsistent or missing in the registry or Active Directory, depending on ISA Server configuration. This could be the result of an error in the configuration, an incomplete administration operation, or other internal errors. The actions in this duplicate alert are specified in the initial alert and are ignored by the service.

User Action

Delete the erroneous alert with ISA Management or a script. To locate the alert, use the name of the alert as it appears in the message.


Event 14070

ISA Server 2004: Event 14070

Event Message

The service could not start because it failed to connect to ISA Server service. Check the Event Viewer for related error messages.

Explanation

The alert duplication is the result of one or more configuration settings that are inconsistent or missing in the registry or Active Directory, depending on ISA Server configuration. This could be the result of an error in the configuration, an incomplete administration operation, or other internal errors. The actions in this duplicate alert are specified in the initial alert and are ignored by the service.

User Action

Delete the erroneous alert with ISA Server Management or a script. To locate the alert, use the name of the alert as it appears in the message.


Event 14072

ISA Server 2004: Event 14072

The alert feature of the ISA Server Control service failed to log on as user %2 to run the command %3 specified for the alert '%1'.

Explanation

Incorrect credentials can be caused by a misspelled user name, password, or domain name. It is also possible that the Windows password has changed and the password that is stored in ISA Server is now incorrect or that the domain name changed.

User Action

Verify that all the credentials for this alert are set correctly.


Event 14074

ISA Server 2004: Event 14074

The alert feature of the ISA Server Control service failed to logon as user %2 to run the command %3 specified for the alert '%1'. For more information about this event, see ISA Server Help.

Explanation:

Incorrect credentials can be caused by a misspelled user name, password, or domain name. It is also possible that the Windows password has changed and the password that is stored in ISA Server is now incorrect or that the domain name changed.

User Action

Verify that all the credentials for this alert are set correctly.


Event 14076

ISA Server 2004: Event 14076

ISA Control service failed to execute the security editing application. Error code: %1.

Explanation

The Secedit system application, which is used for security configuration and analysis, may fail due to an incorrect configuration specified in the security template files.

User Action

Use the Securwiz.log file in the ISA Server installation directory to identify the error. The file contains text in UNICODE (use Notepad to edit it). Search for the keywords "Warning" and "Error."


Event 14077

ISA Server 2004: Event 14077

Event Message

Failed to start the %1 during %2. Use the source location %3 to report the failure.

Explanation

The service failed to start.

User Action

Restart the service. To do this, in the ISA Server Management console tree, click Monitoring, in the details pane click Services and then on the Tasks tab, click Start Selected Services.


Event 14079

ISA Server 2004: Event 14079

Event Message

Due to an unexpected error, the service %1 stopped responding to all requests. Stop the service or the corresponding process if it does not respond, and then start it again. Check the Windows event Viewer for related error messages.

User Action

Restart the service. To do this, in the ISA Server Management console tree, click Monitoring, in the details pane click Services and then on the Tasks tab, click Start Selected Services.


Event 14086

ISA Server 2004: Event 14086

Event Message

ISA Server packet filter log service cannot allocate memory. The packet filter log component of ISA Server logs this event when it fails to allocate memory where memory resources are low. The packet filter log component cannot operate until the low memory situation is resolved. The ISA Server administrator can stop and restart the ISA Server services to resolve the low memory situation if logging of packet filter data is mandatory.

Explanation:

There are not enough memory resources available to complete this action.

User Action:

Close


Event 14095

ISA Server 2004: Event 14095

Explanation:

The event may be caused by a shortage of memory, an internal error, or corruption in the registry. If the problem is in the registry, it may be the result of changes made to the registry with a tool, such as regedit.exe.

User Action:

  1. Report the error location to Microsoft.
  2. Stop and then restart the Firewall service.
  3. If the problem persists, you may need to uninstall and then reinstall ISA Server.


Event 14096

ISA Server 2004: Event 14096

Explanation:

The event may be caused by a shortage of memory, an internal error, or corruption in the registry. If the problem is in the registry, it may be the result of changes made to the registry with a tool, such as regedit.exe.

User Action:

  1. Report the error location to Microsoft.
  2. Stop and then restart the Firwall service.
  3. If the problem persists, you may need to uninstall and then reinstall ISA Server.


Event 14097

ISA Server 2004: Event 14097

Explanation:

The event may be caused by a shortage of memory, an internal error, or corruption in the registry. If the problem is in the registry, it may be the result of changes made to the registry with a tool, such as regedit.exe.

User Action:

  1. Report the error location to Microsoft.
  2. Stop and then restart the Firewall service.
  3. If the problem persists, you may need to uninstall and then reinstall ISA Server.


Event 14098

ISA Server 2004: Event 14098

Explanation:

The event may be caused by a shortage of memory, an internal error, or corruption in the registry. If the problem is in the registry, it may be the result of changes made to the registry with a tool, such as regedit.exe.

User Action:

  1. Delete the server publishing rule. To do this, in the Firewall Policy node of ISA Server Management, select the rule and then in the tasks tab, select Delete Selected Rule. Apply the changes, and then create a new rule.
  2. Stop and then restart the Firewall service.
  3. If the problem persists, you may need to uninstall and then reinstall ISA Server.


Event 14102

ISA Server 2004: Event 14102

Explanation:

The registry key could not be written. This may be due registry corruption.

User Action:

Re-install the the Routing and Remote Access service by disabling and re-enabling VPN. To do this, in the console tree of ISA Server Management, select the VPN node, and then in the details pane, select Verify that VPN Client Access is Enabled.


Event 14111

ISA Server 2004: Event 14111

Explanation:

The cache could not start because there are incorrect settings in the cache configuration or the cache settings conflict with other configuration settings.

User Action

  1. Correct the cache settings by restoring the cache default settings. To do this, first stop the Firewall service. Then, in the Configuration node of ISA Server Management, click Cache. On the tasks tab, click Configure Cache Settings, and then on the Advanced tab, click Restore Defaults. Apply the changes and restart the Firewall service.
  2. If resetting the defaults does not resolve the problem, delete the cache files.
  3. If cache initialization still fails, you may need to reinstall ISA Server.


Event 14142

ISA Server 2004: Event 14142

Explanation:

This log entry or event is generated by the dial-up entry component of ISA Server when a dial-attempt fails. The problem could be related to authentication.

User Action

Verify that the specified phonebook entry in the dial-up entry configuration can be dialed manually. To do this, in the Configuration node of ISA Server Management, click the General node, and then select Dial-Up Entries. In addition, check authentication settings.


Event 14147

ISA Server 2004: Event 14147

Event Message

ISA Server detected routes through adapter "%1" that do not correlate with the network element to which this adapter belongs. The address ranges in conflict are: %2. Fix the network element and/or the routing table to make these ranges consistent; they should be in both or in neither. If you recently created a remote site network, check if the event recurs. If it does not, you may safely ignore this message.

Explanation:

Every subnet connected to the ISA Server computer must be contained in a single network. The conflicting route is crossing the network element boundaries.


Event 14148

ISA Server 2004: Event 14148

Explanation:

The requested service port is already in use, or data loss may have resulted from a large number of packet collisions on the local network segment. It is also possible that there is a problem with the network adapter.

User Action:

  1. Check that the network adapter is functioning properly.
  2. Monitor the service that failed for the server and the client, or monitor traffic on your local network.


Event 14149

ISA Server 2004: Event 14149

Explanation:

The Web Proxy filter is unable to register itself to listen on the port specified. Another application might be using the designated port.

User Action:

  1. Use netstat -a to check which ports are in use.
  2. Check the port details for each protocol defined for ISA Server. To do this, in the console tree of ISA Server Management click Firewall Policy, and then in the Toolbox, click Protocols. Select each protocol to view its details.


Event 14193

ISA Server 2004: Event 14193

Explanation:

This event is generated when the Web proxy is unable to allocate cache memory on the basis of the following: (size of RAM) x (percentage of free memory to use for caching). This may happen when there is not enough free virtual memory to allocate. In this case the Web proxy will allocate a smaller cache memory size and issue the event.

User Action:

  1. Reduce the "percentage of free memory to use for caching". This option does not indicate the percentage of available memory that ISA Server uses for caching, but rather the percentage of total RAM ISA Server uses for caching. This memory is allocated during the startup of the Microsoft Firewall service, and changes to this setting only take effect when you restart the Microsoft Firewall service. To reset this, do the following: On the Configuration node of ISA Server Management, right-click Cache, and then click Properties. On the Advanced tab, specify a new value in Percentage of free memory to use for caching.
  2. Alternately, you can increase the amount of physical memory on the computer.


Event 14200

ISA Server 2004: Event 14200

Explanation:

If this event happens for each connection, there may be a problem with the published site, or with the SSL certificate installed on published site. Otherwise, this event may indicate a heavy load on the published site.

User Action:

  1. Use a connectivity verifier to validate connectivity with the published site.
  2. Verify that a valid SSL certificate exists on the target computer.
  3. Retry the connection.


Event 15001

ISA Server 2004: Event 15001

Explanation:

A possible Windows out-of-band denial-of-service attack was attempted against a computer protected by ISA Server. If successful, this attack causes the computer to crash.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the task tab, click Create New Access Rule.


Event 15002

ISA Server 2004: Event 15002

Explanation:

A possible Internet Protocol (IP) half-scan attack was attempted against a computer protected by ISA Server. This alert occurs when an unexpected Transmission Control Protocol (TCP) packet with a particular flag (for example, Fin, Ack, All, None) is detected.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15003

ISA Server 2004: Event 15003

Explanation:

A possible land attack was attempted against a computer protected by ISA Server. This alert occurs when a Transmission Control Protocol (TCP) SYN packet or User Datagram Protocol (UDP) packet is sent with a spoofed source Internet Protocol (IP) address and port number that is identical to that of the destination IP address and port. The effect of this action appears as if the host computer has sent a packet to itself. If this attack is successful, then a loop is created and the computer crashes.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15004

ISA Server 2004: Event 15004

Explanation:

A possible land attack was attempted against a computer protected by ISA Server. This alert occurs when a Transmission Control Protocol (TCP) SYN packet or User Datagram Protocol (UDP) packet is sent with a spoofed source Internet Protocol (IP) address and port number that is identical to that of the destination IP address and port. The effect of this action appears as if the host computer has sent a packet to itself. If this attack is successful, then a loop is created and the computer crashes.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the task tab, click Create New Access Rule.


Event 15005

ISA Server 2004: Event 15005

Explanation:

A possible land attack was attempted against a computer protected by ISA Server. This alert occurs when a Transmission Control Protocol (TCP) SYN packet or User Datagram Protocol (UDP) packet is sent with a spoofed source Internet Protocol (IP) address and port number that is identical to that of the destination IP address and port. The effect of this action appears as if the host computer has sent a packet to itself. If this attack is successful, then a loop is created and the computer crashes.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the task tab, click Create New Access Rule.


Event 15006

ISA Server 2004: Event 15006

Explanation:

A possible User Datagram Protocol (UDP) bomb attack was attempted against a computer protected by ISA Server. This event occurs when there is an attempt to send an illegal UDP packet.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the task tab, click Create New Access Rule.


Event 15007

ISA Server 2004: Event 15007

Explanation:

A possible ping-of-death attack was attempted against a computer protected by ISA Server. This event occurs when a large amount of information is appended to an Internet Control Message Protocol (ICMP) echo request (ping) packet. If this attack is successful, the computer crashes.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the task tab, click Create New Access Rule.


Event 15008

ISA Server 2004: Event 15008

Explanation:

A possible spoof attack was attempted against a computer protected by ISA Server. This event occurs when an Internet Protocol (IP) packet is received from an Internet Protocol (IP) address that is not reachable via the interface on which the packet was received.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15009

ISA Server 2004: Event 15009

Explanation:

ISA Server detected a possible SYN attack and will protect the network accordingly.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15101

ISA Server 2004: Event 15101

Explanation:

A possible windows out-of-band, denial-of-service attack was attempted against a computer protected by ISA Server. If successful, this attack crashes the computer.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15102

ISA Server 2004: Event 15102

Explanation:

A possible Internet Protocol (IP) half-scan attack was attempted against a computer protected by ISA Server. This alert occurs when an unexpected Transmission Control Protocol (TCP) packet with a particular flag (for example, Fin, Ack, All, None) is detected.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15103

ISA Server 2004: Event 15103

Explanation:

A possible land attack was attempted against a computer protected by ISA Server. This alert occurs when a Transmission Control Protocol (TCP) SYN packet or User Datagram Protocol (UDP) packet is sent with a spoofed source Internet Protocol (IP) address and port number that is identical to that of the destination IP address and port. The effect of this appears as if the host computer has sent a packet to itself. If this attack is successful, a loop is created and the computer crashes.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15104

ISA Server 2004: Event 15104

Explanation:

A possible well-known port scan attack was attempted against a computer protected by ISA Server. This event occurs when an attempt is made to scan ports on this computer in order to detect the services running on these ports.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15105

ISA Server 2004: Event 15105

Explanation:

A possilbe all port scan attack was attempted against a computer protected by ISA Server. This event occurs when an attempt is made to scan ports on this computer in order to detect the services running on it.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15106

ISA Server 2004: Event 15106

Explanation:

A possible User Datagram Protocol (UDP) bomb attack was attempted against a computer protected by ISA Server. This event occurs when there is an attempt to send an illegal UDP packet.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15107

ISA Server 2004: Event 15107

Explanation:

A possible ping-of-death attack was attempted against a computer protected by ISA Server. This event occurs when a large amount of information is appended to an Internet Control Message Protocol (ICMP) echo request (ping) packet. If this attack is successful, the computer crashes.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15108

ISA Server 2004: Event 15108

Explanation:

A possible spoof attack was attempted against a computer protected by ISA Server. This event occurs when a Internet Protocol (IP) packet is received from a Internet Protocol (IP) address that is not reachable via the network adapter on which the packet was received.

User Action:

  1. If logging for dropped packets is enabled, you can view details of this attack in the Firewall log in the log viewer. You can use this log to monitor any further intruder activity. To do this, in the Monitoring node in ISA Server, click the Logging tab. Then edit the log filter to view the relevant details.
  2. Take additional steps against intruder activity. For example, you may want to add access rules denying traffic from the source of the intrusion. To do this, in the Firewall Policy node of ISA Server Management, on the tasks tab, click Create New Access Rule.


Event 15109

ISA Server 2004: Event 15109

Explanation:

Quarantine settings should only be enabled through ISA Server. If ISA Server detects that Routing and Remote Access service is also configured to apply quarantine, in order to prevent a configuration conflict, ISA Server does not allow the connection.

User Action:

  1. Remove the quarantine configuration attributes from the Routing and Remote Access service policies.
  2. Enable Quarantine through ISA Server. To do this, in the Configuration node of ISA Server Management, select Networks. In the Networks tab, select the Quarantine VPN Clients network, and then select the Quarantine tab.


Event 15110

ISA Server 2004: Event 15110

Explanation:

The Firewall service cannot start if the Routing and Remote Access service is already running on the server. When the Firewall service is running again, the Routing and Remote Access service will restart.

User Action:

No user action is required. The Firewall service is restarting.


Event 15111

ISA Server 2004: Event 15111

Explanation:

This event occurs when the DHCP anti-poisoning intrusion detection mechanism detects a malicious or invalid offer.

User Action:

Follow the instructions provided in the description for the related alert. To do this, in the ISA Server Management console, select the Monitoring node for the server, and click the Alerts tab. In the list of alerts, select the relevant alert. The alert description displays in the alert details pane.


Event 15112

ISA Server 2004: Event 15112

Explanation:

The event occurs when ISA Server rejects a connection from a client because its connection limit was exceeded. The event could indicate a flood attack.

User Action:

  1. Use the log filter to determine if the source of the connection is legitimate or the result of a flood attack. To do this, in the ISA Server Management console, select the Monitoring node for this server. Then, click Logging and edit the log filter properties to view the source of the connection.
  2. If the connection should be allowed, increase the connection limit threshold. To do this, in the ISA Server Management console Configuration node for the server, select General. In the General details pane, select Define Connection Limits, and then use the options in the Connection Limits page to increase the number of concurrent connections allowed.


Event 15113

ISA Server 2004: Event 15113

Explanation:

ISA Server rejected a connection from the client %1 because its connection limit was exceeded. The event could indicate a flood attack.

User Action:

  1. Use the log filter to determine if the source of the connection is legitimate or the result of a flood attack. To do this, in the ISA Server Management console, select the Monitoring node for this server. Then, click Logging and edit the log filter properties to view the source of the connection.
  2. If the connection should be allowed, increase the connection limit threshold. To do this, in the ISA Server Management console Configuration node for the server, select General. In the General details pane, select Define Connection Limits, and then use the options in the Connection Limits page to increase the number of concurrent connections allowed.


Event 15114

ISA Server 2004: Event 15114

Explanation:

ISA Server rejected a connection from the client %1 because its connection limit was exceeded. The event could indicate a flood attack.

User Action:

  1. Use the log filter to determine if the source of the connection is legitimate or the result of a flood attack. To do this, in the ISA Server Management console, select the Monitoring node for this server. Then, click Logging and edit the log filter properties to view the source of the connection.
  2. If the connection should be allowed, increase the connection limit threshold. To do this, in the ISA Server Management console Configuration node for the server, select General. In the General details pane, select Define Connection Limits, and then use the options in the Connection Limits page to increase the number of concurrent connections allowed.


Event 15115

ISA Server 2004: Event 15115

Explanation:

As a result of this event, DHCP anti-poising intrusion detection mechanism is currently disabled on this network adapter.

User Action:

Use the IPConfig utility to check if there is more than one network adapter using the same MAC Address. For best security practice, when the DHCP anit-poising intrusion detection mechanism is disabled, you should not use a VLAN-tagged environment with DCHP on unsecured networks.


Event 15116

ISA Server 2004: Event 15116

Explanation:

ISA Server rejected a connection from the client %1 because its connection limit for the number of connections allowed per second was exceeded. The event could indicate a flood attack.

User Action:

  1. Use the log filter to determine if the source of the connection is legitimate or the result of a flood attack. To do this, in the ISA Server Management console, select the Monitoring node for this server. Then, click Logging and edit the log filter properties to view the source of the connection.
  2. If the connection should be allowed, increase the connection limit threshold. To do this, in the ISA Server Management console Configuration node for the server, select General. In the General details pane, select Define Connection Limits, and then use the options in the Connection Limits page to increase the number of connctions allowed per second.


Event 15117

ISA Server 2004: Event 15117

Explanation:

ISA Server rejected a connection from the client %1 because its connection limit was exceeded. The event could indicate a flood attack.

User Action:

  1. Use the log filter to determine if the source of the connection is legitimate or the result of a flood attack. To do this, in the ISA Server Management console, select the Monitoring node for this server. Then, click Logging and edit the log filter properties to view the source of the connection.
  2. If the connection should be allowed, increase the connection limit threshold. To do this, in the ISA Server Management console Configuration node for the server, select General. In the General details pane, select Define Connection Limits, and then use the options in the Connection Limits page to increase the number of concurrent connections allowed.


Event 21098

ISA Server 2004: Event 21098

Explanation:

When VPN is configured to use the RADIUS Authentication Provider, the RADIUS Server List configuration is pushed to the Routing and Remote Access. When the RADIUS Server list is empty, Routing and Remote Access Service will not start.

User Action:

Make sure there are valid servers in the VPN RADIUS Server List. To do this, in the console tree of ISA Server Management, in the name used to manage the ISA Server, click General, then in the details pane click Define RADIUS Servers.

Alternatively you can configure VPN to use Windows authentication.


Event 21099

ISA Server 2004: Event 21099

Explanation:

This event occurs when ISA Server is unable to read the RADIUS server name or IP address from storage.

User Action:

  1. Verify that your RADIUS Server settings are correct.
  2. If you specified the RADIUS Server as a FQDN, verify that the name can be resolved to an IP address.
  3. Check that memory resources are available.


Event 21164

ISA Server 2004: Event 21100

Explanation:

This event occurs when ISA Server is unable to read the RADIUS server attributes (such as order, connection timeout, port, use msg authenticator, shared secret) from storage, or memory allocation fails, or ISA Server was unable to resolve the RADIUS server name to an IP address (i.e., GetHostByName failed).

User Action:

  1. Verify that your RADIUS Server settings are correct.
  2. If you specified the RADIUS Server as a FQDN, verify that the name can be resolved to an IP address.
  3. Check that memory resources are available.


Event 21103

ISA Server 2004: Event 21103

Explanation:

Network Load Balancing is enabled for ISA Server, but Network Load Balancing is not installed.

User Action:

Install Network Load Balancing on this computer. For details about installing Network Load Balancing, refer to the Windows Help.


Event 21105

ISA Server 2004: Event 21105

Explanation:

Network Load Balancing is enabled and configured to run with ISA Server. Therefore, it should be stopped and started through ISA Server Management only.

User Action:

Network Load Balancing will be restarted by ISA Server. If you would like to stop Network Load Balancing you must do so through ISA Server Management.

To do this: Open ISA Server Management and in the console tree of ISA Server, click Monitoring. In the details pane click the Services tab, then select Network Load Balancing, and then in the task pane click Stop. do the following:


Event 21106

ISA Server 2004: Event 21106

Explanation:

Network Load Balancing is enabled and configured to run with ISA Server. Therefore, any changes to the Network Load Balancing configuration should be done through ISA Server Management. The changes will not be saved.

User Action:

ISA Server will revert the Network Load Balancing configuration to the configuration saved in ISA Server. There are no user actions required.


Event 21107

ISA Server 2004: Event 21107

Explanation:

Changes made to the Network Load Balancing configuration could not be saved. This may be due to low resources.

User Action:

  1. Close any open applications to free memory.
  2. If it is not a memory resource problem, restart the Firewall service.
  3. If the problem still persists, restart the computer.


Event 21108

ISA Server 2004: Event 21108

Explanation:

Network Load Balancing has been stopped on this computer.

User Action:

No user action is required. Network Load Balancing will restart automatically when the Firewall service is restarted or when the administrator restarts Network Load Balancing.


Event 21109

ISA Server 2004: Event 21109

Explanation:

Network Load Balancing starts when Firewall service is started, a new Network Load Balancing configuration applied, Network Load Balancing was previously stopped because of a problem which no longer exists, or Network Load Balancing is restarted by the administrator.

User Action:

No user action is required.


Event 21113

ISA Server 2004: Event 21113

Explanation:

The computer must have a network adapter that is associated with the network and has static IP address configured on it. Also, if the computer is running on Windows Server™ 2003 without any service packs installed (SP1 or later), the network adapter must not be the network adapter used for intra-array communication.

User Action:

  1. Make sure that the computer has a network adapter with a static IP address configured on it, and that the network adapter is associated with this network.
  2. If you are running Windows Server 2003 without any service packs, make sure this network adapter is not being used for intra-array communication.


Event 21114

ISA Server 2004: Event 21114

Explanation:

The computer must have a network adapter that is associated with the network and has static IP address configured on it. Also, if the computer is running on Windows Server™ 2003 without any service packs installed (SP1 or later), the network adapter must not be the network adapter used for intra-array communication.

User Action:

  1. Make sure that the computer has a network adpater with a static IP address configured on it, and that the network adapter is associated with this network.
  2. If you are running Windows Server 2003 without any service packs, make sure this network adapter is not being used for intra-array communication.


Event 21115

ISA Server 2004: Event 21115

Explanation:

The event occurs when a network adapter configuration includes network IP addresses from more than one network.

User Action:

Configure the network adapter so that all its IP addresses belong to the same network.


Event 21137

ISA Server 2004: Event 21137

Explanation:

This event occurs when the connection between the ISA Server computer and the specified destination server cannot be established using the requested verification method. The server you are trying to verify connectivity with may not be responding. If all connectivity verifiers are failing, the ISA Server computer may not be connected properly to the network.

User Action:

  1. Verify that the ISA Server computer is connected to the network.
  2. Use ISA Server logging feature to determine if the connection request was denied by a policy rule.


Event 21138

ISA Server 2004: Event 21138

Explanation:

The connection to the server succeeded, but the time used to verify the connection took longer than the response connectivity threshold specified for this connectivity verifier.

User Action:

Verify that there are no networking problems, and that the specified destination server is not too busy to handle the connectivity request. If this error is persistent, consider raising the connectivity verifier threshold.


Event 21140

ISA Server 2004: Event 21140

Explanation:

When publishing a report, the ISA Server computer creates a folder with the report files in the published reports directory on the specified server. If ISA Server does not have the necessary permissions to write to the specified server, report publishing will fail. If no user account is defined, ISA Server uses the computer account that ISA Server is running on to write the files.

User Action:

Verify that the ISA Server computer account has write permissions to the published reports directory on the specified server. Alternatively, you can configure ISA Server to use a different account which has the required permissions.


Event 21141

ISA Server 2004: Event 21141

Explanation:

ISA Server was unable to send the report completion e-mail message using the specified SMTP mail server. There may be connectivity or permission issues blocking the request.

User Action:

  1. Verify the SMTP server is running, and that there are no connectivity or permissions issues.
  2. Verify that the request was not denied by an ISA Server firewall policy access rule.
  3. If you are using an external SMTP server, verify that an access rule allowing the Local Host access to the External network using the SMTP protocol has been created. If no rule exists, you must create one. For instructions on creating access rules, see ISA Server Help.


Event 21142

ISA Server 2004: Event 21142

Explanation:

ISA Server was unable to either generate a daily summary or generate a report.

User Action:

View the result code for details about the source of the error.


Event 21157

ISA Server 2004: Event 21157

Explanation:

ISA Server was unable to either generate a daily summary or generate a report.

User Action:

View the result code for details about the source of the error.


Event 21158

ISA Server 2004: Event 21158

Explanation:

For each daily summary, the last date included in the summary is recorded in the registry. ISA Server was unable to store this information in the registry. As a result, this summary might be generated again.

User Action:

View the result code for details about the source of the error.


Event 21163

ISA Server 2004: Event 21163

Explanation:

This event occurs when the specified VPN site-to-site network adapter is assigned an IP address that is already included in another network. This may be an indication of a spoof attack.

User Action:

  1. Verify that the VPN configuration for the remote server is defined properly.
  2. Try to reestablish the connection and ensure that the connection is with the correct remote site.


Event 21164

ISA Server 2004: Event 21164

Explanation:

This event occurs when a dial-up connection was assigned an IP address that is already included in another network. This could indicate a configuration error or a possible spoof attack.

User Action:

Check the IP address ranges of the dial-up network, and verify the configuration with the service provider (ISP).


Event 21177

ISA Server 2004: Event 21177

Explanation:

The failure may be due to a shortage of resources, probably memory resources. If it is not a memeory resource problem, it may be the result of a bad configuration or storage corruption.

User Action:

  1. View the web filter configuration to verify that it is valid.
  2. Free up memory resources by closing open applications.
  3. If the problem persists, and a backup exists, use the ISA Server Restore option to overwrite the corrupt configuration. To do this, in the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore. For details about restoring an ISA Server configuration, see ISA Server Help.
  4. If you are unable to restore the configuration, or doing so does does not solve the problem, you should reinstall ISA Server. Before reinstalling, you must first uninstall ISA Server using the remove program applet avaialable from Control Panel. When you uninstall, you lose all the configuration parameters. Reinstalling ISA Server without first uninstalling the previous copy does not resolve this problem.


Event 21195

ISA Server 2004: Event 21195

Explanation:

This event occurs when IPSecPol tool is not installed on the computer. To create a network using IPSec protocol tunneling mode on a computer running Windows 2000 Server, you must first install the IPSecPol tool.

User Action:

Install the IPSecPol tool, available from the Microsoft website. The tool must be installed to the ISA Server installation folder.


Event 21200

ISA Server 2004: Event 21200

Explanation:

This alert indicates a possible attack on your ISA Server computer. Processing the log file while under such an attack may cause the log summary generator to consume an excessive amount of memory resources. For best security practice, the amount of memory resources the log summary generator may consume is limited. The amount of memory consumed depends both on the size and the content of the log files.

User Action:

If you have a strong computer that can handle larger amounts of memory consumption, you can increase the amount of memory consumption available by configuring the registry key "NumOfEntriesMultiplicationFactor". Changing this key to 2 will allocate 2-times the amount of memory, setting it to 4 allocates 4-times the amount, and so on. This key is of the DWORD type and should be located inHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fpc\Reports.

Note: The amount of memory consumption allowed can be decreased by using the registry key "NumOfEntriesDivisionFactor".


Event 11009

ISA Server 2004: Event 11009

Event Message:

%1 failed to start. The storage of the current array %2 (or server %3) could not be accessed during %5. The error code in the event viewer indicates the source of the failure. Use the source location %6 to report the failure. If your server is a stand-alone SA Server, try to restore the ISA Server configuration, otherwise, check the connectivity to domain controller (DC), and the DNS configuration.%4%0

Explanation

If you are running ISA Server 2004 Standard Edition, this error indicates a corrupted registry key. Otherwise, the error may result from a bad connection to the domain controller or from DNS errors.

User Action

  1. If you are running Standard Edition and a backup exists, try to restore the configuration. To do this, in the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore. For details about restoring an ISA Server configuration, see ISA Server Help.
  2. Otherwise, verify connectivity with the domain controller and check the DNS configuration.