ISA Server 2000 Service Pack 2 Release Notes

Microsoft Internet Security and Acceleration (ISA) Server 2000 Service Pack 2 (SP2) includes all the hotfixes and security bulletins that are released for ISA Server 2000, including all the hotfixes and security bulletins that were released as part of ISA Server Service Pack 1 (SP1). ISA Server 2000 SP2 also includes several additional fixes that are available only as part of ISA Server SP2.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

Installing ISA Server 2000 SP2

Microsoft recommends that you install ISA Server SP2 on every ISA Server computer that you deploy in your organization, including on computers that are running only ISA Management or the Message Screener.

Before you install ISA Server SP2 on a computer, make sure the computer is disconnected from the Internet. The computer must remain disconnected from the Internet until the ISA Server SP2 installation is completed successfully. After installation, the computer can be safely connected to the Internet.

To install ISA Server SP2 on ISA Server 2000 Enterprise Edition, you must be logged on with an account that has domain administrator credentials.

To install ISA Server SP2, follow these steps:

1. Download the ISA Server SP2 self-extracting file from the Web. Use the file that matches the appropriate language, as described in the following table:

   Language	File Name
   English	ISASP2-ENU.exe
   French	ISASP2-FRA.exe
   German	ISASP2-DEU.exe
   Japanese	ISASP2-JPN.exe
   Spanish	ISASP2-ESN.exe

2. Review the ISA Server SP2 Release Notes.
3. To start the installation, run the ISA Server SP2 executable file.
4. On the Welcome screen, click Next.
5. In the ISA Server SP2 End-User License Agreement, click I Agree to accept the licensing terms and to run the installation. Click Next.
6. ISA Server will inform you if it must restart any running services. Click Continue.

Note

• ISA Server SP2 features a new installation tool.
• The installation process updates relevant files and saves the original files in a folder that is named $ISA2000UninstallServicePack2$. This folder is located in the Microsoft Windows folder.
• You cannot install ISA Server SP2 on the evaluation version of ISA Server.
• You must reinstall ISA Server SP2 after you do any one of the following tasks:
  • Add or remove ISA Server components.
  • Install ISA Server Feature Pack 1.
  • Change the ISA Server installation mode.
• When you install ISA Server SP2 on a computer that is running Microsoft Windows Server 2003, and you have not previously installed ISA Server SP1, you must manually restart the ISA Server services after you install ISA Server SP2.
• If you quit the ISA Server SP2 installation, you must restart the computer before you start another ISA Server SP2 installation.
• You must remove ISA Server updates in the reverse order that they were installed in. Otherwise, the removal process will fail.
• When you install ISA Server SP2 on a computer that is running Microsoft Windows 2000 Server, you must first install Windows 2000 Server Service Pack 4 (SP4).

Removing ISA Server SP2

To remove ISA Server SP2, follow these steps:

1. In Control Panel, double-click Add/Remove Programs.
2. Click Microsoft ISA Server 2000 Service Pack 2 (KB 816460), and then click Change/Remove.
3. Click Next.

Note

• If you remove ISA Server SP2 from a computer that is running Windows Server 2003, make sure to install ISA Server SP1 and ISA Server hotfix 255. Hotfix 255 is described in the following Microsoft Knowledge Base (KB) article:
  331062 Running ISA Server on Windows Server 2003
• The 2r.htm and Pathmappingeditor.hta files are not deleted when you remove ISA Server SP2.
• When you remove ISA Server SP2, a warning message indicates that some applications may not work correctly after you remove ISA Server SP2. Ignore this message.

Upgrading Firewall Client for ISA Server SP2

ISA Server SP2 enhances the stability of the Firewall Client software. Microsoft recommends that Firewall Client computers be updated with the ISA Server SP2 client hotfixes.

The Firewall Client Setup program must be run directly from the mspclnt share. If you install the Firewall Client from any other location, the hotfixes that are included in ISA Server SP2 for the Firewall Client will not be installed. (This behavior also occurs if you install Firewall Client by using Add or Remove Programs in Control Panel.)

To upgrade Firewall Client with the ISA Server SP2 hotfixes, follow these steps:

1. Install ISA Server SP2 on the ISA Server computer.
2. On the client computer, run the Setup.exe program from the client share folder, and then click Repair. The client share folder is \\ISA_Server\mspclnt\setup.exe, where ISA_Server is the server name of the ISA Server.

Running ISA Server 2000 on Windows Server 2003

The following issues apply when you run ISA Server 2000 on Windows Server 2003:

• ISA Server can be installed on computers that are running Windows Server 2003. However, the packet filter extension driver (Mspfltex.sys) in the release version of ISA Server is incompatible with computers that are running Windows Server 2003. The driver does not load when you install ISA Server on a Windows Server 2003-based computer. Because ISA Server SP1 includes a compatibility fix for the driver, you may ignore all error messages that are related to this issue and that are displayed during ISA Server installation. After ISA Server installation, some services will not start. ISA Server SP1 or ISA Server SP2 solves the issue with this driver.
• You must install ISA Server SP1 or ISA Server SP2 before you upgrade an ISA Server computer that is running Windows 2000 Server or Windows 2000 Advanced Server to Windows Server 2003.
• ISA Server 120-Day Evaluation is supported only on Windows 2000 Advanced Server. ISA Server 120-Day Evaluation must be removed from any computer that is running Windows 2000 Server or Windows 2000 Advanced Server before you upgrade to Windows Server 2003.
• If you plan to run ISA Server on computers that are running Windows Server 2003, make sure that the Internet Connection Firewall (ICF) is disabled when you install ISA Server. The Firewall service cannot start if ICF is enabled. If this condition occurs, the Firewall service will generate an event that indicates that the Firewall service will not start if the ICF is enabled. Follow the instructions in the event log to start the Firewall service.
• Performance alerts in the ISA Server Performance Monitor snap-in must run under an account that is a member of the Administrators group. By default, Windows Server 2003 performance alerts are configured to run under the Network Service account. The Network Service account lacks sufficient credentials. To resolve this issue, follow these steps:
  1. Run the ISA Server Performance Monitor.
  2. Expand Performance Logs and Alerts, and then click Alerts.
  3. In the right pane, right-click an alert, and then click Properties.
  4. In the Properties dialog box, click the General tab.
  5. In the Run As text box, type the user name of an account that belongs to the Administrators group on the computer, and then click the Set Password button.
  6. In the Set Password dialog box, type the password, and then click OK.
  7. In the Properties dialog box, click OK.

Note

• ISA Server SP2 includes the updates that are mentioned on the following Microsoft Web site:
  http://www.microsoft.com/downloads/details.aspx?FamilyID=77d89f87-5205-4779-b1ab-fc338283b2d9&DisplayLang=en
  If you install ISA Server SP2, you do not have to install ISA Server hotfix 255. Hotfix 255 is described in the following Microsoft Knowledge Base (KB) article:
  331062 Running ISA Server on Windows Server 2003

Configuring H.323 application filter settings

For security reasons, ISA Server SP2 configures the H.323 application filter to stop listening for incoming and outgoing calls. Therefore, ISA Server SP2 minimizes the risk of introducing potential vulnerabilities, such as those described in the following Microsoft Security Bulletin: The updates that are described in the bulletin are included in ISA Server SP2.

To configure the H.323 application filter settings after you install ISA Server SP2, follow these steps:

1. In ISA Management, click Internet Security and Acceleration Server, click Servers and Arrays, click the name of the applicable array, click Extensions, and then click Application Filters.
2. In the details pane, right-click H.323 Filter, and then click Properties.
3. On the Call Control tab, click to select one or both of the following options:
   • Allow incoming calls
   • Allow outgoing calls

ISA Server SP2 hotfixes

ISA Server SP2 includes all ISA Server SP1 hotfixes and also hotfixes that were released after the release of ISA Server SP1. Hotfixes that are included in ISA Server SP1 are listed in ISA Server SP1 Release Notes

The following table lists the Microsoft Knowledge Base (KB) articles that are associated with some of the hotfixes that are included in ISA Server SP2: