To resolve these problems, use either of the following
methods:
- Roll back the Security Configuration Wizard
policy.
- Manually change the list on the Windows Firewall
Exceptions tab.
Method 1: Roll back the Security Configuration Wizard policy
The Security Configuration Wizard includes a feature to roll back
the last policy that was applied to the server. To roll back the Security
Configuration Wizard policy, follow these steps:
- Click Start, point to
Programs, point to Administrative Tools, and
then click Security Configuration Wizard.
- On the Welcome page, click Next.
- On the Configuration Action page, click Roll back
the last applied security policy, and then click
Next.
- On the Select Server page, type the name of the server or
select the server on which you applied the security policy that you want to
roll back.
Note By default, the Select Server page is already populated with the
name of the local server. - Click Next.
- On the Rollback Security Configuration page, click
Next.
- On the Rolling Back Security Configuration page, confirm
that the policy roll back in complete, and then click Next.
- On the Completing the Security Configuration Wizard page,
click Finish.
- Restart the server on which the policy was rolled
back.
After the server restarts, the services are in the same state as
they were before the last Security Configuration Wizard policy was applied.
Method 2: Manually change the list on the Windows Firewall Exceptions tab
The
Exceptions tab of the Windows Firewall tool
lists all the programs and the ports that are defined as exempt from Windows
Firewall port blocking. When Exchange 2003 services are added to the
Exceptions tab, the location of the service executable file
(.exe) is listed. If a Security Configuration Wizard policy is applied that
defines a path of a service .exe file that is not a valid path on the local
server, this path is listed in the
Programs and Services
section of
Exceptions tab. For example, you might see the
following path in the
Programs and Services section of
Exceptions tab:
C:\Program Files\Exchsrvr\Bin\Mad.exe
This path is the default installation path of the System
Attendant service. This path is not valid if your Exchange 2003 computer is
installed in C:\Exchsrvr or in another location.
If the
Programs and Services section of
Exceptions
tab lists a path of a service .exe file that is not valid, follow these steps:
- Click Start, point to
Settings, and then click Control
Panel.
- Double-click Windows Firewall.
- Click the Exceptions tab.
- Under Programs and Services, select the
path that is not valid, and then click Delete.
- Click Yes when you are prompted to delete
the path from the Exceptions tab.
- On the Exceptions tab, click Add
Program.
- Click Browse, locate the .exe file for the
service that you are trying to add to the Exceptions tab, and
then click Open.
For example, locate the correct
path of Mad.exe, and then click Open. - Click OK.
- Review the Exceptions tab.
The
name of the service that you added in step 7 is listed, but it does not appear
with the full path of the .exe file. To verify the path, select the name of the
service, and then click Edit. The full path of the .exe file
of the service is displayed.
Perform this procedure for any other Exchange 2003 services that
appear on the
Exceptions tab as a path that is not a valid
path. Frequently, one of the following services will be in the list:
- EMicrosoft Exchange MTA Stacks (Emsmta.exe)
- Microsoft Exchange Information Store (Store.exe)
- Microsoft Exchange System Attendant (Mad.exe)
- Microsoft Exchange Site Replication Service
(Srsmain.exe)