The Microsoft Firewall service does not start after an ISA Server 2004 SP3 installation fails

You have a computer that is running Microsoft Internet Security and Acceleration (ISA) Server 2004. You install ISA Server 2004 Service Pack 3 (SP3) on this computer either manually or from the Microsoft Update Web site.

If the ISA Server 2004 SP3 installation fails, a rollback operation is performed to restore the ISA Server components to their pre-update versions. However, after the rollback operation is complete, the Microsoft Firewall service does not start. Additionally, the following error messages are logged in the Application log:

Error message 1Error message 2

This issue occurs if the rollback operation is not successful and if the computer contains ISA Server 2004 components from the pre-update version and from ISA Server 2004 SP3.

The most common installation and rollback failures occur in the following scenario:

• You have the ISA Server Management Microsoft Management Console (MMC) snap-in open in a separate Remote Desktop Protocol (RDP) session.
• You use an unattended installation to install ISA Server 2004 SP3. For example, ISA Server 2004 SP3 is installed from the Microsoft Update Web site.

The Microsoft Update installer cannot prompt a user to close the ISA Server Management MMC snap-in. Therefore, the installation fails. Then, it starts a rollback of all changes to this point. If the rollback also fails, the computer will contain ISA Server 2004 components from the pre-update version and from ISA Server 2004 SP3.

To work around this issue, use one of the following methods.

Method 1: Reinstall ISA Server 2004 SP3

1. Download ISA Server 2004 SP3.
   
   For more information about how to download ISA 2004 SP3, visit the following Microsoft Web site:
   http://technet.microsoft.com/en-us/forefront/edgesecurity/bb734854.aspx
2. Exit all ISA Server utilities, and then close all ISA Server user interface components. For example, close the ISA Server Management Microsoft Management Console (MMC) snap-in.
3. Exit all other RDP sessions on the server. To do this, follow these steps:
   1. Open Task Manager, and then click the User tab.
   2. Right-click a user account that does not represent your current connection, and then click Log Off.
   3. When you are prompted to verify the action, click Yes.
   4. Repeat steps 3b through 3c for each RDP connection.
4. At a command prompt, type the following command to reinstall ISA Server 2004 SP3, and then press ENTER:
   msiexec /p Full_Path_To_SP3_Package REINSTALL=all REINSTALLMODE=omus /l*v c:\sp3.log

Note We recommend that you reinstall ISA Server 2004 SP3 in repair mode.

Method 2: Reregister the ISA Server administration component

1. Click Start, click Run, type cmd, and then press ENTER.
2. At the command prompt, type the following commands. Press ENTER after each command.
   cd /d �%programfiles%\microsoft isa server�
   regsvr32 wspadmin.dll
3. When you receive the "DllRegisterServer in wspadmin.dll succeeded" message, click OK.
4. At the command prompt, type the following commands. Press ENTER after each command.
   md VPN\Netsh
   net start fwsrv