Remote desktop failing after service pack 1...

[petrosky]

Hi,

Remote desktop to our server was working flawlessly until I deployed SP1. Now I get the "Client could not connect to the remote computer" error.

I can Rdesk out to external clients fine and other XP boxes in the office.

The server runs ISA but it seems configured to allow RDP in and out on 3389...but the server doesn't seem to be listening on 3389 as I get an error when I telnet to the port. "Could not open the connection to the host, on port 3389: Connect failed"

Also, the RPC service on the server has no option to stop, start or restart they are all greyed out.

Does anyone have any ideas for me?

Peter.

Remember- It's nice to be important,
but it's important to be nice

 

[monsterjta]

SP1 comes bundled with Windows Firewall, and I believe automatically turns it on unless you specify otherwise. Turn off the Windows Firewall.

Hope This Helps,

Good Luck!

 

[petrosky]

Hi,

Thanks for the quick reply.

In the control panel...windows firewall, I get "Windows firewall cannot run because another program or service is running that might use the network address translation component (ipnat.sys)"

A quick google reveals quite a few hits...I have tried disabling RRAS service and still get the message.

I have the feeling that IAS is blocking the port but this is the first environment where I have seen IAS.

Peter.

Remember- It's nice to be important,
but it's important to be nice

 

[monsterjta]

What does the log/monitor say in ISA when you attempt to connect via RDP?

Hope This Helps,

Good Luck!

 

[Stevehewitt]

Try the following command lines:

netstat -an |find /i "listening"

or

netstat -an |find /i "established"

List open ports that are listening / ports with relevant processes attached.

Good Luck,




Steve.

"They have the internet on computers now!" - Homer Simpson

 

[petrosky]

Hi,

The server is definitely not Listening or Established on 3389.

The ISA logs show no port blocks that I can see...

Further googling on this problem leads me back to my own post here!

Can anyone suggest anything else apart from removing the service pack?


Remember- It's nice to be important,
but it's important to be nice

 

[petrosky]

Just an update...

I have used Portreporter from Microsoft.

I find that the only reference to Port 3389 is established
to an external IP address!
The IP address is not pingable at the moment but a whois does resolve

Am I being hacked??? here is the message.

06/12/19,16:26:25,TCP,32758,192.168.1.253,3389,203.100.229.8,8104,mstsc.exe,<Domain\UserName>

I have disabled remote connections for now but am obviously concerned.


Remember- It's nice to be important,
but it's important to be nice

 

[petrosky]

Please disregard my last post....

That was my own test connection FROM the server to the outside world...

Of course I also tried to connect to the server...but there is not other listings for port 3389...

Time for another coffee.

Peter.

Remember- It's nice to be important,
but it's important to be nice