Thank you sir for your suggestions -----Original Message----- From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Wednesday, June 29, 2005 9:59 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: remote desktop after sp1 http://www.ISAserver.org Those "Closed Connection" with 0x80074e21 are stating that either the RDP client or server closed the connection "rudely" -i.e., with a RST instead of a FIN. Get a capture of the process at both ends of ISA. Check the event logs at the client and server for RDP issues. ------------------------------------------------------- Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! ------------------------------------------------------- -----Original Message----- From: Ara [mailto:ara@xxxxxxxxxxxxx] Sent: Wednesday, June 29, 2005 09:55 To: [ISAserver.org Discussion List] Subject: [isalist] RE: remote desktop after sp1 http://www.ISAserver.org Tom, Sorry wrong logs. Check this Original Client IP Client Agent Authenticated Client Service Server Name Referring Server Destination Host Name Transport MIME Type Object Source Source Proxy Destination Proxy Bidirectional Client Host Name Filter Information Network Interface Raw IP Header Raw Payload Source Port Processing Time Bytes Sent Bytes Received Result Code HTTP Status Code Cache Information Error Information Log Record Type Log Time Destination IP Destination Port Protocol Action Rule Client IP Client Username Source Network Destination Network HTTP Method URL 192.168.0.172 ISA - TCP - - 1162 0 0 0 0x0 0x0 0x0 Firewall 6/29/2005 9:53:31 AM 192.168.0.254 3389 RDP (Terminal Services) Initiated Connection Allow remote management from selected computers using Terminal Server 192.168.0.172 Internal Local Host - - 192.168.0.172 ISA - TCP - - 1162 0 52 40 0x80074e21 0x0 0x0 Firewall 6/29/2005 9:53:31 AM 192.168.0.254 3389 RDP (Terminal Services) Closed Connection Allow remote management from selected computers using Terminal Server 192.168.0.172 Internal Local Host - - 192.168.0.172 ISA - TCP - - 1162 0 0 0 0x0 0x0 0x0 Firewall 6/29/2005 9:53:31 AM 192.168.0.254 3389 RDP (Terminal Services) Initiated Connection Allow remote management from selected computers using Terminal Server 192.168.0.172 Internal Local Host - - 192.168.0.172 ISA - TCP - - 1162 0 52 40 0x80074e21 0x0 0x0 Firewall 6/29/2005 9:53:31 AM 192.168.0.254 3389 RDP (Terminal Services) Closed Connection Allow remote management from selected computers using Terminal Server 192.168.0.172 Internal Local Host - - 192.168.0.172 ISA - TCP - - 1162 0 0 0 0x0 0x0 0x0 Firewall 6/29/2005 9:53:31 AM 192.168.0.254 3389 RDP (Terminal Services) Initiated Connection Allow remote management from selected computers using Terminal Server 192.168.0.172 Internal Local Host - - 192.168.0.172 ISA - TCP - - 1162 0 52 40 0x80074e21 0x0 0x0 Firewall 6/29/2005 9:53:31 AM 192.168.0.254 3389 RDP (Terminal Services) Closed Connection Allow remote management from selected computers using Terminal Server 192.168.0.172 Internal Local Host - - -----Original Message----- From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx] Sent: Wednesday, June 29, 2005 9:47 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: rpc filter after sp1 http://www.ISAserver.org Hi Ara, Try deleting the RDP listener and recreating it. Tom www.isaserver.org/shinder Tom and Deb Shinder's Configuring ISA Server 2004 http://tinyurl.com/3xqb7 MVP -- ISA Firewalls Attention: This message, including any attachment(s), is intended only for the use of the individual(s) to which it is addressed and may contain information that is privileged or confidential. Any other distribution, copying or disclosure is strictly prohibited. If you are not the intended recipient or have received this message in error, please notify us immediately by reply e-mail and permanently delete this message including any attachment(s), without reading it or making a copy. http://www.bossaudio.com ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx All mail to and from this domain is GFI-scanned. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: ara@xxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx