Windows Forum

Ask something
Discussion Locked

domain admins/ proxy server

0 helpful
7 replies

by curacao_dejavu 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

2 weeks ago I installed the update for nav and also the iislockdown tool 2.x
The result is that on a nt proxy server only members of the domain admin groups can connect via the proxy server. Normal domain users get the default dns error page in IE.

When opening outllok express they get the following error.
The host 'pop3.interneeds.net' could not be found. Please verify that you have entered the server name correctly. Account: 'pop3..........', Server: 'pop3..........
', Protocol: POP3, Port: 110, Secure(SSL): No, Socket Error: 10050, Error Number: 0x800CCC0D

Sometimes they get an error that the port 110 is already in use.
However if they are in the domain admin group they can connect fine and they don't receive those errors.
Leopold

7 replies

by budgiesoft

Launch the Service Manager for Proxy.

Select Proxy server and right-click. Open properties.

Click on Security.

In the users tab, it will assume to deny unless listed below. Add your domain to the list.

by curacao_dejavu

Sorry, No go.
I am using proxy 2 with IIS 4, I can not find those options nowhere. I have defined the users also already that may access the proxy server. It was working till I installed the iislockdown utillity. When installing I noticed it was removing the anonymous account from several sources. Undoing the lockdown didn't help.
I created a new anonymous account; same result: Only domain admins can access the internet.

by agibbs

The IIS lockdown tool is a wicked program -- designed **ONLY** to be used on WinNT/2K machines that are used as ONLY web servers.

The IIS lockdown tool automatically assumes that your machine is connected ONLY to the internet (not a corporate LAN), ONLY has one NIC card, and is ONLY a web server. The tool blocks all unused IP ports directly at the NIC card using IPSEC, buttons up security on Account Policies, and uses the most pessimistic file access policy imagineable.

It works GREAT for locking down a dedicated web server. If you run it on a machine that does anything else (like, webserver + proxy server) you're likely to have a whole mess of problems to chase down . . .

--Aaron

by dheupel

You should open port 110 on Proxy Server. A default, out-of-the-box installation of Proxy Server leaves port 110 closed. To open port 110 on Proxy Server:

1) Open the Microsoft Management Console for Proxy Server.

2) Double-click the WinSock Proxy service

3) Click the Security button on the WinSock Proxy service properties page

4) Click Add on the Packet Filters page of the resulting dialog

5) Click the Predefined Filters radio button

6) Select POP3 from the pick list
7) Click OK twice, click Apply, click OK

Hopefully you have two network interface cards in your proxy server, as that is how a true proxy server should function - one NIC set up to talk to your internal network, and one NIC set up to talk to your DMZ or connection to the outside world. Your Proxy Server machine needs this configuration for packet filtering to work properly.

Good luck!

This discussion is closed to new replies.