Re: Problem with domain trust after W2003SP1 upgrade

From: Christian Stinakovits via WinServerKB.com (forum_at_WinServerKB.com)
Date: 04/15/05 

Date: Fri, 15 Apr 2005 16:26:54 GMT

Currently I have a Case running with MS about this .. read on here:
_____________________________________________________________________

Trust verify in Domains and Trusts MMC snapin or NLTEST.EXE fail,

Error message: ?The remote procedure call failed and did not execute?

Cause

Win2k3 SP1 added a new RPC element called Bind Time Feature Negotiation.
The new element provides a method for clients and servers to discover and
negotiate their capabilities during bind time as opposed to the first
request after a bind.

Because this is a new RPC element, it may not be recognized by firewalls,
routers or ISA Server 200x. If the traffic is not recognized, the firewall,
router or ISA Server will drop the new RPC bind request frames. As a result
any operation that requires an RPC bind may now fail with RPC errors. Some
RPC dependent operations that may fail are:

Resolution

ISA 2000 - Apply SP2 for ISA 2000
ISA 2004 - Apply SP1 for ISA 2004

Third Party Firewall or Router - Investigate if the device support Bind
Time Feature Negtiation.

After Installing Service Pack 1 on 2003, Domain trust fails. Test show a
failure in RPC traffic.

Resolution

This is because Windows 2003 SP1 includes a new feature called "Bind Time
Feature negotiation" ISA does not support this feature. This is Fixed In
ISA 2004 SP1. Installing this service pack will allow the RPC traffic to
work.

Other workarounds.

1. Use IPSEC between DCs,
2. Disable "Enforce strict RPC compliance. Instructions below:

In the console tree of ISA Server Management, click Firewall Policy.

Where?

Microsoft ISA Server 2004

Server_Name
Firewall Policy
In the details pane, click any access rule that applies to remote procedure
call (RPC) traffic.
On the Tasks tab, click Edit Selected Rule.
On the Protocols tab (for an access rule), click Filtering, and then click
Configure RPC protocol.
On the Protocol tab, select Enforce strict RPC compliance, if no RPC
protocols should be allowed.
__________________________________________________________________

Another solution that also worked is to uninstall SP1.

bye

Chris

Relevant Pages

  • Re: Problem with domain trust after W2003SP1 upgrade
    ... > request after a bind. ... > routers or ISA Server 200x. ... > router or ISA Server will drop the new RPC bind request frames. ... > Third Party Firewall or Router - Investigate if the device support Bind ...
    (microsoft.public.windows.server.security)
  • Re: RPC call failures
    ... Thanks Wes, ... confirms an AD bind fail with an rpc call fail rc. ... I first noticed this when I opened the DHCP mmc. ...
    (microsoft.public.windows.server.sbs)
  • Re: Vista and Outlook 2003 not connecting to Exchange on SBS2003
    ... Drop RPC frames on the network ... Please modify the registry as the following on Vista machine: ... Server 2003 Service Pack 1-based or Windows Vista-based computers ... Service Pack 1 is installed on a computer that is running ISA Server 2004 ...
    (microsoft.public.windows.server.sbs)
  • Re: OWA/RPC over HTTP troubleshooting tips
    ... configured ISA Server to publish RPC over HTTP ... Does the issue only occur on the external users who attempt to access OWA ... confirm if you have configured ISA Server to publish RPC over HTTP. ...
    (microsoft.public.isa)
  • RE: ISA 2004 - RPC Filter
    ... If you disable the RPC filter, ... Server's RPC filter and such RPC traffic fails through ISA Server. ... This newsgroup only focuses on SBS technical issues. ... you may want to contact Microsoft CSS directly. ...
    (microsoft.public.windows.server.sbs)
Loading