Release Notes

Microsoft Internet Security and Acceleration Server 2000 with Service Pack 2 (SP2) Release Notes


1.0 Introduction
5.0 Running ISA Server on Windows Server 2003
2.0 Installation
6.0 H.323 Application Filter
3.0 Uninstalling ISA Server SP2
7.0 ISA Server SP2 Bug Fixes
4.0 Firewall Client for ISA Server SP2

1.0 Introduction

Microsoft® Internet Security and Acceleration (ISA) Server 2000 Service Pack 2 (SP2) includes all the hotfixes and security bulletins released for ISA Server 2000, including all those that were released as part of ISA Server Service Pack 1 (SP1). It also includes several additional fixes, available only as part of ISA Server SP2.

The following sections describe ISA Server SP2, also described in Microsoft Knowledge Base (KB) article 816460.

Back to Contents

2.0 Installation

We recommend that you install ISA Server SP2 on every ISA Server computer deployed in your organization, including computers running only ISA Management or the Message Screener.

Before installing ISA Server SP2, make sure the computer is disconnected from the Internet. The computer should remain disconnected from the Internet until the ISA Server SP2 installation is completed successfully. After installation, the computer can be safely connected to the Internet.

To install ISA Server SP2 on ISA Server 2000 Enterprise Edition, you must be logged on with an account that has Domain Administrator privileges.

Follow these instructions to install ISA Server SP2:

  1. Download the ISA Server SP2 self-extracting file from the Web, in the appropriate language as listed in the following table.
    Language File Name
    English ISASP2-ENU.exe
    French ISASP2-FRA.exe
    German ISASP2-DEU.exe
    Japanese ISASP2-JPN.exe
    Spanish ISASP2-ESN.exe
  2. Review the ISA Server SP2 Release Notes.
  3. Run the ISA Server SP2 executable file to begin the installation.
  4. On the Welcome screen, click Next.
  5. In the ISA Server SP2 End-User License Agreement, click I Agree to accept the licensing terms and execute the installation. Then, click Next.
  6. ISA Server will inform you if it must restart any running services. Click Continue.

Note the following installation issues:

Back to Contents

3.0 Uninstalling ISA Server SP2

To uninstall ISA Server SP2:

  1. In Control Panel, double-click Add/Remove Programs.
  2. Select Microsoft ISA Server 2000 Service Pack 2 (KB 816460) and click Change/Remove.
  3. Click Next.

Note the following issues when you uninstall ISA Server SP2:

Back to Contents

4.0 Firewall Client for ISA Server SP2

ISA Server SP2 enhances the stability of the Firewall Client software. We recommend that Firewall Client computers be updated with the ISA Server SP2 client fixes.

Firewall Client setup should be run directly from the mspclnt share. If you install from any other location (including using the Add/Remove Control Panel applet), the fixes included in ISA Server SP2 for the Firewall Client will not be installed.

To upgrade Firewall Client to include the ISA Server SP2 fixes:

  1. Install ISA Server SP2 on the ISA Server computer.
  2. On the client machine, run Setup.exe from the client share directory <\\isaserver\mspclnt\setup.exe> and choose Repair.

Back to Contents

5.0 Running ISA Server on Windows Server 2003

The following are known issues when running ISA Server on Windows Server 2003:


Back to Contents

6.0 H.323 Application Filter

For security reasons, ISA Server SP2 configures the H.323 application filter to stop listening for incoming and outgoing calls. In this way, you minimize the risk of introducing potential vulnerabilities such as those described in Microsoft Security Bulletin MS04-001 ( The updates described in the bulletin are included in ISA Server SP2.
You can configure the H.323 application filter settings after you install ISA Server SP2. Perform the following steps:

  1. In ISA Management, click Internet Security and Acceleration Server, click Servers and Arrays, click the name of the applicable array, click Extensions, and then click Application Filters.
  2. In the details pane, right-click H.323 Filter, and then click Properties.
  3. On the Call Control tab, select one or both of the following options, as applicable: Allow incoming calls and Allow outgoing calls.

Back to Contents

7.0 ISA Server SP2 Bug Fixes

ISA Server SP2 includes all ISA Server SP1 bug fixes, as well as bug fixes released subsequent to ISA Server SP1. Fixes included in ISA Server SP1 are listed in ISA Server SP1 Release Notes (

The following table lists the Microsoft Knowledge Base (KB) numbers associated with some of the fixes included in ISA Server SP2:

KB Article Description
317822 Problems with Web Browser if ISA Server 2000 Is Chained to an Upstream Web Proxy Server
318005ISA Firewall Service Cannot Start with More Than 85 IP Addresses on the External Network Adapter
319374Web Proxy Service Stops Responding
321846Incorrect Canonicalization in Rules Engine
321844ISA Server May Cause Non-Paged Pool Memory Peaks
323889Unchecked Buffer in Gopher Protocol Handler Can Run Code of Attacker's Choice
319375The CERT_CONTEXT Structure Variable Is Not Available for Web Filters in ISA
319376How to Automatically Authenticate a User Against All Trusted Domains in ISA
326116Cannot Renew DHCP Assigned IP Address on External ISA Interface
321219Server Publish May Fail on Dial-up Links
319377FIX: ISA Server Blocks Incoming Traffic Although a Valid Server Publishing Rule Exists
313318Cannot Relay Mail Through ISA Server If Authentication Is Required
324642Macintosh Clients Who Use MAPI Cannot Connect to Exchange 2000 with ISA Server
331064ISA Reports May Span Unexpected Date Range or Show Incomplete Data
319381Server-Side Playlists Do Not Work with ISA Server
331062Running ISA Server on Windows Server 2003
331065MS03-009: A Problem in the ISA Server DNS Intrusion Detection Filter May Cause Denial of Service
331066MS03-012: Flaw in Winsock Proxy Service Can Cause Denial of Service
331067ISA Reports May Contain Negative Numbers in the 'All Others' Row
331068ISA Firewall Causes Handle Leak in LSASS
331069Permit URL Path Redirection in Web Publishing Rules
331070Authentication Does Not Succeed When the User Name Contains a Space
331073Problems with HTTPS Requests When an ISA Server Computer Is Chained to an Upstream ISA Server Array
816621Message Screener Causes Handle Leak in Lsass.exe
810559Slow Responses and Failures When You Use Server Publishing UDP Protocols
810561RemoveAllProxyAuthorization Not Applied to SSL Tunneling (CONNECT) Requests
810493Update Rollup for ISA Server Services
813865Multiple Registered Web Filters in Active Directory Are Handled Incorrectly
813864Site and Content Rules Do Not Filter Based on File Name Extensions
815051The Firewall Client Does Not Support the ConnectEx and WSARecvMsg APIs
816454Proxy Service Logs an Event ID 14146 Message After Link Translation Rules Are Enabled
816456Flaw in ISA Server Error Pages Could Allow Cross-Site Scripting Attack
816458MS04-001: A vulnerability in an Internet Security and Acceleration Server 2000 H.323 filter could allow remote code execution
816459ISA Server 2000 hotfix for invalid FTP PORT command
816828"Permission Denied" Error Message When You Use Rlogin to Log On to a Server on the Internet
817829Passive Mode FTP May Break with Multiple IP Addresses on External Interface
818136Web Proxy Service May Crash When It Processes a Redirect Action
818621No Links to Navigate Up Through Directory Levels in FTP Sites When Accessed Through Internet Explorer
818821ISA Firewall Service Stops Responding on DNS Resolution
819962"414 Request-URI Too Large" Error Message from ISA Server
821098Content Cache Issues on Downstream ISA Server Computer
821935ISA Server Web Proxy Service Stops Responding When the CacheConnectSize Registry Value Is Set to 0
822241ISA Server Web Proxy Service Maintains a Connection After a Client Session Is Closed
821724Basic Credentials May Be Sent over an External HTTP Connection When SSL Is Required
822970Cannot Read ISA Server Performance Data by Using an SNMP Program
823261Web Proxy Service Returns "The User Name Was Not Allowed" Error Message After the FTP Server Returns the "User Logged In" Message
823646ISA Server Forces CERN FTP Connections to the Root Directory
823359ISA Server Web Proxy Does Not Append the Domain Name Suffix to the Credentials That Are Passed to an FTP Server
824246Response That Contains the Cache-Control: s-maxage=0 Header Does Not Expire Immediately
828044ISA Server Intermittently Stops Responding to Web Proxy Client Requests
829892You Cannot Connect to External FTP Sites by Using a WRQ Reflection FTP Client through ISA Server 2000
829893RSA SecurID Cookie Expires Frequently, and Clients Are Repeatedly Prompted to Authenticate
831140Web content does not appear, or clients receive an "HTTP 502 Proxy Error" message when they try to access external Web sites with ISA Server 2000
831531Outbound PPTP connections may disconnect after 60 seconds if the ISA Firewall Service is running
832168SecurID doesn't redirect to the requested page after successful SecurID logon

Back to Contents

Information in this document, including URL and other Internet website references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, people, and events depicted herein are fictitious and no association with any real company, organization, product, person, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© Microsoft Corporation 2004. All rights reserved.

Microsoft, Active Directory, Outlook, Windows, Windows Media, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries/regions.

Back to Contents