Lost Server Access

[Nightcheck]

Hi -

Up until a week or so ago, I could log on to our SBS2003 Server remotely via Remote Web Workplace. All of a sudden -
something changed.
I can still log on to our Remote Web Workplace and then log on to one of the client workstations with no problem -
however, I no longer can access the Server. No error message or any indication of what the problem is.

When I am on our Remote Web workplace - The options I have are 1) Connect to the Server 2) Connect to the Client Desktops, 3) View Performance reports, 4) View Sever usage

No problems with 2-4 -

I then select #1 "Connect to the Server" - A new screen appears with our Server name - I click "connect" - and then nothing,

I have had no problems for over a year. The only incident that coincided with this was - about a week or two ago, there a was critical security update for SBS 2003 for some new worm or virus. I downloaded and installed the update (remotely) - and rebooted. Everything went fine and the staff was able to hop back on the network - but.... ever since then... I lost the ability to lo on directly to the Server - but can still log on to any workstation.

I'm really stumped...

Thanks so much in advance for any thoughts on what the problem might be.
Rick

 

[burtsbees]

Being unfamiliar with that app, do you connect to a VPN, or just open a port on the firewall/router (like for RDC, udp 3389...or maybe it's a tcp port...). Since you seem to be able to connect, but just not to the server, I would definitely say it is the update that is preventing the connection. What worm is this update protecting you from? Truthfully, I would set up a VPN and then connect---it's the most secure way, and you would bypass the problem.

Burt

 

[Nightcheck]

Hi Burt -

The patch was dated Oct 22 - Security Update for Windows Server 2003 (KB958644) with the following description:

"Microsoft has released an out-of-band patch to fix an extremely critical worm hole that exposes Windows users to remote code execution attacks.

The emergency update comes just one week after the regularly scheduled Patch Tuesday and follows the discovery of a targeted zero-day attack, Microsoft said in an advisory. The vulnerability is rated “critical” on Windows 2000, Windows XP and Windows Server 2003."
------------------------------------------------------
You are correct that I should be using a VPN (our IT guy - not on site as we are a small company- will be setting me up soon.) I have been connecting by typing in our Company's
remote address i.e.

https://xyzcompany.xyzcompany.com/remote/

which takes me our Remote Web Workplace, where I logon with my user id/password, and then select if I want to logon to the Server or a workstation.

I sent an e-mail to this IT guy and asked him to try and logon to the server (he has always been able to do so) to rule out the possibility that it might be something on my end. He responded saying he could not logon either (he uses the Remote Desktop Connection)with the IP address he has always used. His actual response is as follows:
"I tried RDP into the server like I used to be able to do, using IP address xx.xxx.xxx.xxx and couldn’t connect.

I’m not sure if your IP address changed or if someone blocked something on your router/ firewall or windows server. So to answer your question - I can’t connect as well. Sorry…
--------------------------------------------
We certainly did not change our IP address and if I were a the Sever I could find out for sure (Can I find out if it has been changed remotely as the office it quite a drive).
As to the second part of his response - no one (unless a hacker) could or would have blocked anything on our router/firewall - if for no other reason 1) I wouldn't have a clue how to do so, but even more importantly - I was able to logon to the Server - download/Install the update - reboot - and the 4 workstations can use the network, Exchange etc. - but after that update - I could get to the Remote Web Workplace to bogon to any of the workstations - but not the Server - so I would definitely agree with your assessment that the update is the culprit -
Not being an IT guy (I handle the Finance.Accounting) and though am pretty savvy on regular PC's (Windows XP, Vista, etc.) - I am extremely deficient in my knowledge of Servers, Networks, etc. With this in mind - may I ask what suggestions you could offer?
I really appreciate any assistance you can provide.
Thanks so much in advance..

Rick

 

[burtsbees]

I can almost guarantee the update blocked access to this server. That's how it blocks the worm---by blocking what you guys use to connect. The server does not seem to accept ANY remote sessions. Remove the update and see what happens. I would suggest to get rolling on implementing that VPN a .lot faster now...

Burt