nimda protection on Terminal Server

[nickt]

we currently have a couple of nt4 TSE servers running web services (maybe a bad idea?). we appear to have escaped infection from the nimda virus so far, however, I'm worried because I've been unable to apply any of the MS patches (q301625 was my favourite) because they will not install. Instead I get a message saying something like "This Hotfix can not be installed on Terminal Server.".
Has anyone managed to install this patch?
Alternatively, does anyone know what the patch does and is there a way to accomplish the same results manually?
Or are we going to have to change our web servers to plain NT4?
Why does MS not provide patches that work with TSE when the TSE install process gives you the option of installing IIS?!

 

[ramos777]

I just posted another post just like this one not being a good forum reader prior to posting. Hopefully someone will help us out. This is typical MS B.S!!!! I ran into this w/code red and cant seem to find my notes on what files to change.

 

[CitrixEngineer]

It's widely considered that running anything other than Terminal Services (apart from the essential services) is a bad idea, because of the resource drain on the T/S sessions.

I would certainly recommend having a separate machine as a proxy (I'd recommend Apache over IIS any day for security). Terminal server is, as you're finding out, somewhat unsupported by Microsoft. :-(

The obvious bonus of running Apache is that you only need an old 486, and the licensing is free. The downside is that it will take you a while to get it up and running the way you want it to.

Whatever you decide, keep IIS off Terminal Server.

I hope this helps

 

[nickt]

thanks for that. we've just had some similar news from MS to the effect that they support IIS3 on TSE but not IIS4.
marvellous!
I think we've got round it by copying the idq.dll from a patched nt4 server, removing the relevant script mappings and making sure the virus scanning s/w is up-to-date.
Also, I think we'll be moving the web to a non-TSE server soon!
We might have problems using Apache because it doesn't fit the company standard (sic.), and I've no clue where to start with it!