Hiya folks – I’m harrybbbb, the co-author and publisher of the Advanced Windows Small Business Server 2003 Best Practices book. I like to hold virtual book readings – today it’s on SBS 2003, known as Small Business Server 2003, post-setup stuff. Enjoy!
This section presents some advanced computer connection
tips you might consider after SBS 2003 is installed
on the server machine and you proceed with the
deployment. When it works, the Connect Computer page is wonderful, The page is actually called Network Configuration, but everyone calls it
the Connect Computer page because of how you access it. You access this page from a workstation that is attempting to join the SBS 2003 network by
typing http://servername/connectcomputer. This is so much better than having to make that “magic” disk used in prior SBS versions where you had to run around, putting said magic disk in each computer. However, when the Connect
CHAPTER1 ☛ 4 So You AdvanceWant o SetupBe an and SMB DeplymentConsultan
doesn’t work, this functionality is frustrating because it is very hard to troubleshoot. Described
below are some HandyAndy workarounds to try in the event you hit a roadblock:
Synchronize client computer time
you’ve physically connected to the local area network (LAN) segment (don’t laugh-its easy to
overlook), try this. Run the IPCONFIG command on the errant workstation and
verify it is getting an IP address from the SBS 2003 server machine. In the
perfect world of SBS 2003, this should be a 192.168.16.x IP address. If it is not,
you’ve got some basic network troubleshooting to do because obtaining an IP
address from the SBS 2003 server machine is a low- level
One way this address-leasing
problem reveals itself is in the IPCONFIG output. If you are getting
a 169.x.x.x automatic address generated natively by Windows XP Professional, then clearly the IP address is not coming from the SBS
2003 server machine and you need to resolve your network issues first. This
will be a true test of your skills as a competent SBSer.
On the other hand, if you are getting a valid IP address from the SBS 2003 server machine, run the IPCONFIG /ALL command to verify that the IP
address lease is a “rich fully featured” lease wherein the SBS 2003 server is the
only DNS entry for the client machine. We want the name resolution activity
facilitated by the SBS 2003 DNS services to be
first in line. You do not want name resolution activity initially
going to an external DNS server on the Internet because they can not resolve internal names.
SECTIONBrelsford1 1 MBSBS 2003Consuting
Add to a New Workgroup
your client connection troubleshooting, try adding the workstation to a new workgroup (do this from
Control Panel, Network). If the client computer is still not properly joining
the SBS 2003 domain, reboot the workstation two more times. I know it sounds absurd, but it has
worked a number of times. Our industry is the only place where you can do the
same thing over and over and expect different results, and no one thinks you’re
Add a User
fact is stranger than fiction. Try only adding one user to the client computer machine in the
Connect Computer phase. I have had a few experiences where I could not add
multiple users while running the Connect Computer routine, but when I tried adding only
one user, it worked fine. Also, although it shouldn’t be necessary, try running
the Connect Computer routine as the administrator, which means you have the
rights of the Domain Admins security group.
If other approaches to connect the client computer
to the SBS 2003 domain fail, there is a good chance your
workstation is too far out of time synchronization with the SBS 2003 server. Time can be a real issue on the domain. Check
the time on the server and, if necessary, set it manually to match the server
time. Do this on the workstation by double-clicking on the clock icon in the
bottom right corner of the screen. You can also
check the time service on the server and make sure it is
BEST PRACTICE: If you chose the “Router” option when you
ran the Configure Email and
Internet Connection Wizard, the time service was turned off. Why? Because some routers are
dial on demand; the time service
would cause the router to excessively dial up the ISP, resulting in a potentially expensive
connection pattern. So, if you need the time service running, perhaps as part
of your client computer
troubleshooting approach, you have to set the time service to start
automatically in the services console.
CHAPTER1 ☛4 So You AdvanceWant
o Setupan and SMB DeplymentConsultan
Speaking of time synchronization, this is as good a time as any to
mention that if you are
using ISA Server 2000 in SBS 2003, you need to open up port 123 UDP using the following
procedure so the time service can “get out” and sync with an external time
Logon to the SBS 2003 as the administrator.
Click Start, Programs, Microsoft
ISA Server, ISA Management Programs, Microsoft
ISA Server, and select ISA Management.
In the ISA Management console tree, expand Servers
and Arrays, expand servername, expand Access
Policy, and right-click on IP Packet
4. Click New, Filter. Name the
new filter Time and click Next.
5. Select Allow
packet transmission and click Next.
6. In the Filter Type
dialog box, select Custom.
Set the IP
protocol to UDP.
Set the direction to Send receive.
9. Set the Local port to Fixed port and the Port number
Set the Remote port to Fixed port and set
it to 123.
The property sheet for the time filter you just created in shown in
SECTIONBrelsford1 1 SBS 2003Consuting
Notice the procedure settings are
properly reflected on the Time Properties, Filter Type
12. Accept the default selection of Default IP
addresses for each external interface on the
ISA Server computer and click Next.
13. In the Apply this packet filter to window, select All computers and click Next.
Review the summary information and click Finish.
It is that easy.
PRACTICE: A lot of SBSers think you need to create a protocol rule to achieve the functionality presented above. You
don’t! Protocol rules
allow the client machines to get out and access the Internet. We want internal
client computers to synchronize with the SBS 2003
server machine so a protocol rule is not needed.
pter CHAPTER1 ☛ 4 So You AdvanceWant o SetupBe an and SMB DeplymentConsultan
Synchronize Logon Time
I also like
to synchronize all my workstations at login. Note that this is not necessary for Windows XP Professional
client computers anymore because internal XP technology automatically performs the time
time-synchronize non-Windows XP Professional client computers, I modify the SBS_LOGIN_SCRIPT.bat
file located in %systemroot%\ SYSVOL\ sysvol\ %domainname%\ scripts directory of the SBS 2003
server machine. This file has one line by default. Modify this line by
adding the word call to the begining of the line. and then add the following as the
call net time /set /yes.
your server is getting it’s time synchronized from someplace trustworthy, I use time.windows.com. To
accomplish this, run the following commands once at the SBS 2003 server machine
net time /setSNTP:time.windows.com net stop w32time
net start w32time
In the first line, notice that
there is a reference to time.windows.com, which is an externally verifiable time source. But you don’t have to use time.windows.com; you may use any time source you like. You can also use a list of time
servers by separating them with semicolons. For
more information on setting an authoritative time source, see
Knowledge Base Article# 216734: How to configure an
authoritative time server in Windows 2000. Don’t worry it applies to Windows 2003 also.
SBSer Steve Carmeli shared a
time problem that you might find interesting. His D-Link router was
sending out a time synchronization command that was preventing his domain from syncing. I don’t have the exact specifications
on his network, but all signs point to this as another example of why you
shouldn’t run SBS 2003 with a single network adapter card. Spend the extra few
dollars to buy a second network adapter card and save yourself some grief. (This
y SECTIONBrelsford1 ☛ SBS 2003Consuting BestDeploymentPrac
another way of saying you should make the SBS 2003 server
machine the lord of your network.) Here is Steve’s
I finally started installing SBS
this week. After I was done installing it, I couldn’t log on. Why? SBS kept telling me that the server’s clock was out of sync with the network clock! Well, while I’d only read through to Chapter 3 in the
SBS Best Practices book (I’d read through the consulting best practices book), I’d never read that, and it didn’t make any sense to me. I reinstalled twice but never really checked the time when it came up during the install. Finally, on the third install, I compared the time on the server on Windows Install with my workstation and, sure enough, they were out of sync by over an hour. Well, I adjusted the server on the Windows install, but that still didn’t fix it; I still
couldn’t log on. I rebooted and caught
the setup features of the PC before Windows started and, sure enough, the Windows install didn’t change the server’s clock. I adjusted the server’s clock, rebooted and this time I could log on.
It turns out that the clock in
my router and the clock in my server were set to different times. When I set them to the same time, then the server allowed me to log on.
But note that was with the
D-Link router, which I returned. I had nothing but problems with that router and that would be something I’d write in the knowledgebase. The Linksys router, though more expensive, and though I had to wait much longer for tech support, worked the first time.
/* Style Definitions */
mso-padding-alt:0in 5.4pt 0in 5.4pt;
Harry Brelsford, CEO at SMB Nation
MBA, MCSE, CNE, CLSE, CNP, MCP, MCT, SBSC (Microsoft Small
PS – my Small Business
Server 2008 (SBS 2008) book is now here! J
PPS – my spring show, SMB
Nation Spring 2009, is in the NYC-area on May 1-3, 2009.