New ISA Server acting as a master browser

I have two windows 2003 servers that are domain controllers (names: SERVER1
and SERVER2). I installed a third server with ISA 2004 (name: PROXY) that it
is only a member of this domain.

The problems is that I'm getting the following errors in the event log:
"The master browser has received a server announcement from the computer
PROXY that believes that it is the master browser for the domain on
transport NetBT_Tcpip_{ED8A954B-25B5-4A39-8BF. The master browser is
stopping or an election is being forced"

Is this normal? Can PROXY act as a master althought it's not a domain
controller?

Thanks.

How do you have DNS & WINS configured on the ISA?


--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/downlo...7/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/pro...isaserver.mspx
-----------------------------------------------------


"Gaspar" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> I have two windows 2003 servers that are domain controllers (names:
SERVER1
> and SERVER2). I installed a third server with ISA 2004 (name: PROXY) that
it
> is only a member of this domain.
>
> The problems is that I'm getting the following errors in the event log:
> "The master browser has received a server announcement from the computer
> PROXY that believes that it is the master browser for the domain on
> transport NetBT_Tcpip_{ED8A954B-25B5-4A39-8BF. The master browser is
> stopping or an election is being forced"
>
> Is this normal? Can PROXY act as a master althought it's not a domain
> controller?
>
> Thanks.
>
>

"Gaspar" <(E-Mail Removed)> ha scritto nel messaggio
news:%(E-Mail Removed)...

>I have two windows 2003 servers that are domain controllers (names: SERVER1
>and SERVER2). I installed a third server with ISA 2004 (name: PROXY) that
>it is only a member of this domain.
>
> The problems is that I'm getting the following errors in the event log:
> "The master browser has received a server announcement from the computer
> PROXY that believes that it is the master browser for the domain on
> transport NetBT_Tcpip_{ED8A954B-25B5-4A39-8BF. The master browser is
> stopping or an election is being forced"
>
> Is this normal? Can PROXY act as a master althought it's not a domain
> controller?

Every computer which has NetBIOS enabled can partecipate in the master
browser election; that role has nothing to do with being a DC.

But ISA should be blocking all traffic (including NetBIOS), unless you
enabled it in the system policy...


Massimo

> How do you have DNS & WINS configured on the ISA?
I don't use WINS.
DNS in LAN adapter points to 192.168.0.1 (SERVER1 ip), and
192.168.0.2(SERVER2 ip) as secondary.
Both DNS servers in SERVER1 and SERVER2 use ISP DNS as forwarders. Also
PROXY is configured as default gateway.

Thanks

>
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
> -----------------------------------------------------
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/IS...cessRules.html
>
> Troubleshooting Client Authentication on Access Rules in ISA Server 2004
> http://download.microsoft.com/downlo...7/ts_rules.doc
>
> Microsoft Internet Security & Acceleration Server: Guidance
> http://www.microsoft.com/isaserver/t...dance/2004.asp
> http://www.microsoft.com/isaserver/t...dance/2000.asp
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/partners/default.asp
>
> Deployment Guidelines for ISA Server 2004 Enterprise Edition
> http://www.microsoft.com/technet/pro...isaserver.mspx
> -----------------------------------------------------
>
>
> "Gaspar" <(E-Mail Removed)> wrote in message
> news:%(E-Mail Removed)...
>> I have two windows 2003 servers that are domain controllers (names:
> SERVER1
>> and SERVER2). I installed a third server with ISA 2004 (name: PROXY) that
> it
>> is only a member of this domain.
>>
>> The problems is that I'm getting the following errors in the event log:
>> "The master browser has received a server announcement from the computer
>> PROXY that believes that it is the master browser for the domain on
>> transport NetBT_Tcpip_{ED8A954B-25B5-4A39-8BF. The master browser is
>> stopping or an election is being forced"
>>
>> Is this normal? Can PROXY act as a master althought it's not a domain
>> controller?
>>
>> Thanks.
>>
>>
>
>

> Every computer which has NetBIOS enabled can partecipate in the master
> browser election; that role has nothing to do with being a DC.
>
> But ISA should be blocking all traffic (including NetBIOS), unless you
> enabled it in the system policy...

So, which is the right settings / access rules that I have to configure?
Thanks.

disable Computer Browser Service on the ISA2004 box.



"Gaspar" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
>I have two windows 2003 servers that are domain controllers (names: SERVER1
>and SERVER2). I installed a third server with ISA 2004 (name: PROXY) that
>it is only a member of this domain.
>
> The problems is that I'm getting the following errors in the event log:
> "The master browser has received a server announcement from the computer
> PROXY that believes that it is the master browser for the domain on
> transport NetBT_Tcpip_{ED8A954B-25B5-4A39-8BF. The master browser is
> stopping or an election is being forced"
>
> Is this normal? Can PROXY act as a master althought it's not a domain
> controller?
>
> Thanks.
>

"Gaspar" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> > How do you have DNS & WINS configured on the ISA?
> I don't use WINS.
> DNS in LAN adapter points to 192.168.0.1 (SERVER1 ip), and
> 192.168.0.2(SERVER2 ip) as secondary.
> Both DNS servers in SERVER1 and SERVER2 use ISP DNS as forwarders. Also
> PROXY is configured as default gateway.

1. Add WINS. You will be glad you did and it will solve problems that you
don't even know you have yet.

2. Create and anonymous Access Rule to allow all traffic between the
Internal and Local Host. Add both Internal & LocalHost to both the "From"
and the "To". If you can't trust your Internal Network to access the ISA
box who can you trust?

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/downlo...7/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/pro...isaserver.mspx
-----------------------------------------------------

"Phillip Windell" <@.> ha scritto nel messaggio
news:up$(E-Mail Removed)...

> 1. Add WINS. You will be glad you did and it will solve problems that you
> don't even know you have yet.

Why should you use WINS in a full Active Directory domain? Wasn't it
supposed to be replaced by DNS?


Massimo

> Why should you use WINS in a full Active Directory domain? Wasn't it
> supposed to be replaced by DNS?

The answer is too complex to be given here... Basically it has to do with
the design of the browser service, browse lists, master browsers etc. If you
don't use browsing lists in general you can skip WINS altogether, but if you
want/need them you will eventually run into WINS sooner or later.

See the following article from the MS KB:

Troubleshooting browser Event ID 8021 and 8032 on master browsers
http://support.microsoft.com/kb/135404/en-us

Here's a quote:

[start quote]

Name resolution infrastructure

Name resolution among all browsers is very important. Therefore, make sure
that you establish a robust name resolution infrastructure with WINS. For
browsing to work correctly, name resolution must be functional. We strongly
recommend that all WINS servers point to themselves as Primary and Secondary
WINS in the TCP/IP configuration. (more stuff here)

[end quote]

Now, scroll down to the bottom of article and look at the "Applies To"
section. Surprise, surprise: Windows 2003, 2000 and virtually every other
Microsoft O/S that can act as a master browser is listed there.

Virgil

"henrik" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> disable Computer Browser Service on the ISA2004 box.

LOL, you beat me on this one. I was gonna say the same thing. That IS the
proper way to solve this, considering the ISA machine should not be relied
on to provide browsing list services.

Virgil