After you run the Security Configuration Wizard in Windows Server 2003 SP1, Outlook users may not be able to connect to their accounts (896742)

RESOLUTION

To resolve these problems, use either of the following methods:

• Roll back the Security Configuration Wizard policy.
• Manually change the list on the Windows Firewall Exceptions tab.

Method 1: Roll back the Security Configuration Wizard policy

The Security Configuration Wizard includes a feature to roll back the last policy that was applied to the server. To roll back the Security Configuration Wizard policy, follow these steps:

1. Click Start, point to Programs, point to Administrative Tools, and then click Security Configuration Wizard.
2. On the Welcome page, click Next.
3. On the Configuration Action page, click Roll back the last applied security policy, and then click Next.
4. On the Select Server page, type the name of the server or select the server on which you applied the security policy that you want to roll back.
   
   Note By default, the Select Server page is already populated with the name of the local server.
5. Click Next.
6. On the Rollback Security Configuration page, click Next.
7. On the Rolling Back Security Configuration page, confirm that the policy roll back in complete, and then click Next.
8. On the Completing the Security Configuration Wizard page, click Finish.
9. Restart the server on which the policy was rolled back.

After the server restarts, the services are in the same state as they were before the last Security Configuration Wizard policy was applied.

Method 2: Manually change the list on the Windows Firewall Exceptions tab

The Exceptions tab of the Windows Firewall tool lists all the programs and the ports that are defined as exempt from Windows Firewall port blocking. When Exchange 2003 services are added to the Exceptions tab, the location of the service executable file (.exe) is listed. If a Security Configuration Wizard policy is applied that defines a path of a service .exe file that is not a valid path on the local server, this path is listed in the Programs and Services section of Exceptions tab. For example, you might see the following path in the Programs and Services section of Exceptions tab: This path is the default installation path of the System Attendant service. This path is not valid if your Exchange 2003 computer is installed in C:\Exchsrvr or in another location.

If the Programs and Services section of Exceptions tab lists a path of a service .exe file that is not valid, follow these steps:

1. Click Start, point to Settings, and then click Control Panel.
2. Double-click Windows Firewall.
3. Click the Exceptions tab.
4. Under Programs and Services, select the path that is not valid, and then click Delete.
5. Click Yes when you are prompted to delete the path from the Exceptions tab.
6. On the Exceptions tab, click Add Program.
7. Click Browse, locate the .exe file for the service that you are trying to add to the Exceptions tab, and then click Open.
   
   For example, locate the correct path of Mad.exe, and then click Open.
8. Click OK.
9. Review the Exceptions tab.
   
   The name of the service that you added in step 7 is listed, but it does not appear with the full path of the .exe file. To verify the path, select the name of the service, and then click Edit. The full path of the .exe file of the service is displayed.

Perform this procedure for any other Exchange 2003 services that appear on the Exceptions tab as a path that is not a valid path. Frequently, one of the following services will be in the list:

• EMicrosoft Exchange MTA Stacks (Emsmta.exe)
• Microsoft Exchange Information Store (Store.exe)
• Microsoft Exchange System Attendant (Mad.exe)
• Microsoft Exchange Site Replication Service (Srsmain.exe)