You may find, as we did today, that some services may fail to start or may not properly work after installing windows updates: MS08-037 (951746 and 951748).

In our case the IPSEC Services Service terminated with the following error:  Only one usage of each socket address (protocol/network address/port) is normally permitted.

Additionally, the following event was logged in the system event log:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 7/12/2008
Time: 6:38:37 PM
User: N/A
Computer: SERVER
Description:  The IPSEC Services Service terminated with the following error:  Only one usage of each socket address (protocol/network address/port) is normally permitted.

If the IPSEC service fails to start, the server will be running in Block mode and it will block all network connectivity to the server.

To solve this issue, we followed these steps found at: http://blogs.technet.com/sbs/archive/2008/07/17/some-services-may-fail-to-start-or-may-not-work-properly-after-installing-ms08-037-951746-and-951748.aspx

MS08-037 is a security update designed to prevent DNS spoofing.  The update is described by article 953230       MS08-037: Vulnerabilities in DNS could allow spoofing: http://support.microsoft.com/default.aspx?scid=kb;EN-US;953230

The update changes the way the DNS server allocates the UDP source port for DNS queries.  On an SBS server by default we set the MaxUserPort value in the registry to 60000 or 65536 depending on the version of SBS.  The MaxUserPort  value causes the DNS server to pick UDP source ports in the range of 1024 to 60000, or 65536.  The MaxUserPort is set on the SBS server by Exchange and ISA server.  DNS by default will randomly pick 2500 ports when the service starts up, a port conflict will occur if the DNS server allocates a port that is required by another service and that service will fail once it requests that static UDP port.  So far we have seen issues with AUTD, IPSEC, and IAS but there may be other services that will have a conflict. 

The ReservedPorts registry key can be used to exclude ports from the pool the DNS server uses.  The reservedports registry key is described in 812873 How to reserve a range of ephemeral ports on a computer that is running Windows Server 2003 or Windows 2000 Server

Here is the list of ports that we have seen conflicts with services on the machine.

• 1645-1646 - Used by IAS
• 1701-1701 - Used by L2TP
• 1812-1813 - Used by IAS
• 2883-2883 - Used by AUTD
• 4500-4500 - Used by IPSEC

For now we are suggesting customers be proactive and modify the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ReservedPorts

We suggest you add these port numbers to the current values set in the ReservedPorts registry key.  Do not replace the values currently there with these values but simply add these additional values. 

When you click OK you may get the following warning message:

This warning is OK and you can click OK on it.

Once you modify the ReservedPorts key you will have to reboot the server to make the change effective. 

If you are using any third party applications on your SBS server that might require the use of a static UDP port higher than port 1024, you should also add it to the list of reserved ports.

If you have any other issue after installing 951746 and 951748 that is resolved by uninstalling these updates, try setting the ReservedPorts  registry value and rebooting the server.  Then reinstall the 951746 and 951748 updates. 

Regardless of any other issues you might encounter with these updates (see below), once the updates are installed, you should have the ReservedPorts updated to prevent unexpected failures on server reboot.

Remember that the 951748 and 951746 updates may also cause a loss of Internet Connectivity in conjunction with 3rd party firewall products.  For more information on that issue see: http://blogs.technet.com/sbs/archive/2008/07/11/loss-of-internet-connectivity-after-installing-951748-and-951746.aspx

Furthermore, a third type of issue has been seen where the DNS Server service fails to start with the following error:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 7/15/2008
Time: 5:12:05 PM
User: N/A
Computer: Server
Description:
The DNS Server service terminated with the following error:
Not enough storage is available to complete this operation.

On the servers that we have this problem on we have seen signs of incomplete installations of Windows Server 2003 Service Pack 2. Uninstall both updates (951748 and 951746) and verify that Service Pack 2 is properly installed (You will most likely need to re-install it, check the following link for Best Practices <http://blogs.technet.com/sbs/archive/2007/06/30/new-best-practices-for-sp2-kb.aspx>).

Update:

This issue is further discussed in these two new KB articles:

• http://support.microsoft.com/kb/956189
• http://support.microsoft.com/kb/956188