Artem Pronichkin

I’ve installed Forefront Server Security for Microsoft Exchange 2007 and Forefront Server Security Administrator on different computers, both Windows Server 2008 with all current patches. And by default it was not able to connect to each other. Here’s what the error message looked like.

---------------------------
Confirmation
---------------------------
ERROR: Unable to connect to service. An error was returned. Location: CoCreateInstanceEx. Error: The RPC server is unavailable.

---------------------------
OK  
---------------------------

Also, the following record appeared in the System event log on my client computer (i.e. where the “Administrator” part had been installed).

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          11/3/2008 4:55:21 AM
Event ID:      10006
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <Client Computer FQDN here>
Description:
DCOM got error "2147944122" from the computer <Server Computer FQDN here> when attempting to activate the server:
{903C424C-BE15-4BCE-8256-EDC95C6E28FE}

Ok, I quickly searched over the Internet and found a few places where the same trouble had been discussed. Well, only one newsgroup thread actually. In German. All it suggested was to read product documentation. Alright, there’s a note really about this error in Forefront Security for Exchange Server User Guide (quite strange that it wasn’t found directly). Here’s what it says.

If you create a user that is part of the Administrators Group with read-only access rights to FSE, when that user logs on and tries to open the Forefront Server Security Administrator, the following error will occur:
ERROR: Unable to connect to service. An error was returned. Location: CocreateInstanceEx.Error: Access is denied.
This error is caused by a Windows Server 2003 SP 1 security enhancement. To work around this problem, follow these steps:

1. Run DCOMCNFG from START/Run. The Component Services dialog box appears.
2. Expand Component Services.
3. Expand Computers, My Computer, and DCOM Config.
4. Right-click on FSCController, and then select Properties.
5. Click the Security tab, and then click Edit in Launch and Activation Permissions.
6. Add Domain Users, and click Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
7. Click OK for both open dialog boxes.

But this turned totally useless. The real solution consists of two parts. The fist one is also described in the fore-mentioned manual.

To enable the Forefront Server Security Administrator to run on Microsoft Windows XP SP2

1. Click Start, click Run, and then enter dcomcnfg. The Component Services dialog box appears.

2. In the Component Services dialog box, expand Component Services, expand Computers, right-click My Computer and then click Properties.

3. On the COM Security tab, click Edit Limits under Access Permissions, and then select the Allow check box for Remote Access for the Anonymous Logon user.

4. Add the Forefront Server Security Administrator application to the Windows Firewall Exceptions list:

   1. Open Control Panel, and then select Security Center.
   2. Select Firewall Administrator. The Windows Firewall dialog box appears.
   3. Select the Exceptions tab.
   4. Click Add Program, select FSSAClient from the list, and then click OK. This adds the Forefront Server Security Administrator to the Programs and Services list.
   5. In the Programs and Services list, select the FSSAClient.
   6. Click Add Port, enter a name for the port, enter 135 as the port number, and then select TCP as the protocol.
   7. Click OK.

But the second one was not found anywhere. So I had to find it out myself and now want to share with you. Besides creating firewall exception on the client side, you need a matching rule on the server side. Here’s how you could create it.

netsh advfirewall firewall add rule name="Forefront Server Security for Microsoft Exchange Controller Service" dir="in" action="allow" program="%ProgramFiles% (x86)\Microsoft Forefront Security\Exchange Server\FSCController.exe" description="For source info please read at http://pronichkin.com/blog/Lists/Posts/Post.aspx?ID=3" enable="yes" profile="domain" localip="any" remoteip="any" localport="RPC" remoteport="any" protocol="TCP" interfacetype="any" edge="no" security="notrequired"

Bold is the only parametr you actually need if you prefer to manage firewall rules using GUI MMC (launched via wf.msc).

And one more command-line trick. You can launch Forefront Server Security Administrator with specifying the server you want to manage via commad-line. Just run “FSSAClient.exe your-mail-server.domain.com”, where the latter is actual FQDN of your server (or NetBIOS name if you prefer). A nice trick for creating desktop shortcuts :)