This article applies to:

• MailMarshal SPE 2.1.0+
• Internet Explorer 7
• Internet Explorer 8
• Microsoft Windows Update KB937143
• Microsoft Windows Update KB939653

Symptoms

• Applied Windows Update KB937143 or KB939653 on MailMarshal SPE Web Console server.
• Upgraded server to Internet Explorer 7
• Upgraded server to Internet Explorer 8
• MailMarshal SPE Web Console v2.1.0 - v2.2.0 displays error: System Error: Database could not be contacted - Login failed for user 'sa'.
• MailMarshal SPE Web Console v2.3.0 - v2.3.5 displays error: System Error: Database Version not supported - Expected minimum 9 but got -1.
• MailMarshal SPE Web Console v2.3.6 and above displays error: Configuration Issue
• The Web Console cannot be used. Other MailMarshal SPE and MailMarshal SMTP components continue to function.

Causes

First, verify that the SQL Server service is running and responding.

Windows Update KB937143 (MS07-045: Cumulative Security Update for Internet Explorer) causes unexpected changes in some Windows system functionality that is used by the MailMarshal SPE Web Console website.

It appears that the account used as the identity by the SPE Application Pool has insufficient/incorrect privileges to complete a request. By default SPE App Pool uses an identity of "Network Service" for application pools it creates.

This update only affects servers with IE7 or IE8 installed. Servers that have IE6 installed are not affected.

Resolution:

Microsoft has issued a hotfix that resolves this issue for IE7. For more information, please see the following Microsoft Knowledge Base article:

http://support.microsoft.com/kb/945701

Workaround:

If you are unable to apply the Microsoft hotfix, choose one of the following three possible workarounds:

1. Safest workaround:

   Correct Security Permissions in the Registry

   1. Open Registry Editor and navigate to HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones - (this key might change depending on who your application pool is running as (default is Network Service [aka S-1-5-20]))
   2. Right click on "Zones" and select "Permissions"
   3. Give the "IUSR_<machinename>" account FULL CONTROL on this key and all sub-keys.
   4. Open a command prompt and type "iisreset"
   5. Recycle the SPE Application Pool (with SPE 3.0 and above, only the Admin Console application pool)
      

      Warning: Use due care when editing the Registry.

2. OR Update the account used by the SPE Pool as follows:
   
    (Note: This workaround may be the only solution with Internet Explorer 8)

   IIS 6.0

   1. Open IIS Manager (Start | Settings | Control Panel | Administrative Tools | Internet Information Services (IIS) Manager).
   2. Expand "Application Pools."
   3. Right-click on "SPE Pool" and select "Properties."
      • For SPE 3.0 and above, perform this step for the SPE_AdminConsole_Pool
        
   4. Select the "Identity" tab on the "SPE Pool Properties" window.
   5. Make sure "Predefined" is selected, and then select "Local System" from the menu.
   6. Click Apply, then OK.
   7. Restart the SPE web site (for 3.0, the Admin Console site).
3. OR Uninstall the relevant Microsoft Windows Update - Web Console function will be restored.

In addition to the above, you may also need to update database connection settings.

1. On the SPE Web Console server, run the SPE Database Wizard.
2. Ensure that "Connect using the TCP/IP protocol" is selected.
3. Complete the wizard, using the current database.
4. Restart IIS (from IIS Manager or by the command IISReset).
5. Repeat these steps on any other computers in the installation where the Database Wizard exists.

Note: This change can be required because the account used by IIS processes may not be able to access the database through Named Pipes. The database wizard might have previously succeeded because it connects as the logged on user.