Windows Vista's firewall has outbound rules

Huh. Windows Vista's firewall has outbound rules. I didn't know that until today. I wonder if it does anything?

Anyway, this is accessible via Control Panel (classic view) > Admin Tools > Windows Firewall with Advance Security.

Windows XP SP3 (Service Pack 3)

Windows XP SP3 (Service Pack 3) is available now as an optional update on Windows Update and will become automatic (probably as a critical update) on June 10th.

If you are using Microsoft Dynamics, Microsoft's POS (point-of-sale, not the other thing you're thinking) retail solution, don't install SP3.

Microsoft requires you to have SP1 installed before SP3, and recommends you have SP2 installed (get SP2 from Windows Update) as well before SP3.

In a nutshell, if you have been running updates all along, this won't be a big deal. However, if you load Windows XP fresh on your PC for some reason, this will save you a great deal of time. It adds some Windows Server 2008 compatibility and other networking features, but the big deal is saving time after installing SP2.

So, don't expect any new features. Getting SP2 was essentially getting a new operating system. SP3 is just a time-saving roll-up of patches.

You can download Windows XP SP3 here (316mb) or (more official looking) here. Of course, you should find it as an optional update.

For more, Paul Thurrott's got a review.

Yeah, I know, lots of boring technical stuff lately, but it's what I do for a living.

Update: Microsoft has released a hotfix for Microsoft Dynamics.

Ran into an interesting Windows Server 2003 problem today. There was very high CPU utilization by lsass.exe and svchosts.exe (NETWORK SERVICE), and an inability to create outbound network connections. The client has previously rebooted this server to resolve the issue in the past, but wanted an explanation.

This client runs our application from that server using Terminal Services. Our application would not run and was given a cryptic message with the error code 10055. That five-digit code looked like a Microsoft TCP error to me, and sure enough it was. A quick Google searched turned this up:

10055 WSAENOBUFS -- No buffer space available.

Since that is a TCP error, that would mean no network resources are available. I ran "netstat -n" but saw very few established sockets.

Task Manager showed high CPU usage by lsass.exe and one svchosts.exe running as NETWORK SERVICE. I tried to download Process Explorer but Internet Explorer could not get to any websites; the bottom of the page said there was a DNS error.

I opened a command prompt (CMD) and was able to ping www.yahoo.com, so DNS works. I figured I would just FTP the file, so I ran FTP from their server to our web site and got another error:

> ftp: connect :No buffer space is supported

So, another error that points to TCP resources being unavailable.

I tried asking the great Google for answers about TCP resources and error 10055 but mostly found people who rebooted to make the problem go away. There were some Microsoft Articles about increasing the maximum TCP/IP socket buffers, but this is not our server, so I do not want to make changes requiring a reboot without knowing if it would even solve the problem.

Naturally, I examined Event Viewer and saw some error messages that suggested more socket errors which Microsoft's KB indicates a group policy not being able to execute. Probably not the root problem.

I decided to figure out which service was killing the CPU and see if it was also tying up the network resources.

LSASS sustains a bunch of services, including HTTP SSL, IPSEC, Kerberos, NetLogon, NT LM, Protected Storage, Security Accounts Manager, and maybe a couple others. It seems to manage TCP sockets rather than use them, so though CPU is high I figured I could safely ignore LSASS.EXE

OK, svchosts.exe is starts up services, so I ran the Services.MMC (or go to Control Panel > Administrative Tools > Services) to examine services. I went through all the listed services and looked at the details for each. Where the command line included svchosts.exe, I looked for the "-k NETWORK" to determine which svchosts.exe service was running as NETWORK SERVICE. I restarted each one and watched Task Manager to see if the high-CPU instance of svchosts.exe disappeared briefly. When I got to the "Server" service, both svchost.exe and lsass.exe freed up their resources. The Server service also restarted Net Logon, DFS, and Computer Browser.

Ta-dah! I was able to browse the web, FTP, and of course our application worked again. Since this was not our Windows Server 2003 machine, I passed the information along. But, that certainly beats rebooting completely.