ISA Server 2004 Service Pack 3 – rollback failure and temporary resolution

Should the installation of ISA Server 2004 SP3 fail for any reason, a rollback operation will execute so that ISA components are returned to their pre-update versions.  If the ISA management console was opened while the update or rollback was in progress, this rollback process may fail.   This most often occurs when the ISA management was left open in a separate RDP session on that server.


We have had reports that the rollback is failing, which may result in leaving mixed components on the ISA Server, causing ISA service startup to fail.  We are investigating ways to prevent the update conflict and also to correct the rollback failures.


There are two options to resolve the rollback failure:


Option A; reinstall in repair mode (preferred)


A.      Download Service Pack 3 from ISA Download Site for your ISA 2004 Edition

B.      Make sure all ISA UI is closed and no other ISA utilities are in use

C.      Reinstall SP3 using this command line:

Msiexec /p <FullPathToSp3Package> REINSTALL=all REINSTALLMODE=omus SKIP_DIAGLOGACLS=1 /l*v c:\sp3.log



Option B; re-register an ISA administration component

A.      Start | Run

B.      Type “cmd” <Enter>

C.      Run the following commands:

1.       cd /d “%programfiles%\Microsoft ISA Server” (use the quotes)

2.       regsvr32 wspadmin.dll

3.       md VPN\Netsh

4.       net start fwsrv.


If none of these processes are successful, please contact PSS immediately.


Jim Harrison (ISA SE)

Comments (29)

  1. Anonymous says:

    Hi all, The ISA Team (Jim Harrison) blog a post about roolback of SP3 – ISA 2004. More information at

  2. Anonymous says:

    How to resolve problems with the ISA SP3

  3. Anonymous says:

    Hi all, The ISA Team (Jim Harrison) post a blog about roolback of SP3 – ISA 2004. More information at

  4. Anonymous says:

    Hi all, The ISA Team (Jim Harrison) blog a post about roolback of SP3 – ISA 2004. More information at

  5. Anonymous says:

    I followed the instructions in Option A, I noticed that new functions (loggin tab) were installed but the Firewall Service still stopping, after many tries of restart the service, I just disable the Cache then restart the service and it works! Also I was played with Backup-Restore but I think disable the Cache was that make works.


  6. Anonymous says:

    Hi jim,

    Thanks for the valued info.

    Will spread the word



  7. Anonymous says:

    Olá, O time do ISA Server (Jim Harrison) postou uma notícia sobre roolback do SP3 – ISA 2004. Mais informações

  8. Anonymous says:

    Olá, O time do ISA Server (Jim Harrison) postou uma notícia sobre roolback do SP3 – ISA 2004. Mais informações

  9. Anonymous says:

    Thanks for sharing your feedback!

  10. Marc Grote says:

    Hi Jim,

    great information.

    regards Marc aka Jens Baier

  11. Dave says:

    Hi Guys,

    Dont know where else to post. Just installed SP3 for 2004 and the MMC had a cry on me. The first time it failed I turned off the MMC and ran it again, the second time it installed but when it came back up it said that the mmc couldnt initalise. I rolled it back and all is well again. Anyone had the same experience?

    Forgot to add this is on a Win2k on AD

  12. Edwin Mateo says:

    Gracias, por publicar este tipo de informaci►2n

  13. Paulo Anica says:

    None of the solutions worked in my case.

  14. tony says:

    I have installed SP3, or should I say attempted, and it bombs each time, and the repair fails; which forces me to reinstal SP2 in order for me to get the Firewall service to start.

    I have down loaded SP 3 twice from Microsoft.

    I am unable to run Option A, either I am just brain dead or both downloads are bad.

    Do you have a different example that shows the use of a down loaded source (is it like E:ISA 2004SP3)?

    Thank you,


  15. JL says:

    Had the exact same problem with SP3 install on our ISA2004. Mine threw an error registering FTPadmin.dll.

    Bombed the install and re-ran with the command line entry above to resolve problem.

  16. Craig McLaren says:

    Has this problem been fixed yet?

  17. nik says:

    It failed for me 3 times and everytime a rollback.  Disabled antivirus, UPS software and ISA services manually first.  After this via the option A, command line it worked for me. Thx

  18. Scott says:

    I tried installing sp3 to solve an issue I’m having with outlook RPC connections failing to the exchange server (which mysteriously started yesterday). When the box came back up after the reboot, not even half of the system services started up. I had to go in and manually start them all including net logon, all 3 ISA services RRAS, etc. I tried uninstalling sp3 through Add/Remove programs and after the reboot I still had the same issue with the services start up. I luckily had a full backup from the night before so I restored and it came up working fine, including rpc and all my remote outlook clients. 15 mins later I started having the same rpc issue and outlook clients can’t connect. I’d love any input available. I want to re-install sp3 but I’m terrified.


  19. Scott says:

    I figured out this problem and it turned out to be the latest update of trend micro office scan client.


  20. Tim says:

    I could not get sp3 to install using the setup package or from the command line. Every time the installation would fail with error 1603 and then roll back. After looking through the log I discovered that there was an unresolved account SID which had been delegated as an ISA Server full administrator. After using the Administration Delegation wizard to remove the SID the installation worked perfectly.

  21. Francois (Frank) says:

    Same thing for me. I had to remove an unresolved account SID in the delegate administration. After that, the SP3 installation work succesfully.

  22. Frank says:


    What was the issue with Trend Micro Client and what was the solution? I am in the same boat as you. Thanks


  23. guy says:

    Tim and Francois you are stars, i was tearing my hair out will all the other fixes until i was your comments on administrators and sure enough an unresolved user account.

    Many thanks

  24. Tim Novak says:

    Excellent information.  

    I still received an error during the install stating a dll couldn’t be registered, but I chose ignore and completed the install and everything worked fine.  The first time, it wouldn’t complete at all.

    Thank you for the update!

  25. Ludvig F. Aarstad says:

    I just did the install. It failed a couple of times until I realised someone else being logged on having started the ISA Management. So, got them to close the console and the install went fine. However, after the reboot when I try to launch ISA Server Management I get this error:

    Snap-in failed to initialize.

    Name: Miscrosoft ISA Server 2004


    I have no idea what is happening

  26. Ludvig F. Aarstad says:

    Nevermind… I got it working. Reinstalled SP3 using the commandline described above, worked.

  27. D.King says:

    How i can remove unresolved account SID Role for ISA Server Enterprise Administrator and assign new account?

  28. John Mcdonald says:

    Funny, 6 years after the last comment, I have decided to go to sp3.  Thanks for the help.