Anyconnect with IPSEC IKeV2 certificate requirement

Similar Questions

• Restrict the Anyconnect to IPSEC

  Dear,

  the current configuration on the attributes of group policy should allow anyconnect with IPSEC and SSL (svc). If I disable the svc by configuring the following:

  test group policy attributes

  Protocol-tunnel-VPN IPsec l2tp ipsec

  the CiscoAnnyconnect app does not work with "Login Failed, mechanism of connection not allowed, contact your administrator".

  my original config is

  WebVPN

  allow outside

  Image disk1 SVC: / anyconnect-win -3.1.04072- k9.pkg 1

  enable SVC

  test group policy attributes

  Protocol-tunnel-VPN IPSec l2tp ipsec svc

  Split-tunnel-policy tunnelall

  WebVPN

  SVC Dungeon-Installer installed

  generate a new key SVC time no

  SVC generate a new method ssl key

  client of dpd-interval SVC 120

  SVC request no svc default

  Disable Smart tunnel

  with ios asa805-20-k8

  can you please tell how to force the use to only ipsec with the Cisco anyconnect application?

  THX,

  IPsec (IKEv2) with AnyConnect Secure Mobility Client Software ASA 8.4 (1) or later. Your release 8.0 (5.20) does not support IKEv2.

  Once you have an improved system to work, please see the following display that gives a complete guide to configuring a remote access VPN using IKEv2:

  https://supportforums.Cisco.com/document/74111/ASA-AnyConnect-IKEv2-CONF...

  Hope that this helps, please rate if it does.

• AnyConnect with IKEv2

  Hello world

  I have config Anyconnect with IKEv2 only no web launch and SSL is also turned off.

  I downloaded the anyconnect - anyconnect-victory - 3.1.05160 - k9.pkg on PC.

  tried to connect but no luck.

  Is that it is designed to work this way?

  Concerning

  Mahesh

  Yes - it's a way to do it.

  Profile .xml is a simple file (but critical) very small, you can copy manually the ASA to your PC as well as through the automatic method, which, as noted, requires customer services via the SSL on the SAA. If you have the correct .xml file (should specify transport IPsec) and AnyConnect on the PC client software, you don't need the ASA via SSL customer service.

  If you make the manual method, any future update profile must also be distributed manually.

• Setup for use with Cisco Anyconnect VPN IPsec

  So, I had trouble setting up VPN on our ASA 5510. I would use IPsec VPN so that we don't have to worry about licensing issues, but what I have read you can do with and always use Cisco Anyconnect. My knowledge on how to set up VPN especially in iOS version 8.4 is limited, so I've been using a combination of command line and ASDM.

  I am finally able to connect from a remote location, but once I log in, nothing else works. What I've read, you can use IPsec for client-to-lan connections. I use a pre-shared for this. Documentation is limited on what should happen after have connected you? Shouldn't be able to local access on the vpn connection computers? I'm trying to implement work. If I have VPN from home, should not be able to access all of the resources at work? According to me, because I used the command-line as ASDM I confused some of the configuration. In addition, I think that some of the default policies are confused me too. So I probably need a lot of help. Here is my current setup with the changed IP address and other things that are not related to deleted VPN.

  NOTE: We are still testing this ASA and is not in production.

  Any help you can give me is greatly appreciated.

  ASA Version 8.4 (2)

  !

  ASA host name

  domain.com domain name

  !

  interface Ethernet0/0

  nameif inside

  security-level 100

  the IP 192.168.0.1 255.255.255.0

  !

  interface Ethernet0/1

  nameif outside

  security-level 0

  IP 50.1.1.225 255.255.255.0

  !

  interface Ethernet0/2

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface Ethernet0/3

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface Management0/0

  No nameif

  security-level 100

  IP 192.168.1.1 255.255.255.0

  !

  boot system Disk0: / asa842 - k8.bin

  passive FTP mode

  DNS domain-lookup outside

  DNS server-group DefaultDNS

  !

  permit same-security-traffic intra-interface

  !

  network of the NETWORK_OBJ_192.168.0.224_27 object

  subnet 192.168.0.224 255.255.255.224

  !

  object-group service VPN

  ESP service object

  the purpose of the tcp destination eq ssh service

  the purpose of the tcp destination eq https service

  the purpose of the service udp destination eq 443

  the destination eq isakmp udp service object

  !

  allowed IP extended ip access list a whole

  !

  mask 192.168.0.225 - 192.168.0.250 255.255.255.0 IP local pool VPNPool

  no failover

  failover time-out period - 1

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 645.bin

  don't allow no asdm history

  ARP timeout 14400

  NAT (inside, outside) static source any any static destination NETWORK_OBJ_192.168.0.224_27 NETWORK_OBJ_192.168.0.224_27 non-proxy-arp-search to itinerary

  !

  the object of the LAN network

  NAT dynamic interface (indoor, outdoor)

  Access-group outside_in in external interface

  Route outside 0.0.0.0 0.0.0.0 50.1.1.250 1

  Sysopt noproxyarp inside

  Sysopt noproxyarp outdoors

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec ikev2 ipsec-proposal OF

  encryption protocol esp

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 proposal ipsec 3DES

  Esp 3des encryption protocol

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 ipsec-proposal AES

  Esp aes encryption protocol

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 ipsec-proposal AES192

  Protocol esp encryption aes-192

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 AES256 ipsec-proposal

  Protocol esp encryption aes-256

  Esp integrity sha - 1, md5 Protocol

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  Crypto ca trustpoint ASDM_TrustPoint0

  registration auto

  name of the object CN = ASA

  Configure CRL

  crypto ca server

  Shutdown

  string encryption ca ASDM_TrustPoint0 certificates

  certificate d2c18c4e

  864886f7 0d06092a c18c4e30 308201f3 3082015c a0030201 d 020204 2 0d 010105

  0500303e 3110300e 06035504 03130741 53413535 3130312a 2 a 864886 30280609

  02161b 41 53413535 31302e64 69676974 616c 6578 7472656d 65732e63 f70d0109

  3131 31303036 31393133 31365a 17 323131 30303331 39313331 0d 170d 6f6d301e

  365a303e 3110300e 06035504 03130741 53413535 3130312a 2 a 864886 30280609

  02161b 41 53413535 31302e64 69676974 616c 6578 7472656d 65732e63 f70d0109

  6f6d3081 9f300d06 092 has 8648 86f70d01 01010500 03818d b 30818902-00-818100-2

  8acbe1f4 5aa19dc5 d3379bf0 f0e1177d 79b2b7cf cc6b4623 d1d97d4c 53c9643b

  37f32caf b13b5205 d24457f2 b5d674cb 399f86d0 e6c3335f 031d54f4 d6ca246c

  234b32b2 b3ad2bf6 e3f824c0 95bada06 f5173ad2 329c28f8 20daaccf 04c 51782

  3ca319d0 d5d415ca 36a9eaff f9a7cf9c f7d5e6cc 5f7a3412 98e71de8 37150f02

  03010001 300 d 0609 2a 864886 f70d0101 05050003 8181009d d2d4228d 381112a 1

  cfd05ec1 0f51a828 0748172e 3ff7b480 26c197f5 fd07dd49 01cd9db6 9152c4dc

  18d0f452 50f5d0f5 4a8279c4 4c1505f9 f5e691cc 59173dd1 7b86de4f 4e804ac6

  beb342d1 f2db1d1f 878bb086 981536cf f4094dbf 36c5371f e1a0db0a 75685bef

  af72e31f a1c4a892 d0acc618 888b53d1 9b 888669 70e398

  quit smoking

  IKEv2 crypto policy 1

  aes-256 encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  IKEv2 crypto policy 10

  aes-192 encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  IKEv2 crypto policy 20

  aes encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  IKEv2 crypto policy 30

  3des encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  IKEv2 crypto policy 40

  the Encryption

  integrity sha

  Group 2 of 5

  FRP sha

  second life 86400

  Crypto ikev2 activate out of service the customer port 443

  Crypto ikev2 access remote trustpoint ASDM_TrustPoint0

  Crypto ikev1 allow outside

  IKEv1 crypto policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  SSH timeout 10

  Console timeout 0

  management-access inside

  SSL-trust outside ASDM_TrustPoint0 point

  WebVPN

  allow outside

  AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1

  AnyConnect image disk0:/anyconnect-linux-2.5.2014-k9.pkg 2

  AnyConnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 3

  profiles of AnyConnect VPN disk0: / devpn.xml

  AnyConnect enable

  tunnel-group-list activate

  internal VPN group policy

  attributes of VPN group policy

  value of server WINS 50.1.1.17 50.1.1.18

  value of 50.1.1.17 DNS server 50.1.1.18

  Ikev1 VPN-tunnel-Protocol, l2tp ipsec ikev2 ssl-client

  digitalextremes.com value by default-field

  WebVPN

  value of AnyConnect VPN type user profiles

  always-on-vpn-profile setting

  privilege of xxxxxxxxx encrypted password username administrator 15

  VPN1 xxxxxxxxx encrypted password username

  VPN Tunnel-group type remote access

  General-attributes of VPN Tunnel-group

  address (inside) VPNPool pool

  address pool VPNPool

  LOCAL authority-server-group

  Group Policy - by default-VPN

  VPN Tunnel-group webvpn-attributes

  enable VPN group-alias

  Group-tunnel VPN ipsec-attributes

  IKEv1 pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  class-map ips

  corresponds to the IP access list

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  Review the ip options

  inspect the netbios

  inspect the rsh

  inspect the rtsp

  inspect the skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect the tftp

  inspect the sip

  inspect xdmcp

  inspect the http

  class ips

  IPS inline help

  class class by default

  Statistical accounting of user

  I would recommend buy AnyConnect Essentials. The cost of the license is nominal - list of US $150 for the 5510. (piece number L-ASA-AC-E-5510 =)

  Meawwhile you can use the Cisco VPN client inherited with IKEv1 IPSec remote access VPN using profiles *.pcf.

  I believe you can also use the client Anyconnect client SSL or DTLS transport access remotely (non-IPsec) without having to buy the license Anyconnect Essentials for your ASA focus.

  As an aside, note that if you want to use AnyConnect Mobile (e.g. for iPhone, iPad, Android, Blackberry etc.clients) you will also get the additional license for it (L-ASA-AC-M-5510 =, also price US $150)

• ASA5505 IPSEC only with self-signed certificates

  Hi all

  I have little Cisco training and was assigned to a pilot project. We have cleaning of the ASA from another Department, but I do not have access to support. It is running ASA v9.1 and ASDM 7.1. If all goes well I'll be sent on training and we can buy a nice 5520.

  So I scoured the internet for a guide that is easy to do as my title says, but I'm having major trouble. I find a lot of outwardly signed with self-signed SSL VPN or VPN IPSEC with CERT support but I can't only get ASA self-signed IPSEC IKEv2 with certificate authentication. Also, to make it even worse, I have to provide the user with the software, the profile and the certificate in hand. No access to the web or download portal.

  If you know where I can get good installation guide for this type of use please by all means save me here. If this isn't possible, I'm cool with that, let me know.

  Thank you fo any help you can provide

  Jay

  If the ASA uses a certificate issued by a certification authority that is in-store customer trust root CA, then the certificate of identity ASA didn't need to be imported by the customer.

  Which is why it's usually recommend to follow the path of using experienced public CA because they are alreay included in most modern browsers and so the client has no need to know how to import certificates etc.

  If you are using a local certification authority that is not in the store trusted CA of the customer to deliver your ASA certificate or identity certificates on the SAA signing root then you must take additional measures at the level of the customer.

  In the first case, you could import the CA certificate in the store root CA of the client trusted root. After that, all the certificates it has issued (the IE the ASA certificate of identity) would automatically be approved by the customer.

  On the second case, certificate of identity of the SAA is would have installed on the client because it (the ASA) basically as it's own root certification authority. Usually, I install them in the CA store root confidence of my client, but I guess that's technically not necessary, as long as the customer knows to trust this certificate.

• AnyConnect VPN Client - works with IPsec

  Hello

  How can I do for AnyConnect VPN Client works with ipsec?

  I tried with SSL and works normally.

  But with IPsec does not work. Should I do something?

  Thank you

  Rodrigo

  Rodrigo, Anyconnect works with SSL, in order to use IPSec, you must the Cisco VPN Client.

• AnyConnect with certificate and without MS Certificate Server

  Hello community.

  Is it possible to use anyconnect with certificate, but without a MS. Certificate Server
  I think a certificate installed on the asa and the certificate installed on the laptop or mobile client-side. If the certificate of the client is able to connect.
  I heard that if you use the certificate for anyconnect that the asa do not ask for login credentials, the anyconnect can be connected without credentials. I don't like this behavior.
  Is it possible to use the certificate and the asa is still to ask credentials?

  Thanks in advance

  Sent by Cisco Support technique iPhone App

  Yes to both:
  -3rd party CA to issue certificates for the ASA and customers
  -You can use the authentication of the hybrid to use certificates and passwords (one-time or static)

  Sent by Cisco Support technique Android app

• Can we run AnyConnect using self signed certificates?

  I have a lab that I want to build a tunnel to remote access for mobile-to-ASA computer, using AnyConnect.

  I understand AnyConnect requires IKEV2 and certificates.

  It allows no password communicated in advance, as the VPN-client.

  Is there a way I can build the lab without a certificate?

  In practice you can do pretty much everything with SSL VPN (AnyConnect client) you could with IPSec VPN (IPsec legacy or 3rd party client).

  You get the advantage of support modern OS (i.e., Windows 8, etc.) and the ability to add many other features (with AnyConnect Premium licenses) and integrate other modules such as NAM and Cloud Web security etc...

• AnyConnect 3.1 - the certificate on the secure gateway is not valid

  Hi guys,.

  I have a problem with the Anyconnect 3.1.01065.

  When I try to connect I get the "the certificate on the secure gateway is not valid. A VPN connection can be established.

  The certificate is a signed cert self.

  Woks AnyConnect 2.5 without problems.

  Image of the ASA: 8.4 (2).

  [27.11.2012 15:58:27] Ready to connect.

  [27.11.2012 16:01:49] Contact IP_WAN.

  [27.11.2012 16:01:52] Please enter your username and password.

  [27.11.2012 16:02:01] User credentials entered.

  [27.11.2012 16:02:02] Establish the VPN session...

  [27.11.2012 16:02:03] Checking for updates to profile...

  [27.11.2012 16:02:03] Checking for updates...

  [27.11.2012 16:02:03] Checking for updates of customization...

  [27.11.2012 16:02:03] Execution of required updates...

  [27.11.2012 16:02:08] Establish the VPN session...

  [27.11.2012 16:02:08] Setting up VPN - initiate the connection...

  [27.11.2012 16:02:09] Disconnection in progress, please wait...

  [27.11.2012 16:02:13] Connection attempt failed.

  Anyone had this problem before?

  Thank you very much.

  Hello Cristian,

  Please see this:

  CSCua89091 Details of bug

  the local certification authority must support the EKU and other necessary attributes

  Symptom: The local CA on the ASA server currently does not support attributes like the EKU. This enhancement request is to add support for this. Workaround: Configure the cert on the customer's profile

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId= CSCua89091

  And the following:

  DOC: Anyconnect supports Extended Key use specific attributes in CERT

  Symptom: When using certificates with the anyconnect client if the certificate is installed on the SAA does not have the EKU attribute set to "Server authentication", then the anyconnect client will reject the ASA certificate as invalid. The certificate of the client id must also be '-l' client authentication "otherwise the ASA he will reject... Conditionsof : Use a certificate of id on the ASA with one other than «authentication server» EKU Use a certificate of id on the client that has one another EKU that '-l' client authentication. Workaround solution: Generate a new certificate of ID with correct extended key usage

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId= CSCty61472

  If at this point, you need to set up the corresponding certificate or use an earlier version of the AnyConnect client.

  HTH.

  Please note all useful posts

• Redundancy ASA - Client to the remote access (AnyConnect or IPsec) VPN Cisco to 2 PSI

  Hello

  I realize that the true public access redundancy require routers and BGP need &AS#; but some can't afford such a solution.  Should someone have ASA 5510 dry + with 2 of the ISP could use IP SLA functionality for primary education to save the failover, etc..  What VPN clients for remote access (SSL or IPSec).  I'm curious if you have any other solutions/configurations on it to allow either of these customers, AnyConnect or IPsec, to try the primary counterpart and after a few failed attempts over fail to backup (even if a user tries to establish a VPN)?  I know that one of the possible solutions may use a domain name FULL peer IPSec or AnyConnect client input, then maybe public operator DNS TTL change or other hosted / failover services... but these "proxy" or DNS services are not the best solution because there is cache and other associated DNS weaknesses (right)?  These are not infallible fail-over, I'm sure that some users might succeed and some may fail; I do not know administrators will be like that as much as they like going to the dentist.

  Anyone who has any ideas or possible solutions?

  Thank you.

  Hello

  Backup servers are supported by remote access VPN clients.

  The client will attempt to connect to the first IP/configured FULL domain name and will try the following in the list, if no response is received.

  http://www.Cisco.com/en/us/docs/security/vpn_client/cisco_vpn_client/vpn_client46/win/user/guide/VC4.html#wp1000747

  Federico.

• AnyConnect with ISA500

  To use the VPN with the ISA500 y at - it no extra cost for the Anyconnect client or any license required?

  Hello Alan,.

  The ISA500 series comes with a 1 or 3 years security services license. This license allows you to use AnyConnect with ISA. No additional cost to you, as all the ISA500 are sold with this license. Don't forget, if you buy the product of 1 year, you will have to renew the license in a year.

  TIP: the ISA has VPN client available on the quick boot disk, so make sure you don't throw it out.

• Bypass the router upstream company ACL with IPSEC VPN

  Hello

  My headquarters has a routing infrastructure company. I want to configure a Site VPN to IPSEC as a solution of webvpn AnyConnect for my users through the company. If the security guys to create an ACL on the router upstream from my Cisco ASA 5585 to allow IPSEC between 28 (the stretch between my external interface of ASA and the trunk of PO on the upstream router) then I can send ip a whole between my inside interface subnet and subnet within the interface on the ASA distant (still on the company's infrastructure holding constant and correct routing. In short, if a packet is encrypted in an IPSEC packet, IPSEC is not filtered, you can send any traffic, even if it is AS restrictive on a router upstream of the LCA, correct?

  Thank you!

  Matt

  CCNP

  You are right, the router can not look in the VPN package. So anything that is transported inside the VPN, it bypasses security company-ACL.

  For VPN traffic to your ASA, you need the following protocols/ports:

  1. UDP/500, UDP4500, IP/50 for IPsec
  2. UDP/443 for AnyConnect with SSL/TLS, TCP/443

• Error in windows 2003 Standard Edition with Service Pack 2... The server {00024500-0000-0000-C000-000000000046} is not registered with DCOM within the required time.

  Could someone fix for the error below...

  OS: Windows 2003 Standard Edition with Service Pack 2...

  Event type: error
  Event Source: DCOM
  Event category: no
  Event ID: 10010
  Date: 08/08/2012
  Time: 10:00:31
  User: n/a
  Computer: BP1WHIAP011
  Description:
  The server {00024500-0000-0000-C000-000000000046} is not registered with DCOM within the required time.

  Hello
  For assistance on this issue, you can post your question in the Technet Forums.
  http://social.technet.Microsoft.com/forums/en-us/categories/

• When I try to access utility 'defrag' from Microsoft, a link to "Diskeeper" is everything that happens with download and purchase required.

  When I try to access utility 'defrag' from Microsoft, a link to "Diskeeper" is everything that happens with download and purchase required.  What is an intrusion to avoid?  It is possible to access the Microsoft defrag utility?

  Glen, have you ever tried to download Diskeeper?

  If so, he may have added something on your computer for access to defragment.

  You're going to start > all programs > Accessories > system tools > Disk Defragmenter and obtaining the pop-up window?

  Check in Add/Remove programs and see if something diskeeper is installed then uninstall it.

  Post back with more information, make and model of the pc, current anti-virus, browser and operating system and the service pack.

  also:

  Download, install, update and do a full scan with these free malware detection programs at:

  Malwarebytes (MMFA): http://malwarebytes.org/

  SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

  After back with the results.

• The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} is not registered with DCOM within the required time.

  This morning when I checked my system log, it was filled with errors, while saying:

  The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} is not registered with DCOM within the required time.

  A quick search of the register revealed that it identifies Windows Management Instrumentation (WMI). I looked, and indeed, he was arrested. When I tried to start it, I got the error message:

  Could not start the Windows Management Instrumentation service on Local computer

  Error 193: 0xc1

  All the help I can find on the subject assumes that the application does not have the required permissions. Nothing has been deliberately changed. I tried to do a restore of the system of the last days at several checkpoints and received messages that it could be done. So, I checked all the required permissions were still in place.

  My operating system is XP Pro SP3 with all updates applied.

  So, I have to say that something broken, perhaps in the framework of an automatic update or another. Now, when I try to run Microsoft Update, it just hangs.

  Maybe there is not enough information here, but I'm looking for more help on troubleshooting. I have the system tools enough to report all the news of trial if necessary.

  Thank you

  Don

  Even if I had run a chkdsk/r on my system disk and he come clean, I have decided to launch a sfc/scannow and found 3 DLLs that were somehow not original. Once these have been restored, the errors have stopped (so far). While it was only 30 minutes, it is the longest, I went all day with no error message. I'm keeping my fingers crossed.