Customers who have an existing Websense installation and want to move to Forefront Threat Management Gateway (TMG) as a Secure Web Gateway can migrate without creating rules from scratch.  SecureGUARD ( ) provides the Web Configuration Migration Wizard, a migration tool that converts an existing Websense configuration to a Forefront TMG 2010 i.. more »

Have you ever wondered what is the latest public hotfix or update available for ISA, IAG, TMG or UAG? Good news!!!!!!!!!!!!!! We have launched the Update Center for Microsoft Forefront and Related Technologies where you can now go and check for the latest updates related to any forefront product. The site is located at .. more »

TMG can be configured in a Mail protection role. In such configurations Forefront Protection for Exchange and Exchange Server (edge transport role) are installed on the same machine as TMG. We have identified problems when installing Microsoft Exchange Server 2010 Service Pack 1 (SP1) that was released last week on such deployments. SP1 made some .. more »

Forefront Endpoint Protection 2010 Beta So now that you’ve downloaded Forefront Endpoint Protection Beta 2010, the next step would be to plan your deployment and get the Forefront Client in your Configuration Manager environment. This post will focus on how to deploy Forefront Endpoint Protection client to a collection of computers using your ex.. more »

This post is about two scenarios which involved ISA server and third party content application. Let’s go over each one of those and the troubleshooting steps involved in order to fix it. ISA was doing a Proxy Chain with a third party product, when the client (using Windows XP SP2 with Internet Explorer 6) was browsing a HTTPS web site behind the IS.. more »

E-Mail Protection feature on TMG is one of the features that allows TMG to leverage other resources available in the environment. In this case, TMG uses Exchange Edge technology as well as Forefront Protection for Exchange. Before start reading this post, make sure to get familiarized with E-Mail Protection feature on TMG by reading the following .. more »

Forefront TMG 2010 provides an enhanced array management feature known as array join / disjoin. This article describes a problem that may be encountered as a result of a failure during this process, the solution you can apply as well as a discussion of how and why this problem occurs. You attempt to join a TMG server to an EMS-managed array, but .. more »

The core TMG behavior (which is the same on ISA) for handling spoofed packets is well known. Basically, if the IP address belongs to the internal network and it is received on the external interface, it is expected that the packet will be dropped. By definition, the intrusion detection system on TMG will do the following: This post describes a .. more »

Our support folks have created a tool that enables you to remove permanently offline computers from your FCS database. Client computers go offline for many reasons, including decommission, re-tasking, and re-imaging. After a day, these computers are shown in the "Not Reporting" section of the Client Security console. After 30 days, these computers .. more »

includes some significant improvements to the reporting functionality: - New look-and-feel for all existing reports – cleaner aesthetics that match other Forefront products. : provides detailed information about the activity of specific users. - Reports added for new features introduced in SP1 - User Overrides and BranchCache integration. Here ar.. more »

Introduction Cannot create a weblistener using any port other then 80 for non-ssl website publishing or trying to modify WebListener settings via UI for non-ssl website publishing. For example trying to use port 8080 on the listener as the port number in front of non-ssl connection option it gives an error: Repro steps Create a weblistener .. more »

Consider a scenario where users are not able to authenticate using FBA with LDAP to access the websites published through ISA server. In this scenario ISA server was part of one domain (contoso.com) and users who would access the website are part of another domain (fabrikam.com). FBA with LDAP is used on the web listener of the web publishing rule .. more »

Consider a scenario where a TMG administrator has configured their TMG Server 2010 installed on a Windows Server 2008 R2 for inbound VPN connections. External VPN users (two or more users) are behind a NAT device, which NATs all outbound L2TP VPN traffic. When users try to connect using L2TP VPN connections, only one user from this network can .. more »

Configure HTTPS inspection) and go to the “Source exceptions” tab (see screenshot below). You can add to the source exception list the following network objects: Computers and Computer sets. Source exception matching is performed in the following way: One of the main added values of HTTPS inspection is validating server certificates. Browsers also.. more »

Forefront TMG 2010 introduced URL filtering, which enables administrators to create rules that allow or block access to Web sites based on their categorization in the URL filtering database. When a request to access a Web site is received, Forefront TMG queries the remotely hosted Microsoft Reputation Service (MRS) to determine the categorization .. more »

While acting as proxy, Forefront TMG can allow or deny Web traffic originating from the protected web clients. In case of denied traffic Forefront TMG sends to the client an error page to display in the browser. The page contains basic information about the reason the traffic was denied: The major limitation of these pages (in Forefront TMG RTM) is .. more »

How to Configure ISA SSL Bridging for System Center Configuration Manager Internet-Based Client Management has been updated with the following information: How to Request a Certificate With a Custom Subject Alternative Name Note:  HTTP methods for the Internet-based software update point are not included because the HTTP verbs used by WSUS are not d.. more »

. The U-Prove technology, which enables minimal disclosure of identity-related information is considered to be a pioneering effort in enhancing online privacy and security, by analyst firm was honored for its identity federation solution in research and education which was developed together with Microsoft and “Live@Edu”. At UW, we are comm.. more »

Kurt Falde, one of our Support Escalation Engineers, create this summary about the recent definition changes: In the past month the AV definition team have released some much needed changes with regards to AV definition and how they are downloaded to WSUS servers during sync intervals. While the changes do not affect clients from a size perspective .. more »

Update completed! How do you like our new digs?.. more »