Installing and Uninstalling

Upgrading

Administering

Firewall Client

Publishing

Documentation

This document provides information about Microsoft Security and Acceleration (ISA) Server 2006.

Be sure to read the Microsoft Internet Security and Acceleration (ISA) Server 2006 "Quick Start Guide" (Isastart.chm). This guide provides installation instructions and setup prerequisites, describes new ISA Server 2006 features, and details walk-throughs highlighting these features. This document is available from the ISA Server 2006 Autorun page, and is located in the root folder on the ISA Server 2006 CD. In addition, for deployment instructions and information about common scenarios, refer to the solution documents, available at the ISA Server Guidance Web site.

Back to Contents

1. For best security practice, always install the latest updates for your operating system. For information about recent updates that you may need to install, see Microsoft Update.
   
   
2. This release does not support ISA Server 2006 installed on computers running the Microsoft Windows Server Code Name "Longhorn" operating system.
   
   
3. This release does not support ISA Server Management installed on computers running Microsoft Windows Vista operating system.
   
   
4. When you uninstall ISA Server, some files are not completely removed from the computer. The following table lists the files that remain and their location.
   
   

   Folder	File name
   %windir%	IsUninst.exe, Atl71.dll, ismifcom.dll, msvcp71.dll, msvcr71.dll. Enterprise Edition only: \config\adam_isastgctrl.evt
   %windir%\System32	DBmsLPCn.dll, dbmsgnet.dll, dbmsqlgc.dll

5. When ISA Server 2004 is installed on a computer that is running Windows 2000 Server, Microsoft SQL Server 2000 Desktop Engine (MSDE) runs under the Local System account. After you upgrade to Windows Server 2003, MSDE continues to run under the Local System account. However, when upgrading ISA Server, the Microsoft Firewall service runs under the Network Service account. Because the Network Service account does not have permission to access MSDE, the Firewall service does not have access to MSDE, and Upgrade fails. To work around this problem, use the ISA Server 2004 Installation Wizard to uninstall and reinstall MSDE. To do this, follow these steps:
   
   
   1. Click Start, click Run, type appwiz.cpl in the Open box, and then click OK.
      
      
   2. In the Add or Remove Programs window, click Microsoft ISA Server 2004, and then click Change/Remove.
      
      
   3. In the Microsoft ISA Server 2004 Installation Wizard, click Next.
      
      
   4. On the Program Maintenance page, click Modify, and then click Next.
      
      
   5. On the Custom Setup page, expand Firewall Services, and then click Advanced Logging.
      
      
   6. Click This feature will not be available.
      
      
   7. Click Next, and then click Install.
      
      
   8. On the Installation Wizard Completed page, click Finish, and then close the Internet Explorer window that automatically opens.
      
      
   9. Repeat steps 1 through 5, and then click This feature will be installed on local hard drive.
      
      
6. If MSDE has been uninstalled from the ISA Server computer, you will need to reinstall it by running ISA Server Setup, and modifying the installation. Prior to reinstalling MSDE, you should stop the Firewall service. Otherwise, MSDE installation may take up to 45 minutes. Note that the Firewall service will restart automatically when the installation is complete.
   
   
7. Occasionally, some interfaces are not registered during Msfpccom.dll registration, which may result in the user receiving the error message An interface is not registered in the ISA Server Management snap-in. If this occurs, you should unregister (by running regsvr32 –u msfpccom.dll), and then register again (by running regsvr32 msfpccom.dll).
   
   
8. When installing ISA Server Enterprise Edition, several DLLs are installed to the following Windows system folders: C:\WINDOWS\ADAM and C:\\WINDOWS\ADAM\EN.
   
   
9. ISA Server 2006 has been tested on Microsoft Virtual Server 2005 R2 and is expected to be fully functional. However, deployment of ISA Server on a Virtual Server 2005 R2 environment should be limited to testing purposes only. Specifically, we do not recommend a Virtual Server 2005 R2 production environment where ISA Server 2006 is expected to serve as the network firewall.
   
   
10. After installing ISA Server 2006, we recommend that you use the Windows Security Configuration Wizard to harden your Windows infrastructure for ISA Server. For details, see the ISA Server 2006 Security Hardening and Administration Guide. Note the following:
    
    
    • The MSDE logging feature was removed from the Windows Security Configuration Wizard for both ISA Server 2006 and ISA Server 2004. ISA Server now controls MSDE usage.
      
      
    • When hardening the computer manually, the Microsoft ISA Server Storage service on the Configuration Storage server computer must be enabled. You can verify the status of this service in the details pane of the Windows Services snap-in. This change applies to Enterprise Edition only.
      
      
11. When an array member is installed in an array for which NLB is enabled, the ports used by any listeners defined in the array will not be available immediately following the Firewall service restart at the end of the installation. This is due to the NLB configuration needing time to synchronize after adding an array member. After the NLB configuration is synchronized (this may take several minutes), listener functionality should be restored automatically. In some instances, some listeners may not be fully functional even after the NLB configuration is synchronized. Restarting the Firewall service will resolve the issue.
    
    

1. DiffServ support is provided only for Web Proxy clients. DiffServ packets are applied to traffic from transparent clients, but should not be used for packet prioritization for those clients.
   
   
2. ISA Server cannot change the DiffServ priority during a Secure HTTP (HTTPS) session, and the first selected priority remains in effect for the entire session. As a result, the following limitations apply to content tunneled over HTTPS:
   
   
   • The Allow special handling of request and response headers according to this priority option in the Priorities tab is not applicable.
     
     
   • The Apply a size limit to this priority option on the Add Priority property page is not applicable.
     
     
3. The Create Answer File Wizard supports Unicode input. However, because the output answer file is generated in ANSI format, characters used in the input strings must be translatable to ANSI. As such, if your input strings include characters that cannot correctly translate to ANSI, the answer file will not be generated properly. To avoid this, do the following:
   
   
   1. When running the Create Answer File wizard, use an ANSI file path to save the generated file and input placeholders in ANSI characters (such as English) for the following properties: name of site-to-site network for the remote site, preshared key, array name and array description, and path to the certificate
      
      
   2. Open the generated answer file and save the file in UNICODE format.
      
      
   3. Edit the UNICODE answer file and change the strings to their actual values.
      
      
4. The Browse button in the Join Existing Array page of the Create Answer File Wizard is not functional. To enter the name of the array, you must type it in the Array Name text box.
   
   
5. When running Enterprise Edition as an array administrator, selecting to participate in the Customer Experience Improvement program by clicking the Customer Experience Improvement Program link in the details pane, and then selecting the participate option in the Customer Feedback dialog box does not work. For array administrators to participate in the program, they will need to select the option in the array properties, on the Customer Feedback tab.
   
   
6. When running Enterprise Edition, the Configuration Storage server generates the following log files in the Windows system folder: ADAM.log, ADAMUninst.log, and PFRO.log.
   
   

Back to Contents

• This release does not support Firewall clients installed on computers running the Microsoft Windows Server Code Name "Longhorn" or Microsoft Windows Vista operating system. Firewall Client installation is blocked for this operating system.
  
  

Back to Contents

1. Some applications, such as Windows Media Player, Microsoft Office Picture Manager, and Microsoft Outlook Mobile Access, do not support client certificate authentication during an SSL/TLS handshake, and will not be able to authenticate when client authentication is required. As a result, users will get an error message from such applications when trying to access the published content. This issue occurs if the Web listener requires SSL client certificate authentication, or if the Web listener requires forms-based authentication and any of the publishing rules using this Web listener requires an additional SSL client certificate. In some instances, such as for Windows Media Player, the user may be able to save the target of the link to a local folder, and then access the content from that folder.
   
   
2. When Office Communicator Web Access is published using the Web Publishing Rule Wizard, users may experience errors when sending messages. If this occurs, delete the Web publishing rule and create a new rule using the Exchange Web Publishing Rule Wizard instead. In the Select Services page of the wizard, select Outlook Web Access as the Web client mail service you are publishing. After the rule is created, you will need to edit the rule properties and make the following changes: On the Authentication tab, select NTLM authentication. On the Paths tab, delete all Exchange paths, and then type the path /*.
   
   
3. To allow a SecurID cookie to be generated by ISA Server, and then trusted by a SecurID Web Agent, the same domain secret must be shared on the ISA Server computer and the Web Agent. When exporting the domain secret on the Web Agent computer, verify that the Domain name text box in the Manage Domain Configuration dialog is cleared. If a domain name is entered in the text box, a failure will occur when importing the domain secret to the ISA Server computer.
   
   
4. When configuring an Exchange Web client access publishing rule for Exchange Server 2007, the Exchange publishing attachment blocking options in the rule Application Settings property page are not functional.
   
   

Back to Contents

1. When opened from a network share, the pages of the "Quick Start Guide" will not display on a computer running Microsoft Windows Server 2003 with Service Pack 1. To view the "Quick Start Guide," copy the file Isastart.chm to a local directory, and open it from there. For more information and other options, see the Microsoft Knowledge Base article 896054, "You cannot open remote content by using the InfoTech protocol after you install security update 896358, security update 840315, or Windows Server 2003 Service Pack 1."
   
   
2. In the document "Upgrading ISA Server 2004 Enterprise Edition to ISA Server 2006 Enterprise Edition," section "Scenario Four: Load Balanced Array," note the following corrections:
   
   
   • The text "After you complete the upgrade of the Configuration Storage server you need to disable NLB integration for the ISA Server array“ should be changed to: "After you complete the upgrade of the Configuration Storage server, you need to add any additional virtual IP addresses(VIPs), and then apply the changes by clicking the Apply button on the Apply Changes bar. Then disable NLB integration for the ISA Server array."
     
     
   • In the same section, under the heading "Start the NLB service on the ISA Server 2006 array members," there is a step missing. Before starting the NLB service, you must first enable NLB integration.
     
     

Back to Contents

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, people, and events depicted herein are fictitious and no association with any real company, organization, product, person, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2006. Microsoft Corporation. All rights reserved.

Microsoft, Outlook, Windows Server, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries/regions.

Back to Contents