在 Microsoft 的新系统 Windows 8 中的许多既有功能，若没有被大肆的重新改造过，都至少经过一些细微的调整，其中也包括了目前尚未公布的新版 Windows Explorer 程序。有如其它的 Windows 8 程序，这次已经用了 N 年没变的 Windows 档案管理程序，加入了当年首度出现在 Office 2007 上的「Ribbon 接口」，也对触控操作变得更为友善。不过别担心宝贵的屏幕空间将被巨大按钮所压缩，下一代的 Explorer 透过将详细数据窗口安排至窗口右侧等排版调整，使其比起前版的 Windows 7 可显示更多的档案内容。还将「上层」按钮再度回到功能列及加入了许多新的快捷按键设定（看来又有得背了）。快从引用来源中观看更多相关细节与示范影片吧！

您也许喜欢：
Windows 7 SP1测试版发布	HTC HD2 的（非官方） Windows Phone 7 ROM 发布	Windows 7 + Windows Live 新站点: To The Cloud	Windows7的新激活补丁已经发布	Windows 7 RC将在3月1日到期
无觅

2007 = $AdminSessionADSettings.ViewEntireForest = $true

2010 = Set-AdServerSettings -ViewEntireForest $True

or use –ignonreDefaultScope on the command if applicable, i.e.

get-mailbox –ignonreDefaultScope

http://technet.microsoft.com/en-us/library/bb124527.aspx

How can this be made permanent ?

you could add it to the personal EMS startup

Default Location:

My Documents\WindowsPowerShell\profile.ps1

您也许喜欢：
Exchange 2007批量修改用户邮箱的属性	How to view members of a dynamic group using powershell	下载Exchange Server 2010 SP1	如何使用Powershell发送Html邮件	25个常用的Powershell命令
无觅

Forefront Threat Management Gateway (TMG) 2010 supports several protocols for establishing a site-to-site (LAN to LAN) VPN, including PPTP, L2TP, and IPsec. Of these, IPsec is the only supported protocol for establishing site-to-site VPN connections with third-party VPN devices such as Cisco PIX and ASA. In this post I will demonstrate how to configure Forefront TMG and the Cisco PIX/ASA to create a site-to-site VPN for the following branch office deployment scenario:

[Note: Site-to-site VPN in TMG is supported only in multi-homed network configurations. The TMG firewall must be configured with a minimum of two network interfaces to function as a site-to-site VPN gateway.]

Configuring the TMG Firewall

Open the TMG management console and highlight the Remote Access Policy (VPN) node in the navigation tree, then select the Remote Sites tab in the main window. In the Tasks pane on the right side, click Create VPN Site-to-Site Connection.

The Site-to-Site Connection Wizard will collect the necessary information to establish the VPN tunnel. Enter a descriptive name when prompted.

Select IP Security protocol (IPsec) tunnel mode.

If the TMG firewall is a member of an array that does not have Network Load Balancing (NLB) enabled, select a node to be the connection owner. If NLB is enabled, the connection owner is assigned automatically. [Note: When configuring a site-to-site VPN connection on a TMG firewall that is a member of an array and NLB is not enabled, hosts that are accessed via the tunnel must be configured with a default gateway or static route that will direct traffic back to the array member chosen as the connection owner.]

Enter the IP addresses of the remote and local VPN gateways. The remote VPN gateway IP address will be the IP address assigned to the outside network interface on the Cisco PIX/ASA firewall. The local VPN gateway IP address will be the IP address assigned to the External network interface on the TMG firewall. If the TMG firewall is part of an NLB-enabled array, specify the Virtual IP (VIP) address assigned to the External network of the array.

Certificates are the most secure and preferred method for authenticating tunnel endpoints, but because they are more complex and difficult to configure, many security administrators opt instead to use pre-shared keys. When choosing a key, be sure it is very long and complex (up to 128 characters – it is a good idea to use a random password generator for this task). Although using special characters is an excellent idea for complex keys, avoid using the question mark as the PIX and ASA object to this.

Add the address range(s) of the remote site network(s). It is recommended that these addresses be configured along subnet boundaries.

A network relationship needs to be established between the Internal network and the remote site network. The wizard automatically establishes a route relationship between these two networks.

An access rule is required to allow communication between the Internal network and the remote site network. If this is a fully trusted remote network (e.g. branch office), select all outbound traffic. If the remote network is untrusted (e.g. business partner), specify which protocols and ports are allowed.

Review the configuration and select Finish.

Do not apply the configuration now. The default encryption settings chosen by TMG are incompatible with the Cisco PIX and ASA. To change these settings to match the settings on the PIX/ASA, right-click the remote site and choose properties. Choose the Connection tab and then click IPsec Settings.

For the Phase I settings, change the Encryption algorithm to 3DES, the Integrity algorithmto SHA1, and the Authenticate and generate a new key every: to 86400 seconds (24 hours).

For the Phase II settings, change the Encryption algorithm to 3DES and the Integrity algorithm to SHA1. Change the Session key settings so that a new key is generated every4608000 Kbytes or 28800 seconds (8 hours).

Once complete, save and apply the changes.

Configuring the Cisco ASA 7.x

Connect to the ASA with administrative privileges and enter enable mode. To configure the management connection (phase 1) parameters, establish an ISAKMP policy and set the parameters to use a pre-shared key, use 3DES/SHA for encryption and integrity, specify the use of Diffie-Hellman group 2 (1024-bit) and authenticate and generate a new key every86400 seconds (24 hours).

crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp enable outside

Configure a tunnel-group for the remote peer and establish authentication using a pre-shared key.

tunnel-group 63.166.231.17 type ipsec-l2l
tunnel-group 63.166.231.17 ipsec-attributes
pre-shared-key mMWsT0umh_UQmh]yevjNBW_F

For the data connection (phase 2) create an access rule that defines which traffic to protect using this tunnel. In this example, create an access rule that defines all IP traffic going from10.12.0.0/24 to 172.16.1.0/24.

access-list branch_office extended permit ip 10.12.0.0 255.255.255.0 172.16.1.0 255.255.

Create a NAT rule to exempt any traffic matching this access rule from NAT.

nat (inside) 0 access-list branch_office

Define which encryption algorithms will be used to protect this traffic. In this example specify the use of 3DES and SHA1.

crypto ipsec transform-set branch_office esp-3des esp-sha-hmac

Build the crypto map, indicating that any traffic that matches the branch_office ACL is sent to the specified remote peer using the encryption algorithm defined in the brach_office transform set with Perfect Forward Secrecy (PFS) enabled using Diffie-Hellman Group 2.

crypto map branch_office_map 1 match address branch_office
crypto map branch_office_map 1 set pfs group2
crypto map branch_office_map 1 set peer 63.166.231.17
crypto map branch_office_map 1 set transform-set branch_office

Activate the crypto map on the ASA’s outside interface.

crypto map branch_office_map interface outside

Configuring the Cisco PIX 6.x

Creating a site-to-site VPN connection on a Cisco PIX is similar but slightly different than configuring an ASA. For example, when configuring the management connection (phase 1) parameters using the same configuration used previously, use the following commands:

crypto isakmp policy 10 authen pre-share
crypto isakmp policy 10 encrypt 3des
crypto isakmp policy 10 hash sha
crypto isakmp policy 10 group 2
crypto isakmp policy 10 lifetime 86400
crypto isakmp key mMWsT0umh_UQmh]yevjNBW_F address 63.166.231.17 netmask 255.255.255.255
crypto isakmp enable outside

Create the access rule defining which traffic to protect using this tunnel.

access-list branch_office permit ip 10.12.0.0 255.255.255.0 172.16.1.0 255.255.255.0

Exempt this traffic from NAT.

nat (inside) 0 access-list branch_office

Protect this traffic using 3DES and SHA1.

crypto ipsec transform-set branch_office esp-3des esp-sha-hmac

Build the crypto map.

crypto map branch_office_map 1 ipsec-isakmp
crypto map branch_office_map 1 match address branch_office
crypto map branch_office_map 1 set peer 63.166.231.17
crypto map branch_office_map 1 set transform-set branch_office
crypto map branch_office_map 1 set pfs group2

Activate the crypto map on the PIX outside interface.

crypto map branch_office_map interface outside

Unlike the ASA, the PIX requires an access rule to allow tunneled traffic to cross the firewall. For the branch office scenario (fully trusted network), allow all IP traffic from the172.16.1.0/24 network to reach the 10.12.0.0/24 network and assign that access rule to the outside interface.

access-list main_office_in permit ip 172.16.1.0 255.255.255.0 10.12.0.0 255.255.255.0
access-group main_office_in in interface outside

Due to formatting issues, some of the text in the PIX and ASA command examples may be truncated. You can download the script files for these examples here: PIX | ASA.

您也许喜欢：
替代Cisco Vpn CLient	Forefront Threat Management Gateway (TMG) 2010 Troubleshooting Survival Guide	The Windows Cluster service encountered an error during function OpenCluster	ChengDu Video	Windows Phone 团队内部庆祝 RTM，并举办 iPhone、黑莓葬礼
无觅

We encourage you to enhance this guide by identifying missing areas (scenarios, features, lifecycle…), provide links to and write descriptions of existing content, and providing new content where there are gaps.Join the community!

Introduction
Troubleshooting Tools
Troubleshooting Setup
Troubleshooting Outbound Access
Troubleshooting Performance
Troubleshooting E-Mail Protection
Troubleshooting VPN
Troubleshooting Report
Troubleshooting Web Publishing
Introduction
When approaching to troubleshooting any product there are some general guidelines that should be followed. The WSUS Troubleshooting Survival Guide has the seven core steps that should be used. When the subject is TMG, there are many areas that can be explored from the troubleshooting standpoint. This article will cover the main areas and you can expand by adding new areas with core troubleshooting techniques.

Troubleshooting Tools

Forefront TMG 2010 comes with a built in set of tools that can help you to troubleshoot a great variety of scenarios. Those options are located in the Troubleshooting pane as shown in the figure below:

The Troubleshooting pane has the following options:

• Change Tracking – allows you to enable the capability to track all the changes that are done on TMG. Check a demo of this feature on ISA Server 2006 SP1 here.
• Traffic Simulator – allows you to troubleshoot access rule, web publishing and server publishing rule by simulating a network traffic that will test one of those scenarios. Check a demo of this feature on ISA Server 2006 SP1 here.
• Diagnostic Logging – this feature was first introduced in ISA Server 2004 SP3 and it helps to deeply understand each step of the packet evaluation on TMG. Check a demo of this feature on ISA Server 2006 SP1 here.
• Connectivity Test – performs a simple test against a specific URL.

Note: You can also find an overview of each one of those options on the article Overview of the TMG Firewall’s Troubleshooting Node.

Besides those options there is also an important tool that can be used for proactive and reactive scenarios, this tool is called TMG Best Practices Analyzer. In addition to those direct related TMG tools, there are also other tools that can be very useful while troubleshooting TMG issues, here are some examples:

• Network Monitor: this tool can assist you analyzing packages and have a good understanding of what’s going on in the TCP/IP level. Here are some sample scenarios where this tool was used:

o    Error 64 – From the Field to the Classroom

o    Error 64 “ The specified network name is no longer available” while browsing Internet through ISA Server 2006

• TCPView: this tool can assist you by viewing the TCP connections between localhost and different systems. Is similar to netstat –nao command but in a graphic interface. Here a sample scenario where this tool can be used: Unable to Access HTTPS Sites behind TMG 2010
• Process Monitor: when dealing with Performance issues on TMG, Process Monitor can be a very useful tool for an initial assessment and identification of potential culprits. Here are some sample scenarios where this tool was used:

o    Another Case of High CPU Utilization by wspsrv.exe on Forefront TMG 2010

o    Unable to Install ISA BPA

• HTTPWatch: this is a great tool that allows you to see the content of pages that are using https and troubleshoot issues involving web access or web publishing rules. Here a sample scenario where this tool can be used: Error “Object doesn’t support this property or method” while browsing a site published by ISA Server 2006.
• WinDBG: this tool can be used in scenarios where you need to analyze a dump that was gathered during a crash or hang. It can also be used to attach to a process and get more information about that particular process. Here are some sample scenarios where this tool was used:

o    ISA Server 2006 Firewall Service not starting

o    The Curious Case of TMG Stopping Responding in Random days but always during the Morning

Troubleshooting Setup

Now that you know the most common tools to troubleshoot issues on Forefront TMG, it’s time to have a look on how you should approach in order to troubleshoot TMG Setup. Forefront TMG setup introduces a tool called Preparation Tool that assists to install TMG’s pre-requisites components. After the OS is fully prepared the next phase is to install TMG’s components. During the whole setup process TMG stores log’s information at %windir%\temp, the logs that are added to this folder can be found it here.

At this point in time that we already have Forefront TMG 2010 SP1 and many other updates, it is recommended to always run on the latest and greatest version. One way to start Forefront TMG installation by having at least Service Pack 1 is by slipstreaming TMG with SP1, the procedure to do that can be found ithere. If you decide to install Forefront TMG 2010 RTM, test the functionality and just after that install SP1 you also can. If you have problems to install Forefront TMG SP1 follow this article.

Here are some important articles that outline major installation issues and how to solve those:

• Unable to Install Forefront TMG – “A computer restart is required” warning message
• Troubleshooting ERROR: Setup failed to install ADAM.\r\n (0x80074e46) and 0×80070643 while trying to install TMG 2010
• Another TMG 2010 Installation failure with error 0×80070643
• Unable to install Forefront TMG 2010 – Error 0x80074e46

Setup issues are not always related to the TMG installation itself, sometimes a setup also means the lack of capability to join a new TMG to an existing array. Here are some important articles in this area:

• Unable to join a new Node on an existing TMG 2010 Array
• TMG Quick Tip: Unable to Join a TMG to an Existing Array
• Resolving TMG Array Join Failures – Reporting Server Leftovers

Troubleshooting Outbound Access

When troubleshooting Outbound Access on TMG you must understand which area of TMG you should focus first. But even before that you will need to understand the problem and that’s why those seven steps mentioned in the beginning of this article are so important. To determine which area of TMG you should focus while troubleshooting Outbound Access, ask questions, for example: what’s the error message that the client receives when tries to browse to the web site that doesn’t work? Is this the only user experiencing this problem? Does the problem happens all the time or it’s random? Is this the only web site that this user cannot access? If this user logs on in another workstation, does the problem happen? Does the issue happen using any Browser? Does the issue happen when bypass TMG? The answer for those questions can lead to a more narrowed scenario where you should understand which feature or which setting could be causing this problem. Even better, you could just determine that the issue is not caused by TMG at all.

The core features used in the Secure Web Gateway scenario (Outbound Access) are specified in the table below:

Feature

Troubleshooting Approach

Common Problems (Samples)

URL Filtering

Troubleshooting URL filtering

• Unable to block access for a web site using URL Filtering Override option on TMG 2010

HTTPS Inspection

Troubleshooting HTTPS inspection

• "Page Cannot Be Displayed" error when you try to access a website that requires a client certificate authentication on a Forefront TMG client in Forefront TMG 2010 if HTTPS Inspection is enabled
• Common Problems while Implementing HTTPS Inspection on Forefront TMG 2010

NIS

Troubleshooting NIS

• Another Case of High CPU Utilization by wspsrv.exe on Forefront TMG 2010

Besides those three core features there are other areas of Outbound Access that also needs attention:

• Authentication: outbound authentication issues can happen for a variety of reasons. There are ways to improving web proxy client authentication performance, which are the same as used in ISA Server 2006. Some settings are well known to cause authentication problem, such as the “Require All Users to Authenticate”. The approach explained in this article is still valid for TMG when dealing with this setting. Besides this option here are some other examples of troubleshooting authentication issues on TMG:

o    Troubleshooting Authentication Issues in ISA Server Using Net Logon Logging

o    Random authentication prompts while accessing internet through ISA Server followed by ISA Server becoming unresponsive

o    Understanding Why ISA Server re-prompts for Authentication when Passwords Expire

o    Another Case where Users are randomly prompted for Authentication while Browsing Internet through ISA Server 2006

o    Troubleshooting Intermittent Pop-up Credentials in ISA Server 2004

• Caching: sometimes the object that you see while browsing Internet through TMG might not be what you are expecting. Caching issues can also be treated as an important part of Outbound Access troubleshooting. Here are some important articles in this area:

o    Files larger than 512MB are not served from cache after ISA Server firewall service is restarted

o    Unable to download files larger than 4GB through ISA 200x – works fine in TMG

Troubleshooting Performance

When troubleshooting performance issues on TMG it is important to look outside of TMG itself and make sure to have a broader view of the system where TMG is installed as well as the environment. Performance issues on TMG can be located at the OS level itself or an outside element, such as network environment.  The core elements to address are:

By analyzing the OS components in first hand you can eliminate potential issues that are affecting TMG. Performance Monitor is one of the best ways to address issues of this nature, the main counters to be used in this area are:

• All TMG Counters/*
• Memory/*
• Processor/*
• Network Interface/*
• Process/*
• Physical Disk/*
• Threads/*

Use TMG PAL template in order to analyze the data captured using Performance Monitor, this tool can facilitate the analysis process by giving you a comprehensive report highlighting the main findings.  In some scenarios it is not possible to have a conclusive result based only on Perfmon data, in those cases you might need to capture user or kernel memory dump in order to find out the root cause of the problem. To capture dump you can use the same approach from the article “We are all waiting for you Mr. Disk….are you there?” and once you have the dump you can use the Troubleshooting Forefront TMG 2010 Performance issues Cheat Sheet to analyze it.

The most common causes of performance issue on Forefront TMG are:

• Disk

o    How Disk Bottleneck can affect TMG Performance?

• DNS

o    Side Effects of Incorrect DNS configuration on ISA Server: 10060 Connection Timeout Scenario

• Inappropriate Rule Set

o    ISA Server 2006 stops answering requests

• Third Party Applications

o    Isolating problems that seems to be related to the ISA Server – Part III

o    ISA Server Stop Answering Requests and Firewall Service Hangs

o    TMG Hangs and requires a manual restart

• Sizing

o    Port Exhaustion on ISA Server 2006 while Publishing Outlook Anywhere

• Network

o    What can happen when you think that only Windows system needs to be patched

o    Understanding a scenario where TMG drops the packet as spoofed even when the source IP doesn’t belong to the internal network

• Windows Settings

o    Another performance caveat when troubleshooting TMG or ISA slow browsing behavior

• TMG Logging

o    Intermittent Performance Problem while Accessing Internet through ISA Server 2006

• Authentication

o    Hey DC, are you still there?

Troubleshooting E-Mail Protection

E-Mail Protection feature on TMG is a combination of Forefront Protection for Exchange and Exchange Edge on the same server as TMG is installed. If you don’t have those products you shouldn’t enable E-Mail Protection feature in the first place, this will cause issues. It is strongly recommended to review the E-Mail Protection requirements before enable this feature. Currently (TMG 2010 SP1 + Updates) requires that ALL configurations MUST be done via TMG 2010 Console. When the user changes something that TMG has no control of, TMG doesn’t care and it is up to the user to make sure the settings are duplicated across the array. However if the user tries to change something that TMG controls it may lead to an invalid configuration and cause TMG to function incorrectly. Therefore TMG will not permit such a change. It will remove the user’s changes by resetting Exchange configuration back to the one in TMG storage. To check for changes we will use ADAM’s built-in support for “checkHighestUSn”, an LDAP query that queries the entire ADAM structure for the highest USN. Changes done directly on Exchange Edge Console/Powershell or FPE Console/Powershell will be overwritten by TMG. When this happens the following alert will appear on TMG:

Here it is a list of the top five more common problems while configuring/administering TMG E-Mail Protection:

Scenario 1: making change directly on Exchange Edge or FPE

• Result: Forefront TMG Managed Control Service might fail to start with error 0×80070057.
• Solution: remove the changes that were manually added to Exchange or FPE.

Scenario 2: IPs getting populated on the IP Block List directly on Exchange

• Result: Forefront TMG Managed Control Service stops and fail to start with error 0×80070057
• Solution: disable Sender Reputation feature via TMG Console (under Spam Filtering).

Scenario 3: Installing Exchange 2010 SP1 Slipstream during the installation of E-Mail Protection Pre-Reqs

• Result: Forefront TMG Managed Control Service might fail to start with error 0×80131500 .
• Solution: don’t use Exchange 2010 SP1 Slipstream while installing the pre-reqs for E-Mail Protection. Use RTM and apply SP1 after having TMG 2010 SP1 Update 1.

Scenario 4: Action: Trying to make changes on settings that are not exposed via TMG Console directly via FPE or ExchangeEdge

• Result: Forefront TMG Managed Control Service will overwrite the option and undo the change.
• Solution: don’t use the options that are not exposed via TMG Console

Scenario 5: Action: Install Exchange 2010 SP1 on an a Server using E-Mail Protection feature and having TMG 2010 SP1 on it

• Result: Forefront TMG Managed Control Service might fail to start with error 0×80070057
• Solution: Install TMG 2010 SP1 Update 1

Keep in mind the following points while troubleshooting E-Mail Protection issues:

• TMG Live Logging just shows the SMTP connections coming in and out, nothing more than this.
• TMG Live Logging will be useful is to validate if SMTP connection is established or not and which rule is hitting.
• TMG Trace (using TMG Data Packager) will go a little further, but not much since it only logs the changes that are applied to the system.
• Is okay to use Powershell commands or other tools for Data Gathering purpose, as long as is for read only purpose is okay. Direct changes via Powershell on Exchange Edge or FPE will be overwritten by TMG.

TMG Trace (gathered via TMG Data Packager) most likely will not be helpful in the following scenarios:

• Mail flow issues or NDRs

o    An Exchange Edge expert should be involved.

• Messages are getting incorrectly stamped as SPAM or getting dropped due virus detection

o    Identify which setting is controlling that and engage the correct engineer (FPE or Exchange)

Besides that you also have the following articles that can be used while troubleshooting E-Mail Protection on TMG:

• The Exchange Edge default Receive connector gets unexpectedly disabled even though the Email policy is not configured
• Unable to Add an Additional IP on Receive Connector on Exchange Edge when using E-Mail Protection feature on Forefront TMG 2010
• TMG E-Mail Protection Feature x Exchange 2010 SP1

Troubleshooting VPN

The VPN feature on Forefront TMG is totally based on Windows Server 2008 functionality, in other words, it depends on RRAS functionality. This means that using the traditional Windows Server Routing and Remote access troubleshooting approach is valid.

VPN Client Access

Here are some resources to assist you during the VPN Client access troubleshooting:

• Troubleshooting Tips for VPN Client Access
• VPN users are unable to browse the Internet when connected to TMG and the web browser is configured to “automatically detect settings”
• More than one L2TP VPN connection from behind a NAT device fails with error 809 when TMG 2010 has been configured as a VPN Server

Site to Site VPN

Here are some resources to assist you during the VPN Site to Site troubleshooting:

• How TMG Data Packager can assist you troubleshooting VPN Site to Site Issues
• Troubleshooting VPN over IPsec
• Clients are unable to access shares on a remote network when using TMG as VPN Server in a Site to Site Scenario

Troubleshooting Report

When troubleshooting reporting issues there are three core areas that need attention:

• Reporting configuration
• Report generation
• Summary reports.

The general troubleshooting report framework can be found in this article. Some issues arise when TMG 2010 SP1 was launched, such as the one explained in the TMG Reports stop working after installing TMG 2010 SP1blog post. Here are some other related articles on reporting issues:

• The user activity report for a user account is blank in Forefront TMG 2010 SP1 if the name of the user account has a space
• Forefront TMG 2010 does not generate reports if a disjoint namespace exists in the domain

Troubleshooting Web Publishing

Forefront TMG 2010 has a set of features that can assist you while deploying a scenario that requires high availability. Here are some core TMG functionalities in this area:

Outlook Web Access (OWA)

Use the core troubleshooting methodology exposed in the article Troubleshooting OWA 2007 Publishing Rules on ISA Server 2006, although the article is for ISA the steps there does apply to TMG. In addition to that, keep in mind the following common problems:

• The Case of Eternal Loop while Publishing OWA through ISA Server 2006
• Unable to Logon Using Forms Base Authentication through ISA Server 2006
• The Redirect Catch
• The Redirect Catch – Another one…
• External users receive 500 internal Server Error with the URL denied by an ISA 2006 Server when you try to publish OWA using CAC and Client Certificate Authentication

SharePoint

Most of the issues publishing SharePoint through TMG are similar to what we used to have in the past with ISA, which is how to proper configure AAM. Here an example of this scenario: Unable to “Check Out” a Document in MOSS 2007 Published Through ISA Server 2006. In addition to that it is always recommended to use TMG Data Packager to troubleshoot issues of this nature.

Authentication

Authentication issues in a publishing scenario are usually caused by one of the following components:

A – Client to TMG Authentication

• When client is trying to authenticate against TMG in a publishing scenario you must choose an authentication method that it supported by the client, for example: in the scenario above you have the laptop that is trying to access OWA and a mobile device that is trying to synchronize via Active Sync. If you publish Exchange using Forms Based Authentication for the OWA and use the same rule for Active Sync it will work because FBA falls back to Basic and Active Sync supports basic. Of course the assumption is that you are using HTTPS to avoid passing clear text using Basic Authentication. The most relevant authentication settings in this scenario (A) are located in the Web Listener.

B – TMG to published Server

• The delegation authentication that TMG uses against the published server, for example when you are publishing OWA and choose Basic as delegation you must make sure that the Exchange CAS Server is also using basic for OWA folder. The delegation must match with the published server. The most relevant authentication settings in this scenario (B) are located in the Publishing Rule / Delegation Tab.

C – TMG to Authentication Repository

• What authentication repository are you using, DC, RADIUS, LDAP? Authentication issues easily happen in this communication. For example, if you are publishing a resource using LDAP Authentication you might face SSL issues that are covered in the article Troubleshooting Forms Base Authentication using Secure LDAP Authentication on ISA Server 2006.

Other sources of investigation in the authentication scenario are described below:

• KCD with Cross-Forest Accounts
• ISA Server 2006 form base authentication problem using UPN logon format on a multiple domain environment

Password Management

When using the built-in functionality of providing users with a warning message and a password change prompt, in case their passwords have expired, or are about to, you may encounter difficulties if your domain uses a fine-grained password policy.

Microsoft Forefront TMG and ISA do not support the use of fine-grained password policies.

Call of Action

This is a living document that we are starting now and giving it to you as a base to expand it. Do you want to get engaged on this? Make sure to read the guidelines from Wiki: How to Contribute and have a great time helping the community to grow.
Note: do not add troubleshooting articles in this Survival Guide, we are working to build a Troubleshooting Survival Guide for Forefront TMG 2010. Once we have it we will post it here.

This article was originally written by:

Yuri Diogenes, Senior Technical Writer
Windows Server iX | IT Pro Security
Microsoft Corporation
——–
Yuri’s Blog: http://blogs.technet.com/yuridiogenes
Team’s Blog: http://blogs.technet.com/b/securitycontent
Twitter: http://twitter.com/yuridiogenes

您也许喜欢：
Configuring Site-to-Site VPN with Forefront TMG and Cisco PIX and ASA	替代Cisco Vpn CLient	Windows 7 远程服务器管理工具	如何检测Memory Leak	GPMC: An unknown error occurred while the HTML report was being created
无觅

最近公司部署了基于微软DFS技术的文件服务器。其中最吸引人的技术恐怕就是DFSR（DFS Replication）了。但是经过一段时间的运营，用户在抱怨为什么其他省的文件，自己却看不到？经过一番查找，发现问题居然是，这些文件的属性是Temporary（临时性）的。而DFSR默认的设计，则不会阀值这些带有Temporary属性的文件，并且DFSR的这个特性目前为止还不能配置（2008R2）。

事实上，你根本无法轻易的看到一个文件的文件属性是否是Temporary的。甚至微软提供的一些命令行，例如Attrib.exe，FileSystemObject或者WMI中的CIM_Datafile都无法查看一个文件的Temporary属性，更悲情的是：DFSR本身对这些文件的处理（不同步）不会留下任何的Log，对DFSR来讲，这更不是一个Error或者是Bug了，因为本身就是这么设计的。

理论上，这些文件Temporary属性的文件是指只会临时性使用的文件，而不是用户想要真正存档的，DFSR不复制这些文件是基于提升整个复制效率来考虑的，同时，应用程序为了提升自我的处理效率，也必然会产生大量的临时属性文件。当应用程序要创建一个文件（CreateFile）时，可以使用FILE_ATTRIBUTE_TEMPORARY来创建一个temporary属性文件，但更好的方式是同时指定FILE_FLAG_DELETE_ON_CLOSE属性，这样当程序所有的进程都关闭的时候，temporary文件也可以被删除。

但事实上在Leo的实际生产环境中，用户正常的Office文件，Adobe PDF文件等许多的文件都莫名奇妙的有了Temporary属性，事实这些文件都一定是要被复制到DFS的其他服务器上；于是，Leo只能需求去掉Temporary属性的方法。

使用Fsutil命令查看Temporary属性。

Fsutil是包含在Windows系统中的一个命令工具，用法：

fsutil usn readdata c:\data\test.txt

Major Version : 0x2
Minor Version : 0x0
FileRef# : 0x0021000000002350
Parent FileRef# : 0x0003000000005f5e
Usn : 0x000000004d431000
Time Stamp : 0x0000000000000000 12:00:00 AM 1/1/1601
Reason : 0x0
Source Info : 0x0
Security Id : 0x5fb
File Attributes : 0x120
File Name Length : 0x10
File Name Offset : 0x3c
FileName : test.txt

File Attributes是一个位掩码，表示文件属性的设定值。在上面的例子中，0×120表明为一个临时文件，计算方式是：

0×100 × 0×20 (Archive) = 0×120.

以下列出的文件属性和值的对应表：

这些值结合起来，是文件属性的位码值。

在Debug Log是使用Findstr命令查找Temporary文件。

对于没有复制的文件，DFSR其实是有记录可查的，使用Findstr（包含在windows服务器中的命令工具）通过查找DFSR的Debug Logs中的名为FILE_ATTRIBUTE_TEMPORARY的字段，即可找到哪些文件没有被复制。

首先，因为Log文件被压缩为后缀名为.GZ的压缩包，所以你需要导出所有的DFSR的Debug Logs。默认的log存在于%windir%\debug目录下，找到名为Dfsr*.log和Dfsr*.log.gz解压即可。

假如你导出log到C:\logs下，你可以运行以下的命令查找Temporary文件。

Findstr FILE_ATTRIBUTE_TEMPORARY c:\logs\dfsr*.log

命令会输出包含FILE_ATTRIBUTE_TEMPORARY字段的命令行，如下：

C:\WINDOWS\debug\Dfsr00018.log:20080903 16:14:29.390 1808 USNC 1204 UsnConsumer::ProcessUsnRecord Skipping USN_RECORD with FILE_ATTRIBUTE_TEMPORARY flag:

或者你也可以用记事本等工具打开log文件，使用查找功能，查找FILE_ATTRIBUTE_TEMPORARY字段。

使用Powershell查找Temporary属性的文件。

另外一种更简便的方式是使用PowerShell www.microsoft.com/powershell：

例如我的想找到D:\Data文件夹下面的具有临时文件属性的文件，使用以下的命令：

Get-childitem D:\Data -recurse | ForEach-Object -process {if(($_.attributes -band 0x100) -eq 0x100) {write-output $_}}

使用Powershell移除文件的Temporary属性。

知道了病因，接下来就是对症下药。不过不幸的是，最简单的方式是使用powershell。所以没有Powershell的同学，先去安装一个吧www.microsoft.com/powershell

例如我的想移除D:\Data文件夹下面的所有文件的临时属性，使用以下的命令：

Get-childitem D:\Data -recurse | ForEach-Object -process {if (($_.attributes -band 0x100) -eq 0x100) {$_.attributes = ($_.attributes -band 0xFEFF)}}

您也许喜欢：
Windows Server 2008 R2的DFS及其新特性	Error log: SRMSVC 12306 in FSRM 2008 R2	更新Hyper-v Server 2008 R2 到 Service Pack 1	在windows server 2008中如何使用可靠性监视程序	Windows 7 远程服务器管理工具
无觅