Security (MS)

It isn't here yet but with the amount of information coming out of Microsoft about it lately, I suspect it will be out soon. I've put the entries important to me in bold.

SP1 - New and improved features:

Configuration Change Tracking — logs all configuration changes applied to ISA Server configuration to help you backtrack through your change history. (aka - the 'Who broke it' tracker)

Web Publishing Rule Test Button — helps you verify that the rule configuration agrees with what is set at the published web server and provides specific suggestions when they disagree.

Traffic Simulator — simulates network traffic as it would be seen by the ISA rules engine and gives you specific information about traffic processing along the way.

Diagnostic Logging Query — an extension to the Diagnostic Logging feature provided in the Supportability Pack, this feature makes it much easier to see only the data that is relevant to the current troubleshooting effort.

Support for Network Load Balancing (NLB) multicast and multicast with IGMP operations (KB 938550)

Support for certificates with multiple Subject Alternative Name (SAN) entries in published web servers (Exchange 2007 and OCS 2007 admins will enjoy this)

Kerberos Constrained Delegation (KCD) authentication supports trusted-domain user accounts (KB 942637)

Read more information about it here.

Only do this as a last resort for a problematic application because it opens up security restrictions in a bad way on a computer system.

To disable UAC remote restrictions, follow these steps:

1. Click Start, click Run, type regedit, and then press ENTER.
2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
3. If the LocalAccountTokenFilterPolicy registry entry does not exist, follow these steps:
a. On the Edit menu, point to New, and then click DWORD Value.
b. Type LocalAccountTokenFilterPolicy, and then press ENTER.
4. Right-click LocalAccountTokenFilterPolicy, and then click Modify.
5. In the Value data box, type 1, and then click OK.
6. Exit Registry Editor.

The LocalAccountTokenFilterPolicy registry entry in the registry can have a value of 0 or of 1. These values change the behavior of the registry entry to the behavior that is described in the following table.

Value
0 This value builds a filtered token. This is the default value. The administrator credentials are removed.
1 This value builds an elevated token.

You can read more about this in detail, here.

I had the pleasure of testing this during the alpha stages and had a hard time finding bugs in the product, which is a good thing. If you are using Forefront Client Security and Server 2008, and want to integrate NAP functionality with FCS, look into the integration kit here.

Official description:
This Solution Accelerator is a collection of software components and guidance that you can use to configure a compliance health policy for computers that run Forefront Client Security. Network administrators can use this Accelerator to assess the health of these computers before they are granted network access. If a computer is not compliant with the health policy for Forefront Client Security, it can be isolated to a restricted network until it is properly remediated. These capabilities are enabled by the new NAP feature in Windows Server 2008.