I currently have a an ISA server with Windows XP Pro machines running through the proxy. As machines have been dying we have been purchasing new machines and of course they all come with Windows 7. I have a floor of a couple hundred agents most of which use Windows XP but the select few that get to use Windows 7 get some extra bits that is not intended. Currently if i have an agent log onto a Windows XP machine and have them access say www.espn.com, its blocked. If i have that same agent log off and log onto a Windows 7 machine the user can access www.espn.com. Now the same policies and restrictions apply to the user and being that the ISA policy is a user policy it doesnt change from machine to machine or at least it shouldnt. Now previously when IE7 came out i had to load ADM templates in AD in order to get all of the bells and whistles to correctly manage IE7 and now if i understand correctly, using RSAT or Admin Consoles from Svr2008/Vista/7 it is loaded in automatically and you dont need to load templates anymore. But i cant figure out how a policy that blocks a user on Windows XP doesnt block that same user on Windows 7. I had an agent watching the RAY's game when people werent around and if one of the Owners see's it they will light someone up. Any direction would be great i havent found too much on Google. Thanks,

KEGGLES wrote: I currently have a an ISA server with Windows XP Pro machines running through the proxy. As machines have been dying we have been purchasing new machines and of course they all come with Windows 7. I have a floor of a couple hundred agents most of which use Windows XP but the select few that get to use Windows 7 get some extra bits that is not intended. Currently if i have an agent log onto a Windows XP machine and have them access sayhttp://www.espn.com, its blocked. If i have that same agent log off and log onto a Windows 7 machine the user can accesshttp://www.espn.com. Now the same policies and restrictions apply to the user and being that the ISA policy is a user policy it doesnt change from machine to machine or at least it shouldnt. Now previously when IE7 came out i had to load ADM templates in AD in order to get all of the bells and whistles to correctly manage IE7 and now if i understand correctly, using RSAT or Admin Consoles from Svr2008/Vista/7 it is loaded in automatically and you dont need to load templates anymore. But i cant figure out how a policy that blocks a user on Windows XP doesnt block that same user on Windows 7. I had an agent watching the RAY's game when people werent around and if one of the Owners see's it they will light someone up. Any direction would be great i havent found too much on Google.   Thanks,   Are you sure, that the Win7 machines go to the internet via the same proxy as WinXP machines? Wolfgang

Hi, Your major problem is not Windows 7, based on you description, it’s related to ISA server policy, I recommend you could go to Forefront Edge Security - Firewall Client forum for help. Forefront Edge Security - Firewall Client Forum The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding. Regards, Alex ZhaoPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Well that is the issue. If the same user is receiving the Proxy settings via GPO which is blocking them on IE8 on XP then the same GPO policy is being used when they log onto a Windows 7 IE8. Which means they should both be getting blocked. However the difference is ONLY Windows 7 the browser is the same, the GPO is the same, and the agent is the same; which leaves the OS.

KEGGLES wrote: Well that is the issue. If the same user is receiving the Proxy settings via GPO which is blocking them on IE8 on XP then the same GPO policy is being used when they log onto a Windows 7 IE8. Which means they should both be getting blocked. However the difference is ONLY Windows 7 the browser is the same, the GPO is the same, and the agent is the same; which leaves the OS.     Obviously it is a GPO issue and no Win7 issue. If I read your description correct, your Win7 users don't get the same policies applied that are applied to your WinXP users. There are many possibilities, why a policy is only applied to certain OSs, machines etc even if it's a user policy. Did you create a new policy, which is Win7 compliant after you introduced your first Win7 PC? Because even if your server supports policies for IE8 on Win7 now, that does not mean, that it automatically updates all existing policies to the new Bowser/OS - only newly created policies will create settings understood by IE8/Win7. Therefore you should really follow Alex's advice to post in the mentioned Forefront newsgroup. Wolfgang

Oh i did as soon as you advised. I was just responding to make sure i didnt miss anything to perhaps spark an idea.