I have been wondering about some ISA server configuration issues such as why restrictions on protocol rules by user group do not work. I have found this to be because these restrictions require the installation of the Microsoft Firewall client. Wish I had known that a couple of weeks ago.