Forefront tmg 2010 Network Inspection System & Custom Protocols


Published on

Published in: Technology
1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Forefront tmg 2010 Network Inspection System & Custom Protocols

  1. 1. Forefront TMG 2010 Network Inspection System and Custom ProtocolsTATA Supreme MandalCONSULTANCY Systems EngineerSERVICES LTD. Associate No. 473199 Infospace Bld, UnitechHi- techStructuresLtd.IT/ITes SEZ Block-A 5th, 6th, 7th Floor Tower AI, AII, AIIIPhone :- 0336636 2459FAX: - 033 6636 6600
  2. 2. Forefront TMG 2010 Network Inspection System andCustom ProtocolsAn intrusion detection and prevention system (IDS/IPS) is an essential component of a modern secureweb gateway. The Network Inspection System (NIS) in Forefront Threat Management Gate way (TMG)2010 is a unique implementation of IDS/IPS. NIS is focused specifically on detecting and preventingattacks on Microsoft operating systems and applications. NIS uses signatures that are developed by theMicrosoft Malware Protection Center (MMPC) and are distributed through Windows Update or WSUS.NIS in Forefront TMG 2010 provides protection by performing low-level network protocol inspection.Each packet is analyzed for protocol state, message structure, and message content. When a packet isreceived, NIS will inspect it only after the firewall policy has allowed it, and only after any associated webor application filters have processed it.There is one caveat, however. A custom protocol is not subject to NIS inspection by the Forefront TMGfirewall unless it is associated with a standard protocol. Often a Forefront TMG firewall administratorwill create a custom protocol for a standard protocol that uses a non-standard port. One of the mostcommon protocols to be configured to use non-standard ports is the HTTP protocol. For example, if anadministrator defines a custom protocol to support a web-based application that uses the non-standardTCP port 62112, by default NIS will not inspect this traffic even though the communication is HTTP, aprotocol which NIS normally inspects when it takes place over the standard TCP port 80.To apply Forefront TMG NIS inspection to a custom protocol it must first be associated with a standardprotocol. In our example we’re using HTTP over a non-standard port, so we need to associate our customprotocol with the Web Proxy Filter. TATA CONSULTANCY SERVICES Page 2
  3. 3. Next, associate the custom protocol with a standard protocol definition, in this case HTTP Proxy. TATA CONSULTANCY SERVICES Page 3
  4. 4. Once complete, Forefront TMG NIS inspection will be applied to the custom protocol and policy will beenforced according to the current NIS configuration.Forefront TMG NIS additional information:Enabling and configuring Forefront TMG 2010 NISForefront TMG 2010 NIS Whitepaper [Word Document]Configuring Splunk Universal Forwarder on Forefront TMG 2010Aggregating logged data from security devices such as the Forefront Threat Management Gateway (TMG)2010 firewall is a top priority for many security engineers. Forefront TMG and its predecessor, ISAServer, have always lacked an integrated facility to forward logged data to an external event managementsystem. Often the administrator will have to devise an elaborate process that consists of batch files orscripts that collect firewall and web proxy logs and copy them to another location where they can beconsumed. In the past I’ve demonstrated how third-party utilities can convert firewall log data to thesyslog format as well.Splunk is one of the more popular log management systems in use today, and to make it easier to getForefront TMG log data in to Splunk we can use the Splunk Universal Forwarder. The Universal TATA CONSULTANCY SERVICES Page 4
  5. 5. Forwarder is a utility that installs on the Forefront TMG firewall and monitors the folder containing W3Cformatted text log files. The Universal Forwarder has a small footprint and consumes few resources,making it the ideal method to collect Forefront TMG log data and deliver it to the Splunk indexing serverfor analysis and archiving. The Splunk Universal Forwarder can be downloaded here.Configuring Forefront TMG 2010Before installing the Universal Forwarder, the Forefront TMG firewall must be configured to log to textfile format. To change the log file format, open the Forefront TMG management console and highlight theLogs & Reports node in the navigation tree, select the Logging tab in the center console window, andthen click Configure Firewall Logging in the Tasks pane on the right.Select the option to log to File and choose the W3C extended log file format from the drop down boxbelow. Repeat these steps to configure web proxy logging. TATA CONSULTANCY SERVICES Page 5
  6. 6. When the option to log to text file format is chosen, native Forefront TMG reports cannot be generatedand access to historical log data in the Forefront TMG management console is no longer possible. ClickingOk will generate the following warning message:Reports cannot be generated with the currently selected loggingmethod. To generate reports, use logging to SQL Server Expressdatabases (on the local server).An access rule must be created to allow the Splunk Universal Forwarder to communicate with the Splunkindexing server. The source will be the local host network, the destination will be the Splunkindexing server, and the protocol will be TCP 9997 (outbound), which is the default port used by theSplunk Universal Forwarder. TATA CONSULTANCY SERVICES Page 6
  7. 7. Configuring Splunk Universal ForwarderNext, install the Splunk Universal Forwarder on the Forefront TMG firewall. When prompted, enter thehostname, FQDN, or IP address of your indexing server and specify a TCP port to use (the default is TCPport 9997).Select the option to forward Local Data Only. TATA CONSULTANCY SERVICES Page 7
  8. 8. The Forefront TMG firewall will create new text log files each day and store them in the specified log filesfolder. Specify a Path to monitor by clicking Directory… and selecting C:Program FilesMicrosoftForefront Threat Management GatewayLogs (or the path where your log files are stored, if differentfrom the default). TATA CONSULTANCY SERVICES Page 8
  9. 9. Configure Splunk Indexing ServerOnce the installation is complete, open the Splunk Manager and click Forwarding and receiving.Click the Add new link next to Configure receiving. TATA CONSULTANCY SERVICES Page 9
  10. 10. Configure the indexing server to Listen on this port and enter 9997.Once you’ve configured Splunk to receive data from the forwarder, Forefront TMG firewall and webproxy log data should appear on the indexing server. TATA CONSULTANCY SERVICES Page 10
  12. 12. Integrating WebSense Web Security and Web Filter v7.6 withForefront TMG 2010For customers currently running Microsoft ISA Server 2004 or 2006 with integrated Websense WebSecurity or Web Filter, the options for migrating to Forefront Threat Management Gateway (TMG) 2010have historically been limited. Until recently, Websense provided only limited support for integratingwith Forefront TMG. However, beginning with the release of Websense Web Security/Web Filter v7.6,Websense now provides full support for integrating with Forefront TMG 2010 running on the latestWindows Server 2008 R2 operating system.Integrating Websense Web Security/Web Filter with Forefront TMG is accomplished by installing theWebsense filtering plug-in on the TMG firewall. The plug-in will communicate with external Websensecomponents to provide URL filtering capabilities. Before installing the Websense filtering plug-in on theTMG firewall, install the Websense infrastructure and Web Security/Web Filter components (policyserver, policy broker, filtering service, etc.) on a separate system.Note: This post is intended to provide installation and configuration tips for firewall administrators whowish to integrate Websense Web Security/Web Filter v7.6 with Forefront TMG 2010. It is not meant to be a TATA CONSULTANCY SERVICES Page 12
  13. 13. comprehensive Websense installation guide. For more information on installing and configuring WebsenseWeb Security/Web Filter v7.6, please refer to the Websense Deployment and Installation Centerdocumentation provided by Websense.Policy/Filtering ServerWhen installing the Websense Web Security/Web Filter components, be sure to select the option tointegrate with another application or device.Scroll down and select Microsoft Forefront Threat Management Gateway. TATA CONSULTANCY SERVICES Page 13
  14. 14. The installer will remind you that integrating with Forefront TMG requires a separate Websense plug-into be installed on the TMG firewall.Integration with Forefront TMG requires a Websense plug-in.Complete this installation process and then install theplug-in on the Forefront TMG machine, using the separateForefront TMG plug-in installer. For more information, seethe Installation Guide Supplement for use with MicrosoftISA Server and Forefront TMG.Filtering Plug-In TATA CONSULTANCY SERVICES Page 14
  15. 15. Note: The filtering plug-in for Forefront TMG 2010 is available as a separate download apart from theWebsense Web Security/Web Filter v7.6 installer. It can be downloaded after logging in access rule is required to allow the filtering plug-in to communicate with the Websense filteringservice. Before installing the plug-in, create a rule on the Forefront TMG firewall allowing the local hostnetwork to communicate with the Websense policy/filtering server on TCP port 15868.If you attempt to use the Websense Web Security/Web Filter v7.6 installer to install the filtering plug -inon the Forefront TMG fireall, you will only see the option to integrate with Microsoft ISA Server . If youcontinue anyway, the installation wizard will prompt with the following reminder:Note: If integrating with Microsoft Forefront TMG, a separate installer is used to install the required plug-in on the Forefront TMG machine. Click Help for more information. TATA CONSULTANCY SERVICES Page 15
  16. 16. If you proceed, the installation wizard will stop and generate the following error message:Setup cannot detect Microsoft Internet Security andAcceleration Server installed on this machine. The ISAPIFilter plug-in must be installed on a machine runningMicrosoft Internet Security and Acceleration Server.Once you have downloaded the Websense filtering plug-in for Forefront TMG, installation is simple andstraightforward. Run the installation wizard and provide the IP address of the Websense policy/filteringserver and accept the default port. TATA CONSULTANCY SERVICES Page 16
  17. 17. If the Websense policy/filtering server is not reachable or unavailable you will receive the followingerror message:Filtering Service not found. Make sure the FilteringService is running, or specify a valid address.Verify that you have specified the correct IP address for the policy/filtering server, that it is online andreachable, and that your access rule is configured correctly.During the plug-in installation process it is necessary to stop the Forefront TMG firewall service.Remember that stopping the Forefront TMG firewall service will place the firewall in lockdownmode, preventing normal Internet access. You can stop the firewall service by using the Services MMC,or you can simply open an elevated command prompt and issue the following command:net stop fwsrv TATA CONSULTANCY SERVICES Page 17
  18. 18. After the plug-in has been installed successfully you can restart the firewall service by issuing thefollowing command:net start fwsrvFor Forefront TMG 2010 Enterprise arrays, the Websense Web Security/Web Filter plug-in must beinstalled on each array member. Once you’ve completed the installation of the Websense filtering plug-in you should now be able to create, apply, and enforce URL filtering policies using the Websensemanagement console.Additional NotesDon’t forget to ensure complete filtering coverage for Forefront TMG SecureNAT and Firewall clients bycreating the ignore.txt file in C:WindowsSystem32 that includes the hostname of the TMG firewall inUPPERCASE. For enterprise arrays this must be completed on each array member.Another important point to remember is that the native Forefront TMG URL filtering must be disabledwith integrated Websense Web Security/Web Filter v7.6 to prevent unexpected behavior. You candisable TMG URL filtering by highlighting the Web Access Policy node in the navigation tree, thenclicking the Configure URL filtering link in the Tasks pane and unchecking the option to Enable URLfiltering. TATA CONSULTANCY SERVICES Page 18
  19. 19. Virus/malware scanning, Network Inspection System (NIS), and HTTPS inspection are all compatiblewith Websense Web Security/Web filter v7.6, and having these features enabled is highly recommendedto provide the most complete protection.If you have to uninstall the Websense filtering plug-in for any reason, be sure to use the Add/Removeprograms control panel applet. Removing the filter manually will cause problems for the Websensepolicy and filtering server. Do not remove the filter manually or reset your appliance image/VMsnapshot without uninstalling the plug-in first to avoid these issues.Security Configuration Wizard for Forefront TMG 2010 andWindows Server 2008 R2 SP1Security hardening and attack surface reduction is an important step in preparing a For efront TMG 2010firewall. To accomplish this task, the tool of choice is the Security Configuration Wizard (SCW). In one ofmy articles I demonstrated how to use this tool to properly configure the underlyingoperating system to support the Forefront TMG 2010 firewall role. Since the native Windows SCW doesnot include support for the Forefront TMG role, the TMGRolesForSCW.exe utility included in theForefront TMG Tools and SDK is required. This tool was released prior to service pack 1 for Windows TATA CONSULTANCY SERVICES Page 19
  20. 20. Server 2008 R2 and does not include a template that works correctly out of the box. When you attempt toregister the Windows Server 2008 R2 template on a system with SP1 installed you will receive thefollowing error:Command completed with error.The parameter is incorrect.Please check log file(s) under the following directory:%windir%securitymsscwlogsTo resolve this issue, create a copy of the template file SCW_TMG_W2K8R2_SP0.xml and name itSCW_TMG_W2K8R2_SP1.xml. Open this file with any text editor and navigate to theSCWKBRegistrationInfo node (line 2). Change the value of ServicePackMajorVersion from “0” to “1”and save the file. Register the template using the following command:scwcmd register /kbname:TMG /kbfile:scw_tmg_w2k8r2_sp1.xmlContinue using the SCW to configure and apply a security template to your TMG firewall following theinstructions in my article.Vulnerability in the Forefront TMG 2010 Client Could AllowRemote Code ExecutionIt is extremely rare to see a security update for anything relating to the Forefront TMG firewall. However,the June 2011 security bulletin includes update MS11-040 that addresses a privately reportedvulnerability in the Forefront TMG client that could allow remote code execution. This security update TATA CONSULTANCY SERVICES Page 20
  21. 21. applies only to the Forefront TMG client, not the firewall itself. Also, it does not apply to previousversions of the ISA firewall client.Before applying the MS11-040 update, the latest version of the Forefront TMG client was build7.0.7734.100. After applying the MS11-040 update, the new build number will be 7.0.7734.182.Forefront TMG 2010 Web Proxy Auto Detect FailsRecently I received a call from a customer who was trying to resolve an issue where all web proxy clientsthat were configured to use Web Proxy Auto Discovery (WPAD) with DNS suddenly stopped working.We began troubleshooting by confirming that the hostname WPAD resolved to the internal IP address ofthe Forefront TMG firewall, which it did correctly. Next we used a telnet client to confirm that the TMGfirewall was listening on TCP port 80 (used by TMG for DNS WPAD clients) and indeed it was responsive.A scan of the event logs on the firewall turned up the following warning message: TATA CONSULTANCY SERVICES Page 21
  22. 22. “The Web Proxy filter failed to bind its socket to port 80. This may have been caused byanother service that is already using the same port or by a network adapter that is not functional. To resolvethis issue, restart the Microsoft Firewall service. The error code specified in the data area of the eventproperties indicates the cause of the failure.”Something was listening on TCP port 80, so we opened a command prompt and entered the followingcommand in order to determine which process was listening on this port:netstat –ano | findstr :80 TATA CONSULTANCY SERVICES Page 22
  23. 23. Netstat was reporting that TCP port 80 was in a listening state and bound to the IP address process using this port was the System process (PID 4). This is unexpected, because the ForefrontTMG web proxy service (wspsrv.exe) should be bound and listening on this port. Clearly this was a webservice hijacking this port, so to find out more we entered the following command at a command prompt:netsh http show servicestateThe output of this command revealed a valuable clue. Notice the registered URL below… TATA CONSULTANCY SERVICES Page 23
  24. 24. HTTP:// it turns out, this customer had attempted to change the SQL Reporting Services Web Service URL.By assigning the Forefront TMG firewall’s internal IP address and changing the port to 80 in theReporting Service Configuration Manager, this caused a conflict with the Forefront TMG web proxyfilter, which requires TCP port 80 to provide WPAD for DNS. TATA CONSULTANCY SERVICES Page 24
  25. 25. To resolve the issue, the administrator chose a TCP port other than 80 and restarted the system.Forefront TMG 2010 Configuration Error AlertOn a Forefront Threat Management Gateway (TMG) 2010 firewall you may encounter a ConfigurationError alert like this:The alert description states: TATA CONSULTANCY SERVICES Page 25
  26. 26. “The routing table for the network adapter Internal includes IP address ranges that are not defined in thearray-level network Internal, to which it is bound. As a result, packets arriving at this network adapter fromthe IP address ranges listed below or sent to these IP address ranges via this network adapter will bedropped as spoofed. To resolve this issue, add the missing IP address ranges to the array network.The following IP address ranges will be dropped as spoofed:External:;This alert is the result of the Forefront TMG firewall’s routing table and network definition being out ofsync with each other. In this example, the routing table looks like this: TATA CONSULTANCY SERVICES Page 26
  27. 27. However, the Forefront TMG Internal network definition looks like this: TATA CONSULTANCY SERVICES Page 27
  28. 28. As you can see, the Forefront TMG firewall is configured with an Internal network IP address range of172.16.1.0/24. However, the routing table contains additional static routes that also make the172.16.2.0/24 and networks reachable.To resolve this issue, highlight the Networking node in the navigation tree, select the Networks tab inthe center window, then highlight the network that corresponds to the IP address range contained in thealert. In our example the address range also belongs to the Internal network.Right-click the Internal network and choose properties, choose the Addresses tab, then remove alladdress ranges previously configured. Next, choose Add Adapter and choose the network adapter forthis network. TATA CONSULTANCY SERVICES Page 28
  29. 29. Using this method the IP address range for this network is built using the routing table for the networkinterface. This is the preferred method for defining IP address ranges for Forefront TMG networks. Savethe changes and apply the configuration.For more information on configuring network interfaces for Forefront TMG 2010 firewalls, please refer toJason Jones’ excellent documentation on the subject here:Recommended Network Adapter Configuration for Forefront TMG Standard Edition ServersRecommended Network Adapter Configuration for Forefront TMG Enterprise Edition ServersRelocating SQL Database Files on Forefront TMG 2010When Forefront Threat Management Gateway (TMG) 2010 is installed, an instance of SQL Server 2008Express is included for Forefront TMG firewall and web proxy logging. By default, the log database filesare installed on the system partition, which is less than ideal. Best practices dictate that log data base filesshould reside on a separate, dedicated partition.I’ve had many people ask how to move these database files once the product is installed. Most assumethat the process involves using SQL database management tools to detach the database and manua llymove the database files to a new partition. Not true! Since Forefront TMG handles all of the underlyingSQL database management, the process is actually quite simple. TATA CONSULTANCY SERVICES Page 29
  30. 30. To move the log database files, first create a folder to store them in the new location. Next, open theForefront TMG management console, highlight Logs & Reports in the navigation tree, select the Loggingtab in the center console window, then click Configure Firewall Logging in the Tasks pane on the right.Click the Options… button, then select This folder (enter the full path): and enter the new path to storethe log database files. TATA CONSULTANCY SERVICES Page 30
  31. 31. For EMS-managed or standalone arrays, make certain this path exists on each array member. If itdoes not, the service will not start. If the folder does not exist, TMG will complain.Repeat this process to move the web proxy log database files. In addition, it would be an excellent idea toalso move the Log Queue Storage Folder. This folder should be located on a partition that is separatefrom the one used to store the log database files. For optimum availability this will be a separate physicaldisk, allowing for Forefront TMG to continue logging to the queue even in the event of a physical diskfailure where the log database files are stored. As with the log database files, this folder must exist oneach array member. TATA CONSULTANCY SERVICES Page 31
  32. 32. A system variable can be used to specify the path to log database or log queue files. For example,%LOGDRIVE%FWS, where %LOGDRIVE% can be a different drive letter and path on each arraymember, if necessary. To create a system variable, open the advanced system properties and clickEnvironment Variables…. TATA CONSULTANCY SERVICES Page 32
  33. 33. Under System variables click New…, enter the variable name (e.g. LOGDRIVE), and specify the locationwhere the log files should be stored on this array member (e.g. D:TMGLogs). Repeat these steps on eacharray member, specifying the local path where log database files are to be stored.Confirm the system variable was created properly by opening a command prompt and entering thefollowing command:set logdriveThe output for our example should appear as follows:LOGDRIVE=D:TMGLogs TATA CONSULTANCY SERVICES Page 33
  34. 34. Network Egress Filtering and the RSA SecurID AttackReading details about the recent attack and compromise at SecurID, I was dumbfounded when I cameacross the following:“The attacker then used FTP to transfer many password protected RAR files from the RSA file server to anoutside staging server at an external, compromised machine at a hosting provider. The files weresubsequently pulled by the attacker and removed from the external compromised host to remove any tracesof the attack.”I’m not surprised at all that an attacker was able to infiltrate the RSA private network. However, with thisand myriad similar attacks I’ve read about over the past few years, one thing that consistently amazes meis the relative ease with which attackers can get back out.It appears in this case that RSA allows outbound FTP to anywhere on the Internet. Clearly this is notgood security practice. This is not to say that an attacker couldn’t use another channel to exfiltrate stolendata, but having such generous outbound access rules for file transfer protocols makes it that much easierfor the criminals.To provide better protection from these types of attacks, security policy should be updated to disallowunrestricted outbound FTP access to the general Internet. Following the principle of least privilege,outbound FTP access should be granted only to certain users and to specific sites, and only after it isdetermined there is a business requirement for such access. This access should be reviewed on a periodicbasis. TATA CONSULTANCY SERVICES Page 34
  35. 35. Using Forefront TMG 2010 and leveraging the TMG Firewall Client, it is possible to create outbound FTPaccess rules and enforce user and group authentication. Although this won’t necessarily prevent anattacker from uploading data through the gateway, it presents yet ano ther hurdle for the attacker to clearin order to extract data. If the attacker is still successful, the access logs on the Forefront TMG firewallwill include valuable forensic data, including the name of the application used to transfer data and theaccount information used by the attacker, in addition to the usual log detail (e.g. source and destinationIP addresses, etc.).State-of-the art perimeter defense technology is not enough. Security policy and strong network egressfiltering are essential to prevent data loss. I’d suggest reviewing your outbound access policies today.Preparing Forefront TMG 2010 for EnterpriseWorkgroup DeploymentDeploying Forefront Threat Management Gateway (TMG) 2010 in a workgroup (non-domain joined)enterprise array configuration can present a significant challenge to many administrators. This post isn’tmeant to be a comprehensive TMG Enterprise Management Server (EMS) deployment guide, but I wouldlike to share with you a few important tips that will hopefully make the process of creating an EMS-managed array a little easier.Before Installing EMSIP Addressing – Make certain that all basic IP connectivity is verified before installing any ForefrontTMG 2010 services.Name Resolution – Confirm that name resolution is working properly and that hostnames are beingresolved to the correct IP addresses. Be sure that these IP addresses are assigned to the Internal networkinterface of the EMS and each array member.Certificates – The EMS will require a machine certificate, and each array member should trust theCertificate Authority (CA) that issued this certificate. It is recommended that this certificate be issued byyour internal private CA and not a public third-party CA. The certificate should be for serverauthentication and the common name on the certificate should be the FQDN of the host it is to beinstalled on. Be sure to install the root certificate and any intermediate certificates for the CA on the EMSand each array member. Make certain the certificate is issued with the option for the private key to beexportable.Local Accounts – Identical (mirrored) local accounts should be configured on the EMS and each arraymember and be granted administrative rights for the Forefront TMG 2010 Enterprise. TATA CONSULTANCY SERVICES Page 35
  36. 36. After Installing EMSBefore joining a TMG firewall to an array, you can perform some preliminary tests to determine ifcertificate authentication between hosts is working correctly. To do this, open a PowerShell commandwindow and enter the following commands:import-module servermanageradd-windowsfeature rsat-adldsOnce complete, click Start | Run and enter ldp.exe. From the drop-down menu choose Connection, andthen Connect…. For the server, enter the fully-qualified domain name (FQDN) of the EMS, specify port2172, and then select the option to use SSL.If certificate authentication is working correctly you will connect to the RootDSE. If it is not configuredcorrectly you will receive a connection error. TATA CONSULTANCY SERVICES Page 36
  37. 37. To determine if user authentication is working correctly, select Connection from the drop-down menuand then Bind…. If you are currently logged on with the local mirrored account, select the option to Bindas currently logged on user, otherwise select Bind with credentials and enter the user and passwordof the mirrored account (leave the domain blank). TATA CONSULTANCY SERVICES Page 37
  38. 38. If configured correctly you will receive notification that you have been authenticated. If not, you will benotified that the logon attempt failed.Once you’ve completed these steps you can proceed with configuring the TMG firewall to join the array.Be sure to specify the name of the EMS in exactly the same format as the certificate common name(preferably using the FQDN). BIBLIOGRAPHYISA/TMG/UAG Information  Forefront Edge Security Community  Forefront Edge Security Tech Center  ISAServer.Org  Microsoft Forefront Threat Management Gateway  Microsoft Forefront Unified Access Gateway  Microsoft ISA Server TATA CONSULTANCY SERVICES Page 38
  39. 39. Products  Celestix Networks, Inc.  Collective Software  WebSpyRecommended Blogs  Adrian Dimcevs Blog  Clint Huffmans Blog  Deb Shinders Blog  Ed Horleys Blog  ISA Product Team Blog  Jason Jones Blog  Jason Jones Blog [Legacy]  Joe Davies Blog  Mark Russinovichs Blog  Tom Shinders Blog  Windows Server Performance Team Blog  Yuri Diogenes’ BlogRecommended Web Sites   RunAs Radio  The Cable Guy – Joe Davies TATA CONSULTANCY SERVICES Page 39