ISA and TMG Login Scenarios

Q: What are the various active directory account conditions to program for when it comes to authenticating through an FBA listener on ISA or TMG?

A: There are seven that we've come up with:

1. The account is active and valid.
2. The account’s password is past the 90 days max password age and the password is expired (but account is still active).
3. The account‘s password will expire in <15 days (test by changing remind users from 15 to 120).
4. The account is disabled (test by simply disabling the AD account).
5. The account is expired (test by moving the AD account expire date into the past).
6. The account is set to “user must change password at next logon” (test by simply checking that box)
7. The account is active and valid and the user checks the box to change their password.

TMG 2010 Change Password

Q: We were presented with a Forefront Threat Management Gateway server (TMG) 2010.  It was configured with a Web Listener using FBA, LDAPS auth to a DC (not GC) and when the user's account had the (X) Change password at next login enabled, the user could not authenticate at all.  They were presented with the message "You could not be logged on to ISA Server. Make sure that your domain name, user name, and password are correct, and then try again." We even patched it up to release Version: 7.0.9027.450.
A: Come to find out, the fix for this is the same one as ISA 2006 - KB957859.  This helpful script run against the Listener fixed the issue.

Cscript EnableHotfix957859.vbs /webListener:<listener name> /Value:true