Performance improvements to help manage ISA Server 2000 in large enterprise environments (872750)


The information in this article applies to:

  • Microsoft Internet Security and Acceleration Server 2000

Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

SYMPTOMS

In large Microsoft Internet Security and Acceleration (ISA) Server 2000 Enterprise Edition environments that have centralized domain controllers, the following scenarios may occur.

Scenario 1

When you use the ISA Server Management snap-in to manage Server and Arrays from a computer in a remote domain, you can see only the first 1000 arrays. If the ISA Server Management snap-in is started on a computer in the same domain where all the ISA Server arrays are installed, you will see all the arrays.

Scenario 2

When you open the ISA Server Management snap-in and expand the Server and Arrays node, you may experience a significant delay and high CPU usage.

Scenario 3

When you run Automation scripts or applications that use the FPCArrays.GetContainingArray COM method, the scripts or applications run more slowly as the number of ISA Server arrays in the enterprise increases. You may also notice increased network traffic to retrieve the array object that is associated with the computer that the script is running on.

Scenario 4

The ISA Server Control service, the ISA Server Web Proxy service, and the ISA Server Firewall service may take a long time to start. This delay will increase with the number of arrays that are added to the enterprise. Network traffic and Lightweight Directory Access Protocol (LDAP) requests to domain controllers may increase.

CAUSE

In large ISA Server enterprise environments, the code that handled network traffic to domain controllers and that handled the enumeration of large number of arrays was inefficient. Performance would decrease when more than a 1000 arrays were installed in the enterprise. This hotfix resolves these issues.

RESOLUTION

Service pack information

For more information about how to obtain the latest ISA Server service pack, click the following article number to view the article in the Microsoft Knowledge Base:

313139 How to obtain the latest Internet Security and Acceleration Server 2000 service pack

Hotfix information

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Internet Security and Acceleration Server 2000 service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

You must install ISA Server Service Pack 2 (SP2) before you apply this hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
   Date         Time   Version            Size  File name
   ---------------------------------------------------------
   31-Aug-2004  09:48  3.0.1200.402    222,712  Msfpc.dll
   31-Aug-2004  09:48  3.0.1200.402  1,843,192  Msfpccom.dll
   31-Aug-2004  09:48  3.0.1200.402  2,577,912  Msfpcsnp.dll
The hotfix is also available for the French, German, Spanish, and Japanese versions of ISA Server.

MORE INFORMATION

How to enable this hotfix

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

After you install this hotfix, follow these steps to enable it:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then right-click the following registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fpc

  3. Point to New, and then click DWORD Value.
  4. Type ContainingArrayOptimizationsMask, and then press ENTER.
  5. Click ContainingArrayOptimizationsMask, and then right-click Modify.
  6. In the Value Data box, type 0xff to enable the optimizations.
  7. All ISA Server services must be restarted for the settings to take affect.
When you set the ContainingArrayOptimizationsMask value to 0xff, you enable the optimizations. If you change the value to 0x0, functionality reverts to the old behavior.

Note After you enable the optimizations, you cannot rename an array from the ISA Server Management snap-in. To rename an array, either use a script or revert to the old behavior.

Use the following script to determine the time that is required to retrieve the containing array. This script may help you determine whether you are experiencing "Scenario 2" and whether this hotfix has improved performance.
Set ISA = CreateObject( "FPCDS.Root" ) 
Start = Timer 
Set ISAArray = ISA.Arrays.GetContainingArray 
Stop = Timer 
WScript.Echo "It took " & Stop - Start & " seconds to execute - GetContainingArray."
Use the following script to determine the time that is required to retrieve all arrays. This script may help you determine whether you are experiencing "Scenario 3" and whether this hotfix has improved performance. 
Set ISA = CreateObject( "FPCDS.Root" ) 
Start = Timer 
Set Arrays = ISA.Arrays 
Count = Arrays.Count 
Stop = Timer 
WScript.Echo "It took " & Stop - Start & " seconds to enumerate " & Count & " arrays."

STATUS

Microsoft has confirmed that this is a problem in Microsoft Internet Security and Acceleration Server 2000.
Modification Type:MajorLast Reviewed:5/15/2006
Keywords:kbfix kbbug kbHotfixServer KB872750 kbAudDeveloper kbAudEndUser kbAudITPRO kbAudOEM
©2004 Microsoft Corporation. All rights reserved.