"ISA Server failed to load the firewall policy configuration" error in ISA Server 2006

Consider the following scenario:

• You configure a firewall policy rule in Internet Security and Acceleration (ISA) Server 2006. An Active Directory user authentication is required in this firewall policy rule.
• You add many entries to the User Sets list on the User tab in this rule. Each entry contains many individual Active Directory users and several Active Directory groups.
• You try to change the configuration of the rule. For example, you try to add a user to the User Set list on the User tab.

In this scenario, you cannot apply the changes. Additionally, you receive the following error message:

ISA Server collects all the Windows security elements that are on the Users tab. Then, ISA Server puts these security elements into a single security descriptor. However, Windows has a size limit for a discretionary access control list (DACL). The maximum size of a DACL is 0xFFFF (65535 bytes). Each access control entry (ACE) in a DACL has a size of about 0x24 (36 bytes). Therefore, Windows returns the error that is described in the �Symptoms� section to the ISA Management Microsoft Management Console (MMC) snap-in when the list that is in this security descriptor exceeds the size limit.

For example, assume that the number of entries in the User Sets list for an access rule is more than 100 and that each entry contains many individual Active Directory users. Additionally, assume that the total number of access control entries in the security descriptor is 1821 after ISA Server merges all the users and groups in the User Sets list into a single security descriptor. In this scenario, the DACL size (1821*36 + 8) is greater than the maximum size limit of 65535 bytes. Therefore, ISA Server 2006 cannot synchronize the configuration, and you receive the error message.

Note

• This scenario that is used as an example does not follow the Windows access controls best practices. Therefore, we do not recommend it.
• The DACL header size is 8 bytes.

To work around this issue, use one of the following methods:

• Use nested users and groups.
• In an ISA Server 2006 policy rule, make sure that you have only a few Active Directory users and groups in the User Sets list.

For more information about nested groups, visit the following Microsoft Web site:For more information about Active Directory users, computers, and groups, visit the following Microsoft Web site:For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: