Everyone has seen the Anonymous user in their Forefront TMG Reports. This is because Forefront TMG logs 'anonymous' in the username field for all unauthenticated traffic. We have blogged about the Forefront TMG Anonymous User, and written numerous support articles. But here is the best tip we can give you to reduce unauthenticated traffic in Forefront TMG:
To reduce the amount of unauthenticated traffic recorded by Forefront TMG:
There are certain system defined rules that allow unauthenticated traffic, and unfortunately these rules cannot be edited via the TMG Management Console.
One such rule is the SafeSearch rule that gets created when using Forefront TMG's SafeSearch enforcement feature. This rule effectively allows all browsing to search engines to pass through unauthenticated. If you want to identify the user that was responsible for a specific search, bad luck!
Fortunately there is a way to set this rule to 'All Authenticated Users' but it needs to be done using a script. Richard Hicks explains how to do this in his post, Enable Authentication for SafeSearch Enforcement Rule in Forefront TMG 2010.
Thanks for the tip Richard!
Richard Hicks has made a follow up post outlining some of the challenges associated with the ideal goal of 'authenticating everything'. I recommend checking it out here Identifying and Reducing Anonymous Traffic Allowed by Forefront TMG 2010
On this point, we often see authenticating BYOD (bring your own devices) such as mobile phones and tablets as a major headache for Forefront TMG Administrators. The recommended course of action in this situation is to create a separate network for these devices, and create an access rule for this network in Forefront TMG. This rule can allow 'All Users' (unauthenticated), and then it is easy to include or exclude this traffic using a Rule Equal to 'my unauthenticated traffic' Filter in TMG Reporter. Make sure you're using the latest 2.1 Beta to access this comprehensive filtering feature.
Download our FREE 30-day trial, or schedule a demo and we'll show you how it works.
Fastvue TMG Reporter Voted Best Reporting Application - ISAServer.org Readers Choice
Monitoring, Alerting and Blocking Countries with Forefront TMG