I have been using ISA 2004 for about six months as a proxy server only, and until recently, I never saw the following error:
"ISA Server disconnected the following client: 10.0.5.111 because its connection limit was exceeded. For more information about this event, see the Windows event viewer."
The computer in question is a Citrix MetaFrame XP server, whereby users access the published desktop, and from there access Firefox, which goes through ISA as proxy. In the last two weeks I'm seeing this event pop up several times an hour.
I've read the MS article about this and the other connection limit events, but they're a bit vague as what would cause this. I haven't disabled or changed the default connection limits.
The server has Symantec AV running, and AV hasn't seen anything, and I have scanned the server with various spyware detectors, as well as rootkit finders, and it comes up clean.
What would cause this increase in connection limits? Should I adjust the alerting for this?