Just had one of those 'Microsoft moments' at work. We updated the ISA server (running W2K3) that handles our VPN traffic to SP2. Rebooted, found that VPN clients could not connect, no error logs anywhere. network trace on the server proves that connection attempts are being made but not getting anywhere. Found out that the Receive Side Scaling tunings that MS added to SP2 (the same sort of shite that appears to be causing no end of grief for Vista users trying to copy files across a network) have been enabled by default in SP2. That's never caused me an issue before, but ISA server apparently throws a paddy - I guess because it doesn't like the fact that the processing of packets is being altered by the NIC driver - and refuses to work. Ho hum. Disabled this in the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableRSS - set to '0') and rebooted - all was well with the world once again. Now I'm not normally one to bash Microsoft (are you watching this Freddie?) but this just smacks of incompetence on their part. I can possibly understand a Service Pack breaking a third party product (hey, you can't test every vendor's firewall, right?), but how in the name of God can you ENABLE something that should be an optional feature anyway, that breaks your OWN company's firewall product? Nonsense - utter, utter nonsense.