Hi Greg, Well, I'm sorry, I missed one piece of info. I would like to block by group of user which are admin group and user group. If I block at IWSS, those two groups cannot download .exe file. Do you have any idea how to block at ISA server. ISA checks those groups with AD server. As I tried to monitor the log, the rule was correct but connection was not drop when try to download .exe file. For more info, I configured ISA as a proxy server only, and forward to upstream server to IWSS. Thanks Witt