Quick Tip: Understanding TMG Client 64 bits Behavior
Have you ever wondered why Forefront TMG Client processes (FwcAgent.exe, FwcMgmt.exe) show up on Task Manager as 32bit processes as shown in Figure below?
Many Firewall Admins start wondering why this happens even when they know that Forefront TMG Client is a full 64bit application. The answer is: this is an expected behavior. The Forefront TMG Client package supports both 32- and 64-bit versions of Windows and on 64-bit Windows supports both 32- and 64-bit processes. The FwcMgmt.exe and FwcAgent.exe processes do not use any of the capabilities that are only available for 64-bit processes (e.g. larger memory space) so it was decided that having both 32-bit and 64-bit flavors is not worth the effort. However, it is important to notice that Forefront TMG Client includes a WinSock Layered Service Provider component, which is loaded inproc by WinSock applications and therefore must have the same “bit-ness” as the application. Hence there are two WinSock Layered Service Provider DLLs, FwcWsp.dll and FwcWsp64.dll, supporting 32-bit and 64-bit applications, respectively:
c:\>filever "c:\Program Files (x86)\Forefront TMG Client\FwcWsp64.dll" --a-- Wx64 DLL ENU 7.0.7734.100 shp 356,848 10-14-2009 fwcwsp64.dll c:\>filever "c:\Program Files (x86)\Forefront TMG Client\FwcWsp.dll" --a-- W32i DLL ENU 7.0.7734.100 shp 348,560 10-14-2009 fwcwsp.dll |
The “bit-ness” of the FWC processes (management tools) does not have to match the “bit-ness” of any application and hence having them 32-bit is good enough.
Author
Oved Itzhak
Senior SDE
Microsoft Forefront TMG Team
Technical Reviewers
Yuri Diogenes
Sr Security Support Escalation Engineer
Microsoft CSS Forefront Security Edge Team
Ori Yosefi
Senior Program Manager
Microsoft Forefront TMG Team