Вот смотрел в логах ISA и как понял - ISA тут не причем:
Код:

Initiated Connection SERVER_ISA 18.11.2009 12:22:27
Log type: Firewall service
Status:
Rule: [System] Allow remote management from selected computers using Terminal Server
Source: Internal (192.168.0.5:49815)
Destination: Local Host (192.168.0.10:3389)
Protocol: RDP (Terminal Services)
User:
Additional information
•Number of bytes sent: 0 Number of bytes received: 0
•Processing time: 0 ms Original Client IP: 192.168.0.5
•Client agent:
------------
Closed Connection SERVER_ISA 18.11.2009 12:22:27
Log type: Firewall service
Status:
Rule: [System] Allow remote management from selected computers using Terminal Server
Source: Internal (192.168.0.5:49815)
Destination: Local Host (192.168.0.10:3389)
Protocol: RDP (Terminal Services)
User:
Additional information
•Number of bytes sent: 52 Number of bytes received: 40
•Processing time: 0 ms Original Client IP: 192.168.0.5
•Client agent: