One of the things that I noticed when Change Tracking is enabled on the ISA firewall, is that it provides more information about how the ISA configuration has changed than you might expect. For example, you'll be able to see the changes made to the ISA firewall configuration when you install ISA 2006 SP1. Even more interesting, you can see that changes that are made to the firewall configuration when you install third party ISA plug-ins.
Jonathan Barner on the ISA firewall sustained engineering team provides some examples of this on the Forefront TMG (ISA Server) Blog site at:
Thomas W Shinder, M.D.
GET THE NEW BOOK! Go to http://tinyurl.com/2gpoo8
MVP — Microsoft Firewalls (ISA)