Recommandations for firewall virtual appliance?

Do the features you've listed require that the machine be a part of a domain?  I'm hesitant to put a domain member out on the internet.

If you will not in need to set or create any rules to be applied on a specific users using thier domain user credintials so you are not in need to join it as follow:

1-  if you have a group of computers joined to the domain and used by your users and want to deny the internet or specific websites on some users and enable it for others, in this case you should join the TMG to your domain or  just allowing ldap to your domain controller to get user data.

2- If  yu have a group of computers joined to the domain or member on a workgroup and used by your users and you want to set a rules for internet or any other feature but your TMG is not joined to the domain so you can use the address range  the computers to restrict or grant access and in this case you will not in need of users data just the computers IP.

Thanks for that - Forefront is currently in the lead, but I wanted to get other opinions before I made a decision.  Anyone else?

Check out this article too:

https://www.experts-exchange.com/Microsoft/Windows_Security/A_1928-What-is-Microsoft's-Forefront-Threat-Management-Gateway.html

It's for one of the experts here and I found it very good and will explain more things to you:

https://www.experts-exchange.com/Microsoft/Windows_Security/A_1928-What-is-Microsoft's-Forefront-Threat-Management-Gateway.html

I have examined that possibility, but I do not feel our situation warrants the added complexity.  We are a small library, with about 60 concurrent users running 6x12.  I, literally, am the IT department.

Thanks for everyone's input!  We will give TMG a fair shot.