Well, I have now replaced TMG with ISA, we'll see if it really was TMG that was the cause of all the issues.
Was TMG a replacement for "ISA"?
As it happens my blame may have been misplaced, ISA is in and while it is working a little better there are still issues. There is 'something' wrong in the network and I have no idea where to even start looking. My only option may be to just point all the clients directly at the router and let them connect directly to see if that works.
Stupid internet, it would not be so bad except this school has decided to 'cloud' a bunch of their stuff therby putting all their most important stuff over the weakest possible link avalible. I really would like a chasum to open up and swallow various cloud datacenters around the world so that we can get back to a sane model that works rather than attempting to do the equvilent of pushing an elephant throught an unreliable bendy straw.
I don't know if you have a contract (SLA) with the internet pipe owners ? perhaps packetloss ? let them do some measurements ? maybe fire up wireshark on several locations ?
just some idea's here