How to install TMG 2010 Service Pack on Branch Office Server
When you try to install a service pack for Forefront TMG 2010 on a branch office server, it will fail, because the Firewall service needs to be stopped. When Firewall service has been stopped the connection to headquarter is not longer active. This will cause problems with access to Enterprise Management Server, configuration database and services.
Microsoft published a workaround in a new MSKB article