Forefront UAG Product Team Blog

Rollup 2 for Forefront Unified Access Gateway 2010 Service Pack 4 is available for download

Forefront UAG Team — Fri, 19 Jun 2015 11:40:00 GMT

We have recently released Rollup 2 for Forefront UAG 2010 Service Pack 4

UAG 2010 Service Pack 4 Rollup 2 is available as a hotfix download from Microsoft Support as an update to UAG 2010 Service Pack 4.

This update contains 4 new changes for UAG 2010 Service Pack 4. For details, please visit KB 3060650: Description of Rollup 2 for Forefront Unified Access Gateway 2010 Service Pack 4

Please download the Forefront Unified Access Gateway (UAG) 2010 Service Pack 4 Rollup package and learn more about UAG 2010 SP4 by visiting our TechNet Library.

Thank you,

The Forefront UAG Product Team

Get the latest System Center news on Facebook and Twitter:

The Forefront UAG blog: https://blogs.technet.com/b/edgeaccessblog/
The Forefront TMG blog: https://blogs.technet.com/b/isablog/
The Application Proxy blog: https://blogs.technet.com/b/applicationproxyblog/
The Forefront Endpoint Protection blog : https://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : https://blogs.msdn.com/b/ms-identity-support/

System Center All Up: https://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: https://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: https://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: https://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: https://blogs.technet.com/momteam/
System Center – Service Manager Team blog: https://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: https://blogs.technet.com/scvmm

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

New trace package available for UAG versions through Service Pack 4 Rollup 1

Forefront UAG Team — Fri, 31 Oct 2014 08:37:52 GMT

An updated tracing package is now available from the Microsoft Download center page for Forefront Unified Access Gateway (UAG) Tracing Symbols. This new trace package includes formatting for all UAG versions through Service Pack 4 Rollup 1.

Forefront UAG tracing can be run on the Forefront UAG server and on client endpoint devices connecting to Forefront UAG resources. You configure trace settings, start tracing, reproduce scenarios that require troubleshooting, stop tracing, and then convert the binary tracing output to text using the provided format files.

This download provides the following:
• A set of .tmf files in a zip file. These .tmf files can be used to convert binary trace files on the Forefront UAG server, and on client endpoint devices.
• A EULA license
• A document with instructions for configuring and running tracing

Note that the zip file provided by this download is cumulative. .tmf files included in the zip file can be used with the RTM version of Forefront UAG, and with subsequent Forefront UAG releases.

Versions of .tmf files provided by this download are as follows:

• UAG RTM (Version 4.0.1101.000)
• UAG Update 1 (Version 4.0.1152.100) KB Article 981323
• UAG Update 2 (Version 4.0.1269.200), KB Article 2288900
• UAG RTM MS10-089 bulletin (Version 4.0.1101.052), KB Article 2433585
• UAG Update 1 MS10-089 bulletin (Version 4.0.1152.150), KB Article 2433584
• UAG Update 2 MS10-089 bulletin (Version 4.0.1269.250), KB Article 2418933
• UAG SP1 (Version 4.0.1752.10000), KB Article 2285712
• UAG SP1 Rollup 1 (Version 4.0.1752.10020), KB Article 2475733
• UAG RTM MS11-079 bulletin (Version 4.0.1101.063), KB Article 2522482
• UAG Update 1 MS11-079 bulletin (Version 4.0.1152.163), KB Article 2522483
• UAG Update 2 MS11-079 bulletin (Version 4.0.1269.284), KB Article 2522484
• UAG SP1 MS11-079 bulletin (Version 4.0.1752.10073), KB Article 2522485
• UAG SP1 Update 1 (Version 4.0.1773.10100), KB Article 2585140
• UAG SP1 MS12-026 (Version 4.0.1753.10076), KB Article 2649261
• UAG SP1 Update 1 MS12-026 (Version 4.0.1773.10190), KB Article 2649262
• UAG SP2 (Version 4.0.2095.10000), KB Article 2710791
• UAG SP3 (Version 4.0.3123.10000), KB Article 2744025
• UAG SP3 Rollup 1 (Version 4.0.3206.10100), KB Article 2827350
• UAG SP4 (Version 4.0.4083.10000), KB Article 2861386
• UAG SP4 Rollup 1 (Version 4.0.4160.10100), KB Article 2922171

Thank you,

The Forefront UAG Product Team

Get the latest System Center news on Facebook and Twitter:

The Forefront Endpoint Protection blog : https://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : https://blogs.msdn.com/b/ms-identity-support/

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

Users from a trusted forest are unable to change their password using the UAG portal Credentials Management option

Forefront UAG Team — Thu, 30 Oct 2014 11:11:24 GMT

Once again the UAG product group have worked diligently on releasing a much awaited update for UAG - SP4 Rollup 1

This update includes numerous fixes for the issues we have heard from customers over the last 12 months, plus also some improvements. However, one particular issue is not included in this release, so we thought to share the details on this…

Problem Scenario

Users from a trusted forest are unable to change their password using the Credentials Management option on the UAG portal page.

E.g., a user from a trusted forest logs into the UAG portal and selects the Credentials Management icon on the toolbar. The user then chooses the “Change Password” option, which displays the password change dialog. After completing the form with their current and new password, the user clicks “Save” to apply the change. However, the password is not changed and the user receives an error message stating, “The password change cannot be applied”.

On the other hand, this behavior does not affect users from a domain within the UAG forest and their password is successfully changed. In this scenario, you may also observe that the “User name:” field appears to display the logged in user’s name as “Repository\username”, rather than “TrustedForest\username”.

The Solution

The suggested fix is to make a modification to UAG’s LoginChangePassword.inc,so that the domain_name variable includes the user’s respective domain.

It’s not possible to customize the LoginChangePassword.incfile using the standard UAG CustomUpdate mechanism, and therefore it’s required to modify the built-in file using a manual method.

Note:Unless advised by Microsoft support personnel, making changes to core UAG files is wholly unsupported. You should not make changes to these files except under strict guidance set out by the UAG support team, or other exceptions provided through an official channel such as this blog. Applying any future updates or running repairs may overwrite the modified file.

1. Navigate to ..\\Microsoft Forefront Unified Access Gateway\von\InternalSite\inc\ and make a copy of the LoginChangePassword.incfile within the same folder

2. Now edit the original file and locate the below block of code…

repository = ""
user_name = ""
for each user in user_Vec.UserVec
if i = index then
repository = user.Repository
user_name = user.User
exit for
end if
i = i + 1
next
set user_vec = Nothing

3. Change this to include the following 6 lines…

repository = ""
user_name = ""
for each user in user_Vec.UserVec
if i = index then
repository = user.Repository
user_name = user.User

######### Below lines added to correct issue post SP4 RU1 ##########

domain_name = user.Domain
if ( (domain_name <> "") and (InStr(user_name, "@")=0) ) then
user_name = domain_name & "\" & user_name
end if
##################################################

exit for
end if
i = i + 1
next
set user_vec = Nothing

4. Save the file and repeat these same steps on any other remaining UAG servers

AUTHOR

Rainier Amara

Support Escalation Engineer - Microsoft Edge Security Team

REVIEWERS

Lars Bentzen

Sr. Escalation Engineer - Microsoft Edge Security Team

Rollup 1 for Forefront Unified Access Gateway 2010 Service Pack 4 is available for download

Forefront UAG Team — Tue, 28 Oct 2014 10:25:00 GMT

We are happy to announce that Rollup 1 for Forefront UAG 2010 Service Pack 4 has been released.

UAG 2010 Service Pack 4 Rollup 1 is available as a hotfix download from Microsoft Support as an update to UAG 2010 Service Pack 4.

This update contains over 23 fixes for reported issues plus updates for application publishing templates. For details, please visit KB 2922171: Description of Rollup 1 for Forefront Unified Access Gateway 2010 Service Pack 4

Please download the Forefront Unified Access Gateway (UAG) 2010 Service Pack 4 Rollup package and learn more about UAG 2010 SP4 by visiting our TechNet Library.

Thank you,

The Forefront UAG Product Team

Get the latest System Center news on Facebook and Twitter:

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

IE11 and UAG AD FS trunk issue after upgrade to SP4

Ran [MSFT] — Tue, 03 Dec 2013 09:28:00 GMT

We got word of a couple of instances where an issue occurred on a UAG server after upgrading to Service Pack 4 for UAG 2010 (SP4 is available for download here).

The symptoms:

You are using UAG running version SP3 Rollup 1.
The UAG server is configured with at least one portal trunk that uses AD FS 2. 0 as the trunk authentication server (a.k.a. “authentication repository”)
You upgrade this UAG server to Service Pack 4
After upgrade to SP4, end-users using IE11 who access the UAG portal trunk that uses AD FS authentication are presented with the following error message, instead of the expected logon page:

Sign-in Error

Access to this portal from a mobile device is not allowed because the portal uses federated authentication.

Why does this happen?

The issue occurs when a configuration file on the UAG server fails to get updated to its latest version, which adds support for IE11. This file is named mobile.browser, and is located in the …\InternalSite\ADFSv2Sites\\App_Browsers\DetectionModule folder on the UAG server.

This file is used by AD FS trunks on UAG in order to correctly recognize and categorize connecting clients. In those cases in which the file was not correctly updated to its latest version by the installation of SP4 for UAG, the IE11 browser is incorrectly recognized by UAG as a mobile device and thus denied access to the AD FS trunk. You can easily recognize that the file is not up to date by its Date modified attribute, which will show a date in 2011.

How do I fix this?

The fix for this issue, should you be affected by it, is extremely simple. Just follow these easy steps:

Locate the file mobile.browser in the …\InternalSite\ADFSv2Sites\\App_Browsers\DetectionModule folder on the UAG server.
Note: the same file exists in three other folders of the UAG server. Do not change those files, only change the file (or files, if you have several AD FS trunks) located under the ADFSv2Sites folder!
Delete the file, or, to be on the safe side, copy it to another location or rename its extension to anything you wish. For example: mobile.browser_backup
In case you have configured more than one trunk using AD FS 2.0 authentication , repeat step 2 above for each mobile.browser file in each one of the folders within …\InternalSite\ADFSv2Sites\
Activate the UAG configuration.

This will cause the file mobile.browser file to be recreated in the …\InternalSite\ADFSv2Sites folder. This newly created file will be in the correct, SP4 version, which handles IE11. Note that the file’s Date modified attribute now shows a date in 2013.

Hope this helps.

Thanks to Ophir Polotsky for reporting this issue to us, and to Aaron Ellis for spotting an error in the instructions above.

---------------------

Ran Dolev

Senior Program Manager

Forefront Unified Access Gateway 2010 Service Pack 4 is now available for download

Forefront UAG Team — Wed, 20 Nov 2013 08:27:00 GMT

We are happy to announce that Service Pack 4 for Forefront UAG 2010 is now available.

UAG 2010 Service Pack 4 is available for download from the Microsoft Download Center, as an update to UAG 2010 Service Pack 3 Rollup 1.

Here are some details about the new features included in Service Pack 4 for UAG 2010:

Support for Windows 8.1 client devices

Forefront UAG 2010 SP4 supports Windows 8.1 client devices using Internet Explorer 11 and Internet Explorer 11 on the desktop.
Mail - End users can use the built-in Mail application on Windows 8.1 clients to connect to published Exchange servers.
Remote Desktop - Forefront UAG SP4 supports the Remote Desktop Connection (RDC) 8.1 client.

New tool added to support publishing Windows Server 2012 RemoteApps

Forefront UAG 2010 SP4 adds support for publishing RemoteApps from a Remote Desktop Session Host (RDSH) running on Windows Server 2012 and 2012 R2

Fixes included in UAG SP4

New fixes for customer reported issues. For details, please visit KB 2861386: Description of Forefront Unified Access Gateway 2010 Service Pack 4

Please download the Forefront Unified Access Gateway (UAG) 2010 Service Pack 4 package now, and learn more about UAG 2010 SP4 by visiting our TechNet Library for the SP4 release notes.

Thank you,

The Forefront UAG Product Team

The Forefront TMG blog: https://blogs.technet.com/b/isablog/
The Forefront UAG blog: https://blogs.technet.com/b/edgeaccessblog/

The Forefront Endpoint Protection blog : https://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : https://blogs.msdn.com/b/ms-identity-support/

System Center All Up: https://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: https://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: https://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: https://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: https://blogs.technet.com/momteam/
System Center – Service Manager Team blog: https://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: https://blogs.technet.com/scvmm

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

Getting an Error “You have attempted to access a restricted URL” while accessing an application published through Forefront Unified Access Gateway

Forefront UAG Team — Fri, 08 Nov 2013 07:41:00 GMT

Recently, I worked on a case where the customer had published multiple web applications using the template ‘Other Web Application (Application Specific Hostname)’. The application type was specified as “web”. When users accessed some of the applications, it worked but while accessing the rest, they were getting the error “You have attempted to access a restricted URL” (screenshot below)

When we checked the UAG Web Monitor logs, we got the following information about the user request “Warning 09/19/2013 15:45:21 67 URL Path Not Allowed Security Trunk1 (S) UAG1 A request from source IP address **.**.**.**, user ***** on trunk Trunk1; Secure=1 for application Web Application1 of type Web failed. The URL /test/default.aspx contains an illegal path. The rule applied is Default rule. The method is GET. “

So, it appeared that UAG was not able to match the URL with any of the configured URL sets on that particular trunk where these applications were published. And because of that our request was getting denied by the default rule.

Next, we checked the URL Set to see if we have created rules that would allow the required URL paths. The rule naming format is based on the Application Type specified at the time of creation of the application. Rules beginning with ‘_’ only will be applied for the corresponding applications. In our case, we had the following configuration:

We checked the URL Set for rules that begin with web_ . We could see only one rule present matching that naming convention (web_Rule1). This allowed all the paths.

So, this URL Set rule should have taken care of all the paths accessed by the clients, but still, we had an inconsistency in the behavior since some applications did not generate this error, while others did.

You must be wondering how come we were still getting denied even though we have a rule for that application type which allows everything. Please pay attention to the name of the Application Type and the name of the rule under URL Sets. As you can see, they have been configured with different case, meaning that the Application Type has 'W' (upper case) while the rule name is entirely lower case. And that’s what seemed to be the cause behind the request not being able to match with the rule.

We added another rule to the Rule Set and named it Web_Rule2 and allowed all the paths which were required. After activating the new UAG configuration, users were able to successfully access the published application.

The key takeaway is that URL set rule names are case sensitive and care must be taken while writing rules for user-defined application types. I hope this post helps you in resolving such issues which you may run into during your deployment.

Author:

Karthik Divakaran

Security Support Engineer - Microsoft Forefront Edge Team

Reviewers:

Nitin Singh

Security Support Escalation Engineer - Microsoft Forefront Edge
Team

Richard Barker

Security Sr. Support Escalation Engineer – Microsoft Forefront
Edge Team

Receive error “The UAG Configuration cannot be loaded from Forefront TMG Storage” while launching the UAG 2010 management console.

Forefront UAG Team — Fri, 16 Aug 2013 11:16:42 GMT

Introduction

Most of us might have come across the Error “The UAG Configuration cannot be loaded from Forefront TMG Storage” while trying to launch the UAG Management Console, in multiple scenarios. Recently, I was working on a similar issue with one of my customers and I would like to share my experience on this.

In this scenario, the UAG Server nodes were in Sync and connectivity to the domain controllers was fine.

Troubleshooting

We verified the server sync status from the UAG Activation Monitor console and tested the Domain connectivity using the command “NLTEST /SC_Query : ”. And the Domain Connectivity was fine.

But still we were getting the below error while opening the UAG Management Console:

So, we went to the TMG server console and verified the Network settings. We verified the Internal Network by going to the Internal Network –> Properties –> Addresses (Tab) –> Add Adapter (button).

But we got the following error on the TMG console:

Srvxxxxx in the above Screenshot is the Array node name.

Then after doing some more troubleshooting and digging deeper into it we decided to do a sanity check of the Network configuration of that server. So, we went to the Network Card Properties and started looking at the settings.

Everything looked normal except one strange part. We had the Secondary DNS Server’s IP added twice in the DNS tab of “Advanced” Settings of the TCP/IPv4 Properties:

It looks strange, right? It’s not clear how the secondary DNS Server entry was duplicated.

But, we know for sure that the TMG/UAG code doesn’t like it that way. So we went ahead and removed that duplicate entry of the Secondary DNS Server from there. And after that we did not get any errors while going to the Internal Network Properties of TMG. And we could now open the UAG console as well.

Author

Sunil Nair – Support Engineer, Microsoft CSS Forefront Security Edge Team

Reviewer

Nitin Singh – Support Escalation Engineer, Microsoft CSS Forefront Security Edge Team

Updated Forefront UAG SP3 tracing is now available

Forefront UAG Team — Tue, 30 Apr 2013 14:21:00 GMT

We have an updated tracing package now available from the Microsoft Download center page for Forefront Unified Access Gateway (UAG) Tracing Symbols. This new trace package includes formatting for all UAG versions through Service Pack 3 Rollup 1 and includes the SP3 enhanced context tracing to more easily filter trace data per session.

Thank you,

The Forefront UAG Product Team

Get the latest System Center news on Facebook and Twitter:

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

The Forefront Endpoint Protection blog : https://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : https://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: https://blogs.technet.com/b/isablog/
The Forefront UAG blog: https://blogs.technet.com/b/edgeaccessblog/

How to configure client certificate authentication in UAG 2010

J.C. Hornbeck — Thu, 25 Apr 2013 13:12:38 GMT

In Forefront Unified Access Gateway 2010 (UAG), there are several scenarios that use SSL client certification authentication. For each trunk in Forefront UAG you can configure a simple client certificate or a smart card certificate and in this TechNet Wiki article, Microsoft’s own Junaid Jan shows you how:

How to get Client certificate authentication working on UAG 2010 Portal

J.C. Hornbeck | Knowledge Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news on Facebook and Twitter:

Windows Intune: https://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: https://blogs.technet.com/sus/
The AD RMS blog: https://blogs.technet.com/b/rmssupp/

App-V Team blog: https://blogs.technet.com/appv/
MED-V Team blog: https://blogs.technet.com/medv/
Server App-V Team blog: https://blogs.technet.com/b/serverappv

The Forefront Endpoint Protection blog : https://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : https://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: https://blogs.technet.com/b/isablog/
The Forefront UAG blog: https://blogs.technet.com/b/edgeaccessblog/