Exchange 2013 Sign Out behavior on Microsoft UAG - To finish signing out, please close all open browser windows.

Recently we noticed with some Exchange 2013 customers having their OWA (Outlook Web access) published on Microsoft UAG (Latest SP4 Rollup update) that they can't sign out properly from their OWA session and instead they get the message "To finish signing out, Please close all open browser windows"

When the user hits OK, nothing happened and he is still logged in.

This issue is not related to the UAG OWA setup or the UAG authentication but rather the Exchange Virtual directories authentication. This behavior occurs because the Exchange OWA virtual directories are set to Windows Integrated Authentication.

In order to change this you will need to do the following:

1. From Exchange Admin Center go to Servers - Virtual Directories (Pick your server if you have multiple servers.
2. Edit the OWA (Default Web Site) Authentication.
3. Uncheck "Use one or more standard authentication methods" and pick an option in the below FBA (Forms based authentication) as shown in the below image                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          
4. You will need to do the same for the ECP virtual directory (Actually it will display message with this)
5. Reset/Restart the IIS and the logoff should be normal as expected.

Hopefully this can help anyone encountering this issue.

Read More...

UAG Direct Access client Fail to connect. DA is configured and disabled.

I got couple of users using Windows 7 reporting that they can't connect using Direct Access anymore whether its HTTPS or Teredo, DA just won't work. Upon further discussing the issue with them they mentioned that they enabled and disabled the Direct Access Connectivity assistant (DCA) Use Local DNS couple of times in an effort to work it out.

We started troubleshooting by checking the Name Resolution Policy table and we noticed that the NRPT was not getting applied on the DA client as shown below.

The next step was checking the DA resolution using the netsh dns show state command and it turned to be disabled.

Name Resolution Policy Table Options

--------------------------------------------------------------------

Query Failure Behavior                : Always fall back to LLMNR and NetBIOS

                                        if the name does not exist in DNS or

                                        if the DNS servers are unreachable

                                        when on a private network

Query Resolution Behavior             : Resolve only IPv6 addresses for names

Network Location Behavior             : Never use Direct Access settings

Machine Location                      : Outside corporate network

Direct Access Settings                : Configured and Disabled

DNSSEC Settings                       : Not Configured

The DA client already has the correct group policies, certificates but its disabled.

The next step was checking the below registry key:

"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient EnableDAForAllNetworks"

The value of the key was set to 2 which means that DA is disabled !

Upon deleting the registry key, the DA started working normally without any problem.

For more information about the EnableDAForAllNetworks and its different values please check the below URL. 

http://msdn.microsoft.com/en-us/library/ff957870.aspx

On both cases that i have seen so far the reason was playing with the DCA settings (Use local DNS) which triggered the flipping of this registry key from Automatic to disabled.

Hopefully this could help someone with the same problem.

Read More...

Publish RDS 2012 R2 VDI Pool on Microsoft UAG 2010 SP4

Unfortunately there is no much information (almost nothing) available from Microsoft regarding publishing Virtual Desktop Infrastructure (VDI) Pool on Microsoft UAG 2010. Two years ago i published an article on this same topic but it was targeting publishing the VDI pool from 2008 R2 Virtualization Host server to UAG 2010. You may check it on the following link http://itcalls.blogspot.com/2012/05/publishing-microsoft-pool-vdi-on-uag.html

Lately we updated all our Remote Desktop services servers and upgraded everything to 2012 R2 including the VDI pool (Updating the pool with Windows 8.1 machines). I followed the same steps in my previous article but it didn't work.

The main trick is that in the old RDS version 2008/2008R2 the Session Host (RDSH) was the redirection server. This architecture changed in 2012/2012 R2 servers and the Connection Broker is the component that do the redirection (RDCB).

Since publishing the 2012 R2 VDI is not officially certified with UAG 2010 and to get around this issue,  our team checked the below old article to bypass checking resources.

http://support.microsoft.com/kb/2702989

All We need to do is to adjust the Registry key on the UAG server as shown below:

HKEY_LOCAL_MACHINE\Software\WhaleCom\e-Gap\Common

DWORD Value: TSDontCheckResources
Value data: 1

So what does this Registry key will actually do ?

When connecting to the Remote Desktop Server, the Broker returns the resources list it receives from the RDSH and it picks up all IP addresses on all interfaces on the server. Now the UAG server needs to resolve all the IP addresses returned in the resource list to names and verify if they resolve to the same server. If the resource list contains IPV6 addresses, this lookup fails and hence the security check fails and the connection fails to launch one of the VDI machines in the pool.


To Make it work, i followed my earlier article and then added this key and its working fine.

Read More...

Bye Bye Microsoft UAG !

Yesterday Microsoft Announced officially that there will be no new future full version of Microsoft UAG. Server 2012 and 2012R2 will cover some of the UAG features as Direct Access and basic secure application publishing. This was quite expected especially after the TMG retirement and the new web application proxy that was introduced in Server 2012 R2.


For more details on the latest changes to the Forefront family, please check the below article

http://blogs.technet.com/b/server-cloud/archive/2013/12/17/important-changes-to-the-forefront-product-line.aspx

Read More...

UAG 2010 SP4 Released to support Windows 8.1 and IE 11

Good news for all Microsoft UAG 2010 users, Service Pack 4 (SP4) was released officially yesterday to support Microsoft Latest Operating system Windows 8.1 and Internet Explorer 11 (IE 11). This new SP4 provides other important features as the support of Remote Desktop Connection RDC 8.1 and the Remote Apps published from Remote Desktop session Host on Windows 2012 or 2012 R2.

The Link to download the Latest SP4 is as follows:

https://www.microsoft.com/en-us/download/details.aspx?id=41181


For More details about features and fixes included in this Service Pack, please check the following link:

https://support.microsoft.com/kb/2861386


Service Pack 4 includes some other fixes as well as stability and performance enhancements, I will give it a try and hopefully it will be smooth operation.

Read More...

UAG 2010 File Access application fails to open/start after UAG 2010 SP3 implementation

After the install of UAG 2010 SP3, all of the portal applications worked fine except for the File Access application. I tried several options with the application, removing it and adding it back but never worked till I asked my friend Ben Ari (UAG Senior Escalation engineer) as I thought it was depreciated. It turned out to be a glitch or bug after implementing the UAG 2010 SP3 and to fix you need to do the following:

 

1.       On the UAG server, Navigate to the following folder under UAG installation folder \Microsoft Forefront Unified Access Gateway\von\FileAccess

2.       Edit the file “default.asp” (I took a backup first before any change)

3.       Modify the word cint to parseInt on Line 20 (Or you can search the file as it appears once). Make sure that the “I” in “parseInt” is written in caps (Check below screenshot)

 

 

4.       Save and activate your Forefront UAG

 It should be noted that incase there are more than one UAG server in the array, this change should be applied on all servers manually by the same method and steps above.

Read More...

UAG 2010 Portal error 403.14 after applying UAG 2010 SP3

The UAG 2010 SP3 was officially released on Feb 20, 2013 as promised by the UAG team to resolve several issues mainly to support Microsoft new systems and applications (Windows 8, Server 2012, Exchange 2013, SharePoint 2013...............etc). Thanks UAG team.

Download Link:  http://www.microsoft.com/en-us/download/details.aspx?id=36788

Release Notes: http://support.microsoft.com/kb/2744025


I will discuss my SP3 installation process and my comments for a successful implementation in another Post. One of the main issues that i faced after the installation of the UAG 2010 SP3 was that all my users were unable to access the UAG Portal page or any published site on the UAG (Mail OWA, SharePoint............etc) and the following error is Displayed:

Forbidden Directory, Listing Denied Error code 403.14

Microsoft has a good KB that deals with this error (http://support.microsoft.com/kb/961172) however in my case i needed to reboot the IIS later on. The Steps done to fix this issue is as follows:

1. Open Forefront UAG management on the UAG server.
2. Open/Explore the Trunks under the HTTP and/or HTTPS connections.
3. Right click each Trunk and select Disable.
4. Save and Activate the UAG configuration.
5. Right Click the trunks again and select enable.
6. Save and Activate the Configuration again.
7. Open the IIS Manager
8. Highlight your server name and from the actions hit restart to restart the IIS. This should do the trick.

Hopefully this should help anyone facing this problem after UAG SP3.

Read More...

Microsoft UAG backup using DPM 2012

I have been working on this issue for some time and it was always failing with different kind of errors, i consulted Microsoft Team as well and finally it worked with me. I am using DPM 2012 but it shouldn't differ with any earlier DPM version as 2010. The main blocking issue here is the TMG component on the UAG server. Remember that its highly recommended not to touch the TMG configuration on the UAG however this is one of the rare cases that need the administrator to tweak some TMG settings. To enable the DPM to backup UAG and install the client you need to do the following (Make sure to take Full backup from your TMG settings and Rules):



1. Ensure the File and Printer sharing is checked/Enabled on the UAG internal Network card.

2. From the TMG console- Firewall Policy. On the right pane click show system Policy rule

3. You need to disable system Rule number 2 (Allow Remote Management from selected computers using MMC) by Right clicking the rule and edit system policy, I am assuming the default TMG rules are not touched before.

4. You need to disable System Rule number 22 (Allow RPC from Forefront TMG to Trusted servers)

5. From the Right Pane, in the toolbox section create a new Protocol under user defined. The Protocol parameters as follows:

Primary connection: Type: TCP, Direction: Outbound, Port range: 135-135

Secondary Connection: Type: TCP, Direction: Outbound, Port range: 1024 - 65535

6. Final Step, create a new Access Rule (Make sure to move it to the top). Allow - All outbound traffic except selected (Choose - RPC All interfaces) - From DPM server (Create computer object with DPM IP address)- To Local Host (UAG server) - All users................etc



Save the Settings and ensure they are Synced from the monitoring tab. Now try to install the Agent from the DPM on the UAG server and take a simple test backup.

Read More...

Microsoft UAG 2010 SP3 Under Work to Support Windows 8 & IE 10

Microsoft officially announced couple of days ago that UAG 2010 SP3 will be released the first quarter of 2013. This new Service pack will provide support for Windows 8 and IE 10 as well as other applications as Exchange 2013, Sharepoint 2013.........etc

The support of DirectAccess clients running Windows 8 as well as the normal Service pack fixes and improvements are expected.

http://blogs.technet.com/b/edgeaccessblog/archive/2012/11/26/uag-2010-service-pack-3-is-in-the-works.aspx

Looking forward to getting the new Service pack and testing it with Windows 8.




Update: Microsoft UAG SP3 is released on Feb 2013 and can be downloaded from http://www.microsoft.com/en-eg/download/details.aspx?id=36788

Also UAG SP3 Rollup 1 which is released to fix several issues with SP3 is released on April 2013 (Need SP3 to be already installed) and can be downloaded from http://support.microsoft.com/kb/2827350

Read More...

UAG 2010 RDP Application Failure after applying November 2012 KB2592687 Update

I had a problem accessing any RDP application on my UAG portal (whether its Remote App application , RDP User defined, RDP Gateway or VDI Pool– Predefined Remote Desktop Host), after several hours and investigation with Microsoft team, it turned to be an update released more than 2 weeks ago KB2592687 regarding RDP 8.0 update.

 

http://support.microsoft.com/kb/2592687

 

Looks like UAG Portal is not yet compatible with the new RDP 8.0 update. After uninstalling/Removing this update from my client machine (Windows 7), everything worked fine. I would recommend everyone using the UAG portal to hold for this update till its fully compatible. I escalated this issue for further investigation.

 

For Corporates with WSUS implementation, they may decline/Disapprove this update till further update.

Read More...

Microsoft UAG 2010 Web Monitor All Events displays Message ID 108 Every Minute

After applying Microsoft UAG 2010 SP2 released couple of month ago I noticed that the UAG Web Monitor All Events Message ID 108 is repeated all the way and almost every minute as shown below.

After discussing this issue with Microsoft Escalation Team, it turned that its a known issue after UAG SP2 related to group memberships. Microsoft is aware of this issue and they have a private fix for this specific problem. After applying this fix, I didn't encounter this warning again.

I would recommend anyone having this warning to open a case with Microsoft to get this fix, this case shouldn't be counted since its a known bug.

Read More...

Manual add of Shares to Microsoft UAG File Access

Microsoft UAG 2010 File Access is a nice feature to securely publish your internal shares on your UAG Portal for Internet users. To successfully publish your shares on UAG portal and for the File access to work, it requires the following:

1. NETBIOS should be enabled, Ports 137-139 should be open and not blocked by any internal Firewall
2. Port 445 for SMB should be open so UAG server can access/Locate the shares.
3. On the UAG NIC facing the internal Network as well as on your Domain Controllers NICs, make sure to enable the NETBIOS Over TCP from the NIC advanced properties (WINS Tab).
4. The File servers should have the Turn On discovery feature enabled (check attached) from the Network card advanced sharing options. By design it will turn off automatically unless you started several services as SSDP and UPnP services, please check this thread for more information http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2networking/thread/17e7b386-53ea-411c-8d90-cf4a6229ba27

Sometimes its hard to configure all these settings or maybe its restricted by your network policy. To manually add a network share or even DFS share to your UAG file access you need to modify the ShareAccessCfg.xml (This is the core file for the File Access Application). This file is located under ..\Microsoft Forefront Unified Access Gateway\von\FileAccess

The ShareAccessCfg.xml file can be edited easily using a notepad or any Free XML Editor, one editor that i use frequently is the Microsoft XML Notepad 2007 http://www.microsoft.com/en-us/download/details.aspx?id=7973

To manually add a server or Share you need to add them under the Server section or Share section as shown below

   <servers>

<server name="Domain\Server1" marked="1" provider="MS"/>

</servers>

<shares>

<share name="Domain\Server1\Share_name" marked="1" provider="MS"/>

</shares>

After changing and saving the ShareAccessCfg.xml, make sure of the following:

1. Restart Microsoft Forefront UAG File Sharing Service
2. Open the Application from the UAG Console - Admin - File Access and make sure to hit Apply on each item (Domain, Server and Share)
3. Activate UAG

Read More...

DNS64 Not Healthy after Applying UAG SP2

For those who missed the latest news on UAG, Microsoft released UAG SP2 early this month. For what is new in Microsoft UAG SP2 please check the following link:

http://technet.microsoft.com/library/jj590875

http://support.microsoft.com/kb/2710791

To Download Microsoft UAG SP2, please follow this link:

http://www.microsoft.com/en-us/download/details.aspx?id=30459

Everything went fine while downloading and updating UAG server with the latest SP2, After reboot i noticed that the DNS64 shows Not healthy under the DirectAccess Monitor/Current Status. This is the same behavior that i faced while installing update 1 Rollup 1 early this year and the workaround to fix it was to disable/enable Direct Access from the UAG 2010 console. For detailed steps please check my earlier link:

http://itcalls.blogspot.com/2012/01/dns64-unhealthy-after-applying-uag-sp1.html

Read More...

Microsoft UAG DirectAccess Clients Cannot Reach and Ping your Partner/Newly Acquired Company Network

Its quite often that many corporations acquire a new company or merge with another company with different domain name, subnets................etc. DirectAccess clients in one company cannot reach or ping the different resources, servers, routers..........etc in the other side (acquired/partner company). This can be solved by modifying your DNS infrastructure and UAG DirectAccess Settings as per the following steps:

1. Configure the UAG server to have an IPV4 route to the new acquired network(s). 
2. Make sure that the new acquired Network(s) are added to the UAG internal Networks. This can be done from the UAG Admin Menu – Network Interfaces – Define Internal network IP address range.
3. The DNS servers used by the UAG and DirectAccess clients should be configured to resolve the acquired/Partner Domain either by having their DNS zone or by using conditional Forwarders.
4. Configure your DirectAccess clients to use a DNS suffix search list. This list should include their current original company domain and the newly acquired domain. You may want to test it manually to ensure its working however its preferred to be done on the UAG DirectAcccess clients OU using Group policy as per attached.

5. Microsoft UAG need to be configured to ensure that the client’s NRPT (Name Resolution Policy Table) instructs the client to contact UAG for name resolution of the acquired domain. This will be done from the DirectAccess UAG configuration Step 3 (Infrastructure Servers – DNS Suffixes) as shown below

6. Apply the new config/policy and Activate the UAG.
7. Finally run gpupdate /force on the client to refresh the client group policy. To ensure that the policy is updated on the DirectAccess client you can run the “netsh namespace show pol”.

Read More...

RemoteApp and Web Application ICON Customization in UAG 2010 Portal

UAG 2010 Portal customization is one of the key strengths in the UAG system. The Customization of UAG is based on the Custom Update concept, for more details and real life example, please check the following articles:

• http://itcalls.blogspot.com/2012/03/uag-portal-home-page-customization-left.html
• http://technet.microsoft.com/en-us/library/ee861168.aspx

One of the main customization issues that i faced during the last few weeks is changing the Default icons for applications and RemoteApp published applications on the portal. UAG by default is pre-loaded with several default icons for different applications however Custom apps published using the Remote Desktop Services (RDS) RemoteApp or custom Web published apps gets the default ICON which is not sometimes representing the application as per the Owner point of view. In this article i will provide two examples for ICON customization in UAG 2010 Portal.

1. RDS RemoteApp applications, This includes three fairly simple steps:
• You need to have your ICON file saved in PNG format, the size won't matter as the UAG will automatically re-size it according to its placement in the portal. I tried 15x15 and 32x32 and 64x64 Pixels and it worked fine for the three of them.
• The ICON need to be saved under
  C:\Program Files\Microsoft Forefront Unified Access Gateway\von\PortalHomePage\images\AppIcons\CustomerUpdate (Provided that you installed the UAG in the default C-drive Location). The file should be saved under the application name, for example if your RemoteApp published application is named App1, then its icon should be App1.png.
• Activate the UAG
2. Custom Web Application, By default Custom Web application is published with the default App.gif file, to change this you have to do it in two locations:
• The main (Home) Portal area will need a GIF icon 90x50 Pixels and it will be saved same as the RemoteApp under C:\Program Files\Microsoft Forefront Unified Access Gateway\von\PortalHomePage\images\AppIcons\CustomerUpdate (Provided that you installed the UAG in the default C-drive Location). Again Make sure to name the GIF file with the same name as per your published Application (For example App1.GIF).
• Edit the Properties of the published Application on the UAG portal and change the ICON properties on the Portal Link TAB to reflect the new ICON

• The LeftExplorer Menu needs another ICON file with lower Pixel 15x15 and it should be named with the application name_ICON (For example App1_icon.GIF), similar to the above example, its saved under C:\Program Files\Microsoft Forefront Unified Access Gateway\von\PortalHomePage\images\AppIcons\CustomerUpdate (Provided that you installed the UAG in the default C-drive Location).
• Activate the UAG

These two examples should lay the basic knowledge to customize your UAG Portal application ICONS and hopefully you will find it useful.

Read More...

Publishing Microsoft Pool VDI on UAG 2010 Portal

Virtual Desktop Infrastructure is becoming a hot issue nowadays with many companies adopting this technology due to its flexibility, machines density, mobility, security, manageability and overall total cost of ownership. VDI can be either dedicated/Personal desktop assigned for specific user or pool of desktops available for all users (First come is first served); both flavors have their own benefits/drawbacks depending on your exact need and infrastructure. Microsoft allows you to publish the VDI solution on its UAG portal/Trunk however it’s not straight forward and not well explained/documented.

For an introduction to VDI components, please check the following link.

http://technet.microsoft.com/en-us/video/microsoft-virtual-desktop-infrastructure-vdi-explained.aspx

To publish your VDI Pool on UAG for External users, you need to do the following:

1.    Ensure the UAG server is fully updated and patched with latest UAG Service Pack and Rollups.

2.      From the UAG 2010 Server Copy the file ...\Microsoft Forefront Unified Access Gateway\common\conf\rd-template.txt to ...\Microsoft Forefront Unified Access Gateway\common\conf\Custom Update\rd-template.txt. This is needed to modify some RDP Parameters to make the VDI redirection work. For more information please check the attached link

 http://technet.microsoft.com/en-us/library/ff607422.aspx

For more information on the UAG Custom Update mechanism and a detailed example please check the following articles

http://technet.microsoft.com/en-us/library/ee861168.aspx#Customizing

http://itcalls.blogspot.com/2012/03/uag-portal-home-page-customization-left.html

3.    Add the below two lines to rd-template.txt and save it in Custom Update folder (mentioned in previous steps).

use redirection server name:i:1

loadbalanceinfo:s:tsv://vmresource.1.1

use redirection server name => Specifies whether a redirection server is allowed.

loadbalanceinfo => Contains the load balancing cookie used to choose the best server for the client computer. If you know your VDI Pool ID then you can change this command to be loadbalanceinfo:s:tsv://vmresource.1.PoolID

To get your VDI Pool ID, you need to connect to your Internal Connection Broker server then open the Server Manager – Roles – Remote Desktop Services – Remote Desktop Connection Manager – RD Virtualization Host servers– Pooled Virtual Desktops and then you can see all the properties including the Pool ID.

4.      From your UAG Portal/Trunk add new Application – Terminal Services– Remote Desktop (Predefined).

5.    In the Server Settings add the VDI Redirector session Host IP or Full Address and in the below space make sure to add all IP addresses or names of any system in your VDI solution (Session Broker, Gateway, Redirector, Session Host Virtualization and Virtual machines subnet). This is very critical step for the publishing rule to work fine. The Easiest thing is to add the full IP range for your VDI subnet. Then Activate your UAG.

Note: If you already created the VDI publishing application and it wasn’t working, make sure to delete this application, apply all previous changes and then add the application again, the Custom update changes won’t work for existing published applications.

Read More...

UAG Portal Home Page Customization – Left Side Menu/Scroll Bar Example

Microsoft UAG 2010 offers a very flexible way for customizing different pages and settings. The UAG Customization mechanism is deployed using a “CustomUpdate” Folder structure. Under the “Microsoft Forefront Unified Access Gateway” folder tree you will notice that several folders contain this “CustomUpdate” folder, in this folder the UAG admins can create their own Files and place them in the CustomUpdate folder. 

When the UAG is activated it checks these folders first before checking the default folder. Its highly recommended to try all your customizations in this Folder “CustomUpdate” and the main reason is that if things went wrong, you can just delete these files and everything will be back to the default state before customization. Most of the Customization done for the UAG portal is done via the PortalHomePage folder as per attached screenshot.

An Example of Customization that I came across lately is the ability to increase the width of the Portal Home Page Left Side Menu. To Increase the Left Side Menu are you need to do the following:

1. On the Forefront UAG server, open the folder Microsoft Forefront Unified Access Gateway\von\PortalHomePage
2. Copy the file Standard.Master to the folder Microsoft Forefront Unified Access Gateway\von\PortalHomePage\CustomUpdate.
3. Go to the Below section and modify the Width Portion <td class="midTopSideBarCell" style="width: 200px;"> then Activate the UAG and test the change.

<td class="contentLeftSideBarCell" id="LeftSideBarCell">
                            <table cellpadding="0" cellspacing="0" class="leftSideBarTable">
                                <tr>
                                    <td class="leftTopSideBarCell">
                                        &nbsp;</td>
                                    <%-- Folder View Title --%>
                                    <td class="midTopSideBarCell" style="width: 200px;">

This will increase/Expand the left Side Menu however the Bottom scroll bar is not automatically sized according to the main cell, to adjust it to automatically size/fit with the main left area you will need to customize the Office.css (Thanks to Microsoft team) file as follows:

1. On the Forefront UAG server, open the folder Microsoft Forefront Unified Access Gateway\von\PortalHomePage\App_Themes\Office\Office.css
2. Copy the Office.css file to the \von\PortalHomePage\App_Themes\CustomUpdate\Office\Office.css
3. Go to the below section (.SideBarContent) and modify the Width from 165px to 100% as shown below. Activate the UAG and test the change. This will automatically adjust the scroll bar to fit the left area in the portal.

A very good reference is Technet Article of Customizing the Portal http://technet.microsoft.com/en-us/library/ff607389.aspx and Ben Ari/Rainier Amara Latest comprehensive book dedicated for UAG 2010 Customization.

Read More...

Publishing IMAP/IMAPS on Microsoft UAG 2010 – UAG Support Boundary

Recently several users with BlackBerry phones approached me seeking to access their corporate email on their phones. Microsoft UAG doesn’t support Blackberry service however a workaround to this is using the IMAP to access and download their emails on their Blackberry phones.

Microsoft Highly recommend and Advice all UAG administrators to leave the TMG configuration (Installed by default on the UAG box) untouched. The TMG rules and configuration is controlled and configured by the UAG. The administrators should not use the TMG for publishing applications and other stuff. However there are some exceptions to this strict recommendation and its published in the UAG support Boundaries document. I also checked with Microsoft Support team and they confirmed the IMAP publishing based on this document.

UAG Support boundaries:  http://technet.microsoft.com/en-us/library/ee522953.aspx

As per the above mentioned document, Forefront TMG can be used to publish IMAP/IMAPS. Attached below is the section dealing with supported configuration on the TMG as per the above document.

Accordingly IMAP/IMAPS can be published normally from the TMG server (On UAG Box). This will be a simple Server Publishing Rule with the following settings:

1. Action - Allow
2. Traffic - IMAPS Server
3. From - Anywhere
4. To - Type You Exchange Server IP
5. Networks - External or DMZ (As per your setting)
6. Schedule  - Always

Its Highly recommended to use the IMAPS over the IMAP to ensure the traffic is encrypted.

Read More...

Manual Install of UAG 2010/Remote App and RDS Portal Components

Microsoft UAG 2010 main functions are Application Publishing and Enhanced DirectAccess deployment. The Application publishing allows you to publish several applications on either HTTP or HTTPS trunk. Application publishing includes Web applications, Non-Web applications, Remote Desktop Services (RDS), RemoteApps and VPN services.

When accessing the UAG portal for the first time from your computer using one of the supported browsers (Please check the Client requirements and Supported browsers in http://technet.microsoft.com/en-us/library/dd920232.aspx) the user will be prompted to download and install the UAG endpoint components, these components are used in many things among them checking device (Endpoint detection), SSL tunneling……………etc. This installation is done once per computer.

Some clients have restricted Internet Explorer settings (Using Group Policies) that prevent them from installing MSI or EXE files from the Internet and they need to install the Endpoint components manually.

There are two types of clients that you need to install manually to fully utilize the UAG portal.

1.    UAG Client Components, these are available on the UAG server under

 C:\Program Files\Microsoft Forefront Unified Access Gateway\von\PortalHomePage

 

Several files are available under this location for each component or you can just take the WhlClientSetup-all.msi from this location and have your users install it manually (Of course they need to have admin rights on their computer). Make sure you are running the latest UAG version on your server. The current latest version is 4.0.1773.10110 http://support.microsoft.com/kb/2647899

 

When manually installing the WhlClientSetup-all.msi, the users will be given the choice for Typical installation or Custom Installation to pick specific components as per the below screenshot.

 

2.    Remote Desktop Services (RDS) and RemoteApp need the latest Remote Desktop Connection 7.0 client update for Remote Desktop Services (RDS) for Windows XP SP3, Windows Vista SP1/SP2 which can be downloaded from the following site  http://support.microsoft.com/kb/969084  

This RDC 7.0 client is already installed by default on Windows 7 systems. If you using Network Level Authentication (NLA) on the RDS servers then you need to check this article http://support.microsoft.com/kb/951608 since the NLA is disabled on XP service pack 3.

 

Once both components (UAG and RDS) are installed manually, the user will be prompted to approve running the ActiveX and adding the portal site to the browser trusted sites.

Read More...

DNS64 Not Healthy after Applying UAG SP1 Update 1 Rollup 1

After applying the latest Rollup 1 for UAG SP1 Update 1 released on Jan 12, 2012 I noticed that the DNS64 is unhealthy under the Direct Access Monitor/Current status as shown in the below figure.

I did a reboot to the UAG/Direct Access server (although it’s not required by the fix) however the DNS64 component still showed unhealthy. I disabled/enabled direct access as follows:

1.     Disabled Direct Access

2.     Saved/Activated the configuration

3.     Enabled Direct Access

4.     GPupdate /force on the UAG Server

5.     Applied the policy

6.     Activated the configuration

After that it all worked fine. I am not sure about the reason (Will try to check with Microsoft Team) however that workaround fixed my problem.

Read More...