RDP pre-authentication: what does it actually do?

I'm trying to integrate Forefront TMG and RDS with SecurID authentication. I believe I'm very close to having it working, but I'm hitting a brick wall.
I have "require pre-authentication" set, and "pre-authentication server name" configured, as indicated in so many forum posts and HOWTOs.
No matter what I do, clients receive the error "authentication to the firewall failed due to missing firewall credentials." This is
after they have already successfully authenticated and visited the /RDWeb pages.
Using the TMG logs, procmon, and wireshark, I am 100% certain that no network activity is occurring from the RDP client when this error occurs; this error is being generated entirely on the client side, before it attempts to connect to anything. I understand
that this is what is expected; it is checking for the existence of a cookie.
But the cookie doesn't exist. Why? Because nothing is setting one. The only cookies the client receives during the entire process (logging in to rdweb and trying to launch an app) are the SecurID domain SSO cookie I set in TMG, and the persistent authentication
cookie I also set in TMG. RDweb itself is not issuing any cookie at all.
Can anyone please explain to me, what specific cookie is the RDP client looking for when "require pre-authentication" is enabled? And which component is meant to be setting it?
Obviously I'd be very grateful if anyone can tell me "run this command and it will start working" or whatever, but I'm really hoping to gain an engineering-level understanding of how it's
meant to work ;)

 
Hi,
Please double check the following article:
Configuring Forefront Threat Management Gateway Integration with RD Gateway Step-by-Step Guide
http://technet.microsoft.com/en-us/library/gg589607(v=ws.10).aspx
On the Forefront TMG server apply the Filter ipv4.address==<your public IP>
When client request of remote desktop is reaching to TMG server, please check if the TMG server is forwarding the packet to RDG server.
Looking forward to your feedback.
Regards,
Dollar Wang
Forum Support
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Technology changes life……

Similar Messages

  • Database Table Resource - What does it actually do?

    Hi,
    I want to know what it actually means to grant a database table as a resource to a user in IDM.
    For E.g.: When I provision a NT resource to a user using IDM, it means that a Windows NT account is created for that user.
    However, when I assign a Database table as a resource for a user of IDM, it does not create a user account for that user.
    I am using mySql, and I have assigned a DB table as a resource for a new account. However, I find that such a user is not created in mySql. What does that mean? How then does this user access that database table?
    I was under the impression that a user account would be created in mySql having privileges for that table. In effect, a SQL statement like "Grant all privileges on <tablename> to <username> ".
    Thanks in advance.

    If you want to create or edit mysql users, you would use the MYSQL resource adapter, not the Database Table adapter. The database table adapter is designed to manage rows of a table within the database. Neither allow arbitrary SQL to be excuted, but you could make SQL calls via express in your form or workflow.

  • ACS Express 5.0 - "unique authentication" what does it mean?

    Hi to all,
    the ACS Express 5.0 datasheet states: "Cisco ACS Express supports a maximum of 50 AAA clients and 350 unique user logins in a 24-hour period"
    It's clear what's the meaning of the max 50 AAA clients...in fact what is not clear is regarding the max 350 uniques user authentication.
    If I use 802.1 IBNS with PEAP-MSCHAP to do machine authenticaion each machine authentication will count as a unique logon...isn'it? What happens if there are Laptop assigned to sales which spent a lot of time out of the office???
    Each time these laptops reconnect to the network wil count as an extra logon or and increase the logon counter of one or since this laptop is already authenticated on the morning t won't count as an extra unique logon...
    My question is related to the fact that I have a customer who wanto to introduce IBNS-802.1X but have "only" 20-25 AAA clients and max. 200 users (where about 100 are laptop)...and using ACS 5.0 in a redundant way will be too expensive...
    Thanks for a reply
    Omar

    The ACS Express 5.0 Appliance is designed for a maximum of 350 users. This limit does not apply to the number of logins.
    Cisco Secure Access Control Server Express 5.0 QA
    http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps5698/ps6767/ps8543/ps8724/prod_qas0900aecd806d3a4d.html
    Q. How is Cisco Secure ACS Express positioned in comparison to Cisco Secure ACS for Windows (ACS Windows) and Cisco Secure ACS Solution Engine (ACS SE)?
    A. ...Cisco Secure ACS Express is well suited for deployments that need an access control solution for fewer than 350 users and 50 devices. This product is intended to serve small to medium-sized businesses, retail sites and enterprise branch offices where customers need an easy-to-use GUI yet require a comprehensive but simple feature set and a lower price point to address their specific deployment needs.
    For a detailed feature set, please refer to the Cisco Secure ACS Express data sheet at http://www.cisco.com/go/acsexp....

  • What does syncing actually do

    My wife is afraid to attach her iPhone to the computer do to it wanting to sync with the phone. She is afraid of losing music and pictures on the phone.
    Please let me know what is actually done when it syncs, so I can make her feel safe.
    Thanks
    Keith

    Good question? How did the music and other similar type soft products get out to the iPhone.
    But...
    When you Sync the iPhone it takes information that you may have updated through outlook, calendar, music, etc. that you may have updated on your computer and compares and coordinates that information with that on the iPhone.
    If the information is not on the iPhone but on the computer, it will move the computer information to the iPhone as an addition to the what is already on the iPhone. In the case of music, I believes that it re-writes all of the music you have designated under the music tab to the the iPhone.
    It looks under the tabs indicated by:
    Info
    Ringtones
    Music
    Photos
    Podcasts
    Video
    and moves that information, file by file to the iPhone.
    In the case of the contacts on the iPhone, it will compare the contacts on the iPhone and determine which contacts are new o and modified and moves them to the computer since you may have made entries directly into your iPhone.
    It also does the same thing with the calendar. If you made entries directly into the iPhone and not on the computer it will sync the calendar from the iPhone to the computer.
    The precedent of whether the change on the computer has precedent over the ones on the iPhone, if in conflict are resolved during the sync operation and the user syncing the the devices gets a choice of which data to use.
    I have never lost data during the sync operation.
    Whew!!

  • What does it actually mean to say the website is stateless?

    I am having trouble resolving an important query!
    I understand that Azure websites are stateless in the sense of session state for a web application.  
    However, what I am getting contradictory messages about is as to whether if a website VM is reset, you would lose any changes to a website (i.e. it would revert to the original version).
    This would seem rather peculiar, I would understand reversion to the last deployed version before a problem.
    So the questions are:
    1.  To what point in time is a website restored to if a VM fails (assuming we just have a single instance ?)
    2.  If the VM does get reset, do you lose the contents of the data, LogFiles and any custom directories in the site folders and  underneath the wwwroot directory you see when logging in with FTP? 
    I have just thought of a related question if you had multiple instances, would these custom directories and their contents replicate between instances? (i.e. would they sync to the latest version?)
    The background is that the current site that is being moved from an ISP, will upload user files for temporary storage until the customer downloads them.  Obviously a long term aim is to get these into BLOB storage.
    mmacneill123 (MCP)

    Thanks David
    I am 99% certain that answers by question, I do not see a D:\home but I assume the website is on d by default and the home directory just \ in an FTP client?
    Thanks :-)
    mmacneill123 (MCP)

  • What does this actually mean and how do I fix it: Alert: Error Count Monitor Resolution state Object Hyper-V Virtual Storage Device Has a value

    We are getting this alert on a fair few of our VMs with VHDXs and Dynamic VHDs. Everything seems OK but I am not sure what this actually means and what I need to do to resolve the issue. How do I reset the error count if that is what is required? Thanks
    in advance.
    Alert: Error Count Monitor Resolution state: New
     Error Count Monitor Source: MyVm01 Path: MyHost.MyDomain.local;MyHost.MyDomain.local;FE71577B-A2E2-45C0-B757-2FBCEC9311DE Last modified by: System Last modified time: 2/9/2013 2:08:48 PM Alert description: Instance c:-clusterstorage-volume1-MyVm01-virtual
    Sat 09/02
    To:Administrator
     09 February 2013 14:09
    Alert: Error Count Monitor
    Source: MyVm01
    Path: MyHost.MyDomain.local;MyHost.MyDomain.local;FE71577B-A2E2-45C0-B757-2FBCEC9311DE
    Last modified by: System
    Last modified time: 2/9/2013 2:08:48 PM
    Alert description: Instance c:-clusterstorage-volume1-MyVm01-virtual hard disks-MyVm01-DATA02.vhdx
                Object Hyper-V Virtual Storage Device
                Counter Error Count
                Has a value 9
                At time 2013-02-09T14:08:48.0000000+00:00
    Darren

    But I am getting this alert from SCOM and SCOM has no information about the alert for me to find out what to do - thought that was the point of SCOM to let you know of problems and how to resolve them. :)
    The alert is coming from the Error Count Monitor that is part of the Hyper-V Management Pack Extensions (v 4.0.0.0)
    I have tried looking in the Event Logs on the Host and there doesn't seem to be any storage related errors there. I am trying to establish if this is a false positive, why it is happening and if it is safe to override and ignore.
    There is nothing on the Product Knowledge tab and nothing on the Alert Context other than what I have already mentioned (see below).
    Thanks for responding.
    Time Sampled:
    09/02/2013 14:08:48
    Object Name:
    Hyper-V Virtual Storage Device
    Counter Name:
    Error Count
    Instance Name:
    c:-clusterstorage-volume1-myvm-virtual
    hard disks-MyVM-DATA02.vhdx
    Value:
    9
    Darren

  • What Does It Actually Mean to "Buy" an Apple TV Movie?

    Have searched but can't find the answer to the following: When I "buy" a movie via Apple TV, what happens to my "ownership" of that movie in the future? If I have to replace the original Apple TV device? If I get rid of Apple TV, then later buy another one? Are my purchases linked to my User ID and password so that I will have access to a purchased movie "forever"? Also, if one fills an Apple TV hard drive with purchased movies and wants to add more, what's the fate of the material "deleted"? If Apple TV ownership rights are addressed on the Apple site, I haven't been able to locate them.

    the actual agreement is shown just before you buy any media.. not sure where to find it on the site.
    but my understanding is that.. no downloads later as a rule, but some have managed to get apple to do this on a case by case basis when they have lost files. you are responsible for the safeguard of the files once downloaded. files can be played on 5 authorized computers (the 5 doesn't include appleTV and iPods)... i think computers can be de-authorized, so i guess it 5 computers simultaneously.
    if you want to delete a file from appleTV then you should sync appleTV with a computer so the file can be backed up. even though apple advertises appleTV as a optionally a standalone devise... it'd be very unwise imo to use it in that way since the files on the appleTV cannot be backed up (if you sync with a computer they can be) and a glitch (software, HDD fails etc..) with appleTV would mean losing your files. if sycing is enabled then when files are purchased on the appleTV they auto sync back to the computer. if one streams from a computer additional HDDs can be purchased and attached to the computer meaning basically limitless storage.

  • What does "tradedoubler" actually do?

    Every time I click on a link that opens the App store on my iPhone - for instance, in one of those "free apps" applications, it goes via Safari.
    In that short moment that the Safari window floats by, I can see that it goes to a "tradedoubler" link.
    I looked it up: Tradedoubler is "an international performance-based digital marketing company".
    Which tells me exactly nothing at all. It doesn't explain in any case why my looking up some or other iPhone app should necessarily go via them.
    Other links that Google comes up with explain technicalities about "link generation". What I don't get is why Apple would need an external party to create links to, say, their own app store?
    In other words, what is this "international performance-based digital marketing company" really doing?
    It's not that I'm in any way bothered by them: they don't send me bills; they don't block things. They just swivel past on that odd Safari window every time I click an app store link. It's just a bit weird.
    It is as if a representative of some "international performance-based cash marketing company" would suddenly pop up every time I make a cash payment and insert themselves in the transaction that was hitherto taking place between me and, say, the supermarket cashier: a guy in a business suit would take the money from my hand and hand it to the cashier.
    And everyone would just stand there and act as if it's the commonest thing in the world. 
    That's how it feels: some inscrutable entity has inserted itself into something that I would consider to be nothing but a link - not more complicated than the "a href" sort of thing in HTML.
    I just can't help wondering about it - does anyone know if there is a good solid reason for this Tradedoubler to poke its nose in my App Store business all the time?

    It's an affiliate program from Europe. No big deal really, just tracks links you hit to open the iTunes app store. For it to pop up you must have hit a link from an affiliate, this affiliate will receive 4% of the app purchase price.
    Though as affiliate I never been paid yet, I'm now gathering a couple of 100 red euros that won't seem to ever reach my bank account
    Apple itself does not need these links, it's all affiliate work.

  • What does deauthorization actually do?

    I need to deauthorize iTunes on some old computers that I no longer own. It seems like the only way to do this is to deauthorize my iTunes account on all devices and start from scratch. But what exactly does that do? Will my music be there when I authorize iTunes on my current computer? Will music that I didn't purchase from iTunes but uploaded from CDs still be there? I just don't have a clear idea of what deauthorization does, so I'm hesitant to go through with it. Thanks!

    " But what exactly does that do? "
    Removes the permission to use the itunes purchases on that computer.
    "Will my music be there when I authorize iTunes on my current computer? "
    if it is there now,  it will be there later.  Nothing is lost.  You should always have a backup copy anyway.
    " Will music that I didn't purchase from iTunes but uploaded from CDs still be there? "
    if it is there now,  it will be there later.  Nothing is lost.  You should always have a backup copy anyway.

  • What does refurbished actually mean?

    I'm about  to buy a refurbished Macbook but cannot see any explanation of exactly what has been refurbished? How can I find out this detail?

    Apple Certified Refurbished Products
    Apple Certified Refurbished Products are pre-owned Apple products that undergo Apple's stringent refurbishment process prior to being offered for sale. While only some units are returned due to technical issues, all units undergo Apple's stringent quality refurbishment process....
    From what I've read - most come in a plain outer box rather than the colourful printed one.

  • YouTube - What Does ATV2 Actually Support or Not?

    Does Apple have a list anywhere of what it does and does not support from YouTube on the ATV2? Does anyone here know for sure?
    Playlists are out. I can't see my prior favorites, but I could save new search results to favorites (it looks as if the ATV2 has its own favorites separate from existing ones) -- then the ATV2 stopped saving new searches to favorites. It repeatedly gives me a "trouble contacting YouTube" error dialog, even though it is streaming video. Is it possible there is a limit, and a very low limit at that, on number of videos that can be saved to "favorites"?
    "My videos" doesn't seem to be there.
    Search results are different than on the Mac itself, which is weird, but not a killer.
    YouTube video appears to be rendered slightly better than on the original ATV1, by the way.

    access to youtube is very much reliant on google/youtube not changing anything server-side.
    however there are some limitations which have always been there (and are not necessarily the fault of apple).
    1) not ever youtube video is made available to appletv (for several reasons). the uploaded can easily opt out of syndication which means the video can only be viewed on the website.
    2) videos have to be converted by google/youtube before they are available to appletv/iphone etc.
    if google/youtube happen to change something server-side it means that apple need to update the software before functionality is corrected.

  • Fsb overclocking...what does it actually change? (K7N2 delta-L)

    Hi all,
    I got my new mobo K7N2 delta-L, and I've heard some talk that it should be safe to OC fsb with this mobo as it wouldn't change any other speeds than only the speed of cpu.
    So I'd like to hear how it really is, if I change the fsb does it have any impact on pci or most importantly ide devices? In bios I can set the speed of AGP and memory manually so I guess the fsb doesn't affect to them. But does it then if I don't set memory manually and set it to AUTO or SPD? Most importantly I'm asking what about the IDE, now as I understand pci speed is the same as IDE speed, and there is option in bios "AUTO detect pci clock", if I set that to enabled, does that mean that my hard drive and cd-rom speed always stays the same (33mhz) nomatter what I change my fsb? Please someone give me detailed information on how changing the fsb on K7N2 delta-L works and everything that it affects, or does it really only affect on cpu speed as I've heard. Thank you very much already!

    Just from my experience upping the fsb also ups your PCI
    cards, AGP video,CPU and last but not least memory.
    I think the most gain is in memory benches. The CPU doesn't jump much but the memory is very noticable.
    Upping too far can and will lead to a non posting computer,
    the tough part after hours of experimenting is to try and play your games without addition problems.
    I was O/C'd very well but had to quiet it all down to play Grand theft auto Vice city.
    Had trouble with the O/C on that one alone, all else was fine with 446fsb 223x10.5 but had to wave it all good bye for the sake of the game.I like the game so near stock is what I'm running now.
    I did however just upped my video card to a Radeon Pro 9800 and wait for it and hope I can reclaim some O/C but heck with that card I may not need it.

  • What does RMI actually do?

    Is it something better that should be learned instead of sockets or something. I don't know much about it, and I tried reading some of the info on the site about RMI, but it just doesn't make sense to me. Can anyone maybe just breifly explain it?

    RMI is not really a substitute for Sockets. What RMI allows is for classes of a program to be spread out over a network or the internet. These classes will run just as if you had them all on the local machine (more or less).
    It has some neat applications. However most of what you can do with RMI you should be able to do with sockets. I think RMI is used best within a network, getting into the internet gets into to many security issues that from what I've seen Sockets are much better equiped for.
    If you are curious about something in particular post again and I'll see what I can do.
    If anybody has something to add or correct me on I'd sure like to hear it.

  • What does compressor actually do?

    Sorry if this is stupid but I have owned a mac for about a year and I am always wondering what compressor is. It seems related to video editing but I'm not sure.
    Thanks,
    Macguy3000

    Hi,
    here is a brief explanation.
    Compressor is an extremely useful application for many editors and video/audio professionals and an irreplaceable tool when it comes to encode and compress an edited movie.
    I use it every day.
    Compressor can convert your final movie in MPEG 2 with ac3 dolby stereo compressed audio file for your final DVD (DVDstudio leaves the audio as AIFF, which will take a lot of space in the disc you want to burn and may not work properly with some DVD players).
    With Compressor you can convert and encode in many other formats for the web, podcast, ipod, DVD etc. Just open all the directories in the settings window to find out more.
    Compressor allows you to customize settings in its inspector window so that you can decide frame ratio, output fields, bit rate, audio output, levels and SO much more.
    Compressor can even convert NTSC footage into PAL and vice-versa.
    To tell you what Compressor can do would take me too long but if you click on help in the main menu of the program and open the manual you will see that it is less than 400 pages.
    Try reading it. Once you get to know how it works it will become more and more useful to you.
    The site below will also guide you through very well:
    http://www.kenstone.net/fcphomepage/fcp_homepageindex.html#dvd
    Hope that helps.
    G.

  • What does NFC actually do on a laptop?

    I am looking at a T540 and I see that NFC is available as an option. I use it all the time on my smartphone, but what purpose would it serve on a laptop? Can it do file transfers like Android Beam?
    W540: i7-4700mq, K2100m, 8 GB DDR3L, 512 GB SSD
    T510: i7-620m, NVS 3100m, 8 GB DDR3, 512 GB SSD

    Hi Shawn3090,
    Welcome to Lenovo Community!
    As per the query we understood that you are looking for the details on NFC technology on ThinkPad T540.
    Near Field Communications (NFC) Controller Family.
    Broadcom family of chips is made up of NFC-compliant, highly integrated, low power, low cost, 40 nm NFC controllers.
    Low power target detection mode reduces polling power consumption for longer battery life
    Support for field power harvesting allows the chip to draw energy from the environment so it can support transactions even if the phone battery has expired
    Industry's smallest size chip integrates more external components, reducing total solution BOM (bill of materials) costs
    Only NFC controller to integrate transaction-based Application ID (AID) routing for simultaneous support of multiple secure elements (both SIM and non-SIM) within a single device
    Easily pairs with Broadcom's InConcert® BCM4330 Bluetooth, Wi-Fi and FM combo chip for comprehensive connectivity solution.
    Hope this helps!
    Best regards,
    Hemanth Kumar
    Did someone help you today? Press the star on the left to thank them with a Kudo!
    If you find a post helpful and it answers your question, please mark it as an "Accepted Solution"! This will help the rest of the Community with similar issues identify the verified solution and benefit from it.
    Follow @LenovoForums on Twitter!

Maybe you are looking for