- You have multiple domains inside an Active Directory Domain Services (AD DS) forest to which Microsoft Forefront Unified Access Gateway (UAG) 2010 belongs.
- You have users in a child domain of the forest.
- You have Service Pack 3 for Forefront Unified Access Gateway 2010 or Rollup 1 for Forefront Unified Access Gateway 2010 Service Pack 3 installed.
- The Account Domain field in the 4625 event displays the distinguished name (DN) of the parent domain.
- You have users authenticating to Forefront UAG.
In this scenario, you may notice an increase in the number of failed logon tries in the Security event logs on the domain controllers. A user logging on to Forefront UAG may generate multiple 4625 events every time that they log on. This problem occurs when Forefront UAG tries to look up the groups from multiple sub-domains. The logged events do not affect the user logging on.
- Create the following registry value:Registry subkey location: HKEY_LOCAL_MACHINE\Software\WhaleCom\e-Gap\von\UserMgr
DWORD name: DoNotFetchSubdomainUserGroups
DWORD Value: 1
- Apply Service Pack 4 for Forefront Unified Access Gateway 2010.
- Start the Microsoft Forefront UAG Management console, and then click Activate to apply the changes to your configuration.
- In the lower message pane, wait for the following informational message:
Note By default, informational messages are not enabled or displayed. To enable the informational messages, follow these steps:
- In the Forefront UAG Management console, on the Messages menu, click Filter Messages.
- On the Messages Filter dialog box, in the Message Window area, click to select the Information messages check box, and then click OK.
Note Setting this registry subkey has no functional effect on the logon process and prevents the failed logon tries from being raised.
Article ID: 2910413 - Last Review: 27 Nov 2013 - Revision: 1