FIX: Soft lockout does not apply if Outlook Anywhere uses KCD for SSO to Exchange Server - Microsoft Support

Support

Sign in

Sign in with Microsoft

Sign in or create an account.

Hello,

Select a different account.

You have multiple accounts

Choose the account you want to sign in with.

Applies To

Forefront Unified Access Gateway 2010

Symptoms

You configure Microsoft Forefront Unified Access Gateway (UAG) 2010 to perform a soft lockout on a user after several failed authentication tries. If you also configure Microsoft Outlook Anywhere to use Kerberos Constrained Delegation (KCD) for Single Sign-On (SSO) access to Microsoft Exchange Server, you find that the soft lockout process does not apply.In this configuration, Outlook authenticates to UAG by using NTLM authentication.

Cause

This problem occurs because the "Integrated Windows Authentication" handler in UAG does not check the account lockout status correctly.

Resolution

This problem is fixed in Rollup 1 for Microsoft Forefront Unified Access Gateway 2010 Service Pack 4 (SP4).

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References

Learn about the terminology that Microsoft uses to describe software updates.

Email

SUBSCRIBE RSS FEEDS

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Microsoft 365 subscription benefits

Microsoft 365 training

Microsoft security

Accessibility center