You configure Microsoft Forefront Unified Access Gateway (UAG) 2010 to perform a soft lockout on a user after several failed authentication tries. If you also configure Microsoft Outlook Anywhere to use Kerberos Constrained Delegation (KCD) for Single Sign-On (SSO) access to Microsoft Exchange Server, you find that the soft lockout process does not apply.

In this configuration, Outlook authenticates to UAG by using NTLM authentication.


This problem occurs because the "Integrated Windows Authentication" handler in UAG does not check the account lockout status correctly.


This problem is fixed in Rollup 1 for Microsoft Forefront Unified Access Gateway 2010 Service Pack 4 (SP4).


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.


Learn about the terminology that Microsoft uses to describe software updates.

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

What affected your experience?

Thank you for your feedback!