Multiple 4625 event IDs are logged when a user logs on in Forefront Unified Access Gateway 2010


Symptoms


Consider the following scenario:
  • You have multiple domains inside an Active Directory Domain Services (AD DS) forest to which Microsoft Forefront Unified Access Gateway (UAG) 2010 belongs.
  • You have users in a child domain of the forest.
  • You have Service Pack 3 for Forefront Unified Access Gateway 2010 or Rollup 1 for Forefront Unified Access Gateway 2010 Service Pack 3 installed.
  • The Account Domain field in the 4625 event displays the distinguished name (DN) of the parent domain.
  • You have users authenticating to Forefront UAG.

In this scenario, you may notice an increase in the number of failed logon tries in the Security event logs on the domain controllers. A user logging on to Forefront UAG may generate multiple 4625 events every time that they log on. This problem occurs when Forefront UAG tries to look up the groups from multiple sub-domains. The logged events do not affect the user logging on.

Cause


This problem occurs because multiple events are logged every time that a user logs on to Forefront UAG. In this case, enumeration of the groups in which the user is a member in other sub-domains is tried. These lookups may result in an incorrect query that triggers the failed logon events. 

Resolution


To resolve this problem, install Service Pack 4  for Microsoft Forefront Unified Access Gateway 2010, and then follow the steps in the "More Information" section.

Status


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information


To prevent Forefront UAG from enumerating groups on sub-domains, follow these steps:
  1. Create the following registry value:

    Registry subkey location: HKEY_LOCAL_MACHINE\Software\WhaleCom\e-Gap\von\UserMgr
    DWORD name: DoNotFetchSubdomainUserGroups
    DWORD Value: 1

  2. Apply Service Pack 4 for Forefront Unified Access Gateway 2010.
  3. Start the Microsoft Forefront UAG Management console, and then click Activate to apply the changes to your configuration.
  4. In the lower message pane, wait for the following informational message:

    Activation completed successfully.

    Note
    By default, informational messages are not enabled or displayed. To enable the informational messages, follow these steps:
    1. In the Forefront UAG Management console, on the Messages menu, click Filter Messages.
    2. On the Messages Filter dialog box, in the Message Window area, click to select the Information messages check box, and then click OK.


Note Setting this registry subkey has no functional effect on the logon process and prevents the failed logon tries from being raised.

References


See the terminology Microsoft uses to describe software updates.