Publishing Microsoft Pool VDI on UAG 2010 Portal

Virtual Desktop Infrastructure is becoming a hot issue nowadays with many companies adopting this technology due to its flexibility, machines density, mobility, security, manageability and overall total cost of ownership. VDI can be either dedicated/Personal desktop assigned for specific user or pool of desktops available for all users (First come is first served); both flavors have their own benefits/drawbacks depending on your exact need and infrastructure. Microsoft allows you to publish the VDI solution on its UAG portal/Trunk however it’s not straight forward and not well explained/documented.

For an introduction to VDI components, please check the following link.

http://technet.microsoft.com/en-us/video/microsoft-virtual-desktop-infrastructure-vdi-explained.aspx

To publish your VDI Pool on UAG for External users, you need to do the following:

1.    Ensure the UAG server is fully updated and patched with latest UAG Service Pack and Rollups.

2.      From the UAG 2010 Server Copy the file ...\Microsoft Forefront Unified Access Gateway\common\conf\rd-template.txt to ...\Microsoft Forefront Unified Access Gateway\common\conf\Custom Update\rd-template.txt. This is needed to modify some RDP Parameters to make the VDI redirection work. For more information please check the attached link

 http://technet.microsoft.com/en-us/library/ff607422.aspx

For more information on the UAG Custom Update mechanism and a detailed example please check the following articles

http://technet.microsoft.com/en-us/library/ee861168.aspx#Customizing

http://itcalls.blogspot.com/2012/03/uag-portal-home-page-customization-left.html

3.    Add the below two lines to rd-template.txt and save it in Custom Update folder (mentioned in previous steps).

use redirection server name:i:1

loadbalanceinfo:s:tsv://vmresource.1.1

use redirection server name => Specifies whether a redirection server is allowed.

loadbalanceinfo => Contains the load balancing cookie used to choose the best server for the client computer. If you know your VDI Pool ID then you can change this command to be loadbalanceinfo:s:tsv://vmresource.1.PoolID

To get your VDI Pool ID, you need to connect to your Internal Connection Broker server then open the Server Manager – Roles – Remote Desktop Services – Remote Desktop Connection Manager – RD Virtualization Host servers– Pooled Virtual Desktops and then you can see all the properties including the Pool ID.

4.      From your UAG Portal/Trunk add new Application – Terminal Services– Remote Desktop (Predefined).

5.    In the Server Settings add the VDI Redirector session Host IP or Full Address and in the below space make sure to add all IP addresses or names of any system in your VDI solution (Session Broker, Gateway, Redirector, Session Host Virtualization and Virtual machines subnet). This is very critical step for the publishing rule to work fine. The Easiest thing is to add the full IP range for your VDI subnet. Then Activate your UAG.

Note: If you already created the VDI publishing application and it wasn’t working, make sure to delete this application, apply all previous changes and then add the application again, the Custom update changes won’t work for existing published applications.

Read More

Microsoft MBAM Client Implementation Best Practices

Microsoft BitLocker Administration and Monitoring (MBAM) is part of Microsoft Desktop Optimization Pack suite (MDOP) which contain other important and business enabling tools available for Software Assurance Customers. MBAM is used to simplify and control the Bitlocker implementation (Windows 7 Machine encryption), deployment, help desk support as well as providing rich compliance reports. In this article I would like to share some of the best practices that I passed by recently while implementing MBAM.

MBAM is implemented via Group Policies on your specified Windows 7 Laptops OU under Computer configuration - Policies - Administrative Templates - Windows Components - MDOP MBAM. This folder contain 4 main categories (check below image)

1. Client Management
2. Fixed Drive (Enable Password Protection)
3. Operating System Drive (Enable PIN protection)
4. Removable Drive

Normally we would enable the Client services and enforce the Fixed drive and OS drive encryption (PIN+Password). Depending on your Company policy you may enable or disable the Removable drive encryption (USB thumb drive). Under the Client Management category you can enable Hardware compatibility checking, this feature can be used to identify BitLocker-capable computers and exclude specific hardware that you don’t want encrypted. Only Laptops that are approved and turned to compatible (Hardware TAB in the MBAM admin site) will get encrypted.

The Key steps for successful Bitlocker/MBAM client implementation are as follows:

1. Enable TPM from the Laptop BIOS (check your Laptop Manufacturer BIOS settings)
2. Activate the TPM from BIOS
3. Install the MBAM client on the Laptop (32 bit or 64 bit client). Both are available in the MBAM source files.
4. In many cases MBAM fails to take ownership of the TPM and its recommended to install this fix http://support.microsoft.com/kb/2640178
5. By default the MBAM client will wait for 90 minutes random time delay before reporting to the MBAM server with any status, to overcome this default setting you need to add the DWORD key NoStartupDelay to the HKLM\Software\Microsoft\MBAM with value of 1 on each client. For more information about MBAM registry and Timers please check this link http://www.css-security.com/blog/mbam-real-world-information/
6. If you enabled the Hardware Compatibility checking policy (mentioned above), the MBAM administrator need to to approve the devices to get encrypted and change their status to compatible from the MBAM admin site. There is a 24 hr check delay when you turn the machine compatible from the MBAM console. To overcome this you need to remove the following two keys from your client machines then restart the MBAM agent service
• HKLM\software\microsoft\MBAM\HWExemptionTimer
• HKLM\software\microsoft\MBAM\HWExemptionType

       

MBAM Technical Documents:

• Planning Guide: http://onlinehelp.microsoft.com/en-us/mdop/hh285653.aspx
• Deployment Guide: http://onlinehelp.microsoft.com/en-us/mdop/hh285644.aspx
• Operations Guide: http://onlinehelp.microsoft.com/en-us/mdop/hh285664.aspx
• Troubleshooting MBAM: http://onlinehelp.microsoft.com/en-us/mdop/hh352745.aspx
• MBAM Scalability and High-Availability: http://go.microsoft.com/fwlink/?LinkId=229025
• MBAM Data Retention and Consistency Strategies: http://go.microsoft.com/fwlink/?LinkId=229052
• Using MBAM Data Encryption With MDT: http://go.microsoft.com/fwlink/?LinkId=229053
• MBAM Self-Help Portal: http://go.microsoft.com/fwlink/?LinkId=229054

Microsoft BitLocker Administration and Monitoring (MBAM) Documentation Resources Download Page

http://www.microsoft.com/download/en/details.aspx?id=27555

MBAM Videos and Tutorials: http://technet.microsoft.com/en-us/windows/ff383366.aspx#MBAM

Read More