Skip to main content

UAG endpoint detection and access policies

Endpoint detection and access policies are among the most important security features of the Unified Access Gateway (UAG). Naturally, the ability to evaluate the health of endpoint devices and to enforce certain requirements goes a long way towards enhancing overall security profile of any remote access solution and can play an essential role in implementing organization’s security in-depth strategy. UAG endpoint detection and access policies allow for an extremely detailed level of control. The policies can be applied at three different levels:

  • Trunk – policies applied at this level will be enforced before a user logs on, and if the computer does not meet them, the user will not even reach the log-on page.
  • Portal – policies applied at this level may prevent a user from accessing the portal application after the log-on.
  • Application – policies applied at this level may block access to some or all published applications.

When the user tries to access the UAG portal client components are initialized and perform a system scan. Data collected (about 300 parameters) is sent back to the UAG server, which evaluates it against endpoint policies set for the trunk, portal, and applications, to determine the appropriate level of access.
It is important to note that client components are required for the endpoint detection to work. Also, for security purposes the client detection components will not trust just any website that tries to launch them – unless user has selected to trust the site, the components will not run.
Enforcing 'Any Antivirus' and 'Any Personal Firewall' settings:
The following seem to be a popular initial configuration - to create a custom policy that will enforce the requirements for anti-virus and personal firewall software on the endpoint devices and to apply it at the trunk level. So, I will use it as to showcase the creation of a custom policy:
  • Select the trunk you will be applying custom policy to, navigate to “Endpoint  Access Settings” tab, and click on “Edit Endpoint Policies”:

  • Click on “Add Policy”:

  • Create new policy that defines “Any Antivirus” and “Any Personal Firewall” requirements:
 
  • Apply newly created policy instead of “Default Session Access” one to the trunk:
 
  • Make sure to click on “Activate configuration” for changes to take effect: 
 
  • Test new configuration – first, by trying to connect to the trunk from the device running anti-virus and personal firewall software (upon endpoint detection and evaluation you should get a standard log-on screen); then, by turning your personal firewall off and trying again (you should get a message notifying you that your device does not meet security policy requirements).

Comments

Popular posts from this blog

Skype for Business and VTC Interoperability

Skype for Business (SfB) has a very, very strong potential, I have written about it in my previous post. I can't think of any other platform that shows as much promise in terms of bridging personal and business communications as well as unifying different modes and mediums. And all of this may have started with a strategic acquisition of Skype by Microsoft in 2011.

That said, the road ahead is not without challenges. For example, interoperability with other platforms. Making SfB work with existing Video TeleConferencing (VTC) systems, many of which represent significant capital investments in organizations' infrastructure, could be of a particular importance.

After reading statements like Skype for Business is based on Session Initiation Protocol (SIP) standards and supports H.264 (MPEG-4 video coding standard) one can come to a quick conclusion that integration and/or interoperability with other VTC solutions is easy or nearly automatic. Unfortunately, the industry is not qui…

PoSh Disable and Move AD Users

A quick and easy way to disable user accounts and move them into designated OU:

Import-Csv "C:\TEMP\users.csv" | ForEach-Object { `      $u=$_."sAMAccountName"; $l="Disabling and moving: " +$u; write-output $l; `      Get-ADUser -Identity $u | `      Disable-ADAccount -PassThru | `      Move-ADObject -TargetPath "OU=Disabled Users,OU=Organization,DC=domain,DC=local"
Input is provided via a CSV file:
users.csv (username) sAMAccountName  jdoe1  jdoe2  jdoe3  jdoe4  jdoe5  

To generate input file run something like this, review and edit as necessary:
Search-ADAccount –UsersOnly –AccountInactive –TimeSpan 180.00:00:00 | `      where {$_.enabled} | `      Get-ADUser | `      select sAMAccountName | `      Export-Csv -Path "C:\TEMP\users.csv"

WordPress displays weird characters

Sometimes after a database conversion (e.g. from MySQL to MariaDB) or due to encoding issues a situation might arise when WordPress is showing weird characters. A quick way of remedying the situation would involve examining the pages to discover a pattern (what characters are being substituted, in the example below the apostrophe was replaced by â€™) then running an queries against the database to reverse the effect. Here's a quick example (common tables that store content):



UPDATE wp_posts SET post_content = REPLACE(post_content, 'Â', '')     UPDATE wp_posts SET post_content = REPLACE(post_content, '’', "'")     UPDATE wp_postmeta SET meta_value = REPLACE(meta_value, 'Â', '')     UPDATE wp_postmeta SET meta_value = REPLACE(meta_value, '’', "'")     
Please, keep in mind that to permanently resolve the issue you would need to get to the root of the problem and may need to adjust encoding, run a databas…