After upgrading our domain Controllers, DNS and DHCP servers to the latest Windows Server 2012, I noticed that our Windows 7 UAG DirectAccess clients are not able to RDP (Remote Desktop/MSTSC) to the new Server 2012 Domain Controllers. The same client can ping the 2012 Domain Controller and 2012 DNS server without any problem however all RDP traffic fails.

The weird thing was that at the same time these clients (Windows 7 DirectAccess UAG clients) can ping and RDP/MSTSC any other Windows 2012 member server without any problem at all.

I did some intensive checks and research on the Internet but could not find anything regarding Server 2012 domain controllers issues with UAG based Direct Access, As per Microsoft Escalation team recommendation we did a full tracing scenario on both the UAG and Windows 7 client. 

I tried to reproduce the problem while turning simultaneous capture on both the client and the UAG server using the below scenario

Netsh wfp capture start

netsh trace start scenario=directaccess capture=yes report=yes

Tried both RDP and Ping to the problematic Windows server 2012 domain Controller

Netsh trace stop

Netsh wfp capture stop

After analyzing the captured logs, I noticed that the DA client is using an Expired Security Association when it cannot access the 2012 server. Tracing from UAG server showing the RDP traffic dropped on UAG Server due to the following error. 

“STATUS_IPSEC_WRONG_SA”

Resolution:

This problem was fixed by installing the hotfix for IKEEXT.dll on the UAG 2010 DA server and on the Windows 7 DA client. It should be noted that this fix is only for 2008R2 servers and Windows 7 Clients.

2801453-Delay during IPSEC renegotiation on a computer that is running Windows 7 or Windows Server 2008 R2.

http://support.microsoft.com/kb/2801453/EN-US

After installing this fix on both the UAG server and Windows 7 client, I was able to RDP/MSTSC the 2012 Domain Controller/DNS without any problems.

For more UAG, DirectAccess and Microsoft Security help, please check my Blog http://itcalls.blogspot.com

http://itcalls.blogspot.com/2013/07/windows-7-uag-direct-access-clients.html