Wednesday, August 12, 2009

Forefront for OCS causes URL text conversion error

I am currently running an R1 pool and an R2 pool side by side during a migration. It was decided we would use Forefront for OCS on the R2 pool to appease the security guys. During testing we discovered that although the client filtering tools were set identically on each pool, when sending a url from an R2 client/pool to an R1 client/pool or R1 to R2, the URL failed to send with the following error:

_http://www.microsoft.com/technet/security/bulletin/MS09-034.mspx
The following message was not delivered to Doe, John. More details (ID:400)
_http://www.microsoft.com/technet/security/bulletin/MS09-034.mspx

This only occurred when crossing pools. R2 to R2 client/pool worked fine, R1 to R1 client/pool also worked fine and correctly converted the URL to text.

When working correctly it appears like this:

Your hyperlink has been converted to text - to use copy and paste to a browser
_http://www.microsoft.com/technet/security/bulletin/ms09-034.mspx


After reviewing logs from both pools and both clients it was determined that Forefront for OCS was blocking the transfer. Disabling Forefront for OCS did not resolve the issue, stopping Forefront services caused the OCS front end service to stop (ah, security). Uninstlaling Forefront resolved the above. Luckily I have not gone production with R2 yet. I currently have a case open with MS and will post results here as obviously I will need to be running Forefront for OCS when R2 goes production.

1 comment:

  1. UPdate: OCS R1 Client/Pool and OCS R2 Client/Pool have URL filtering incompatibility when Forefront for OCS is installed.
    There is a KB article http://support.microsoft.com/kb/971480/ that goes over this known issue. However, the SERVER registry setting is incorrect, the entry should be made to:
    HKLM\Software\Wow6432Node\Microsoft\Forefront Server Security\Office Communications Server

    for Server 2008 x64.

    I also found that I did not require the client registry setting to get this to work, however this workaround does enable hyperlinks in chat. There may or may not be a "fix" in the first or second rollups, which may or may not be released by the end of the year (09).

    ReplyDelete