Home
  •  

Security - Diagnoser - Application

Microsoft.AppVirtualization.Server.45.VirtualApplicationServer.Security_Diagnoser_Application (UnitMonitor)

The Security aspect reports on the status of the Application Virtualization Server's certificate and secure communication.

Knowledge Base article:

Summary

The Security aspect reports on the status of the Application Virtualization Server's certificate and secure communication.

Verifier

Before an Application Virtualization Server can be configured to accept secure connections, it must first be provisioned with an X.509v3 certificate.  A certificate must have the proper attributes in order for the Application Virtualization server to find and use the certificate during the installation process.

The following certificate attributes are required:

  1. Server receiving the certificate MUST trust the Root CA which issued the certificate
  2. Certificate must be valid
  3. Certificate must contain the correct Enhanced Key Usage (EKU) - Server Authentication (OID 1.3.6.1.5.5.7.3.1)
  4. Certificate FQDN must match the server on which it's installed.
  5. Client needs to trust the same Root CA

To verify the security certificate for Application Virtualization Server:

  1.  Launch the Microsoft Management Console (mmc.exe). Click File->Add/Remove Snapin
  2. Choose Certificates in the available Snapins. Click Add.
  3. Choose Computer account on the dialog and click Next.
  4. Choose Local Computer and click Finish. Click OK in the Add/Remove Snapins dialog.
  5. Click Certificates\Trusted Root Certification Authorities\Certificates node.
  6. Double click the certificate to check its validity.
  7. If the certificate is invalid/corrupt, you need to import new certificate. You can import a new certificate using the Action->All Tasks->Import file menu.
  8. If you import a new certificate, you need to restart the Application Virtualization Server service for the import to take effect.

To verify the secure protocol and port configuration for the Application Virtualization Server.

  1. Open Application Virtualization Management Console. (Click Start, click Settings, click Control Panel, double-click Administrative Tools, and then double-click Application Virtualization).
  2. Connect to Application Virtualization Management Web Service.
  3. On the left tree in the console, expand Server Groups node and click the server group name that contains the Application Virtualization Server of interest.
  4. On the middle pane, right-click the server and click Properties.
  5. In the Properties dialog box, click Ports tab.
  6. Verify that only RTSPS and/or HTTPS are listed in the Protocols group box. 
  7. Verify that the intended secure port is selected.
  8. Verify the information in the Security Certificate Settings group box.

Diagnoser

Check the Validity of the Security Certificate

  1. Run Microsoft Management Console on the Application Virtualization Server computer (Click Start, click Run, type in mmc, then click OK)
  2. Open the Add/Remove Snap-in dialog box to add the Certificates snap-in (Click File then click Add/Remove Snap-in)
  3. Add the Certificates snap-in (Click Add, select Certificates, click Add, select Computer account, click Next, click Finish, and then click Close)
  4. Click OK to close the Add/Remove Snap-in dialog box.
  5. On the left pane, expand Certificates node and select Personal node.
  6. On the right pane, locate the security certificate of interest and double-click it. The Certificate dialog box opens.
  7. In the General tab, verify that the certificate is still valid and not expired or revoked.
  8. In the Certification Path tab, verify that the Certification status field says "This certificate is OK."

Check the Security Certificate Settings

The following certificate attributes are required:

  1. Server receiving the certificate MUST trust the Root CA which issued the certificate
  2. Certificate must be valid
  3. Certificate must contain the correct Enhanced Key Usage (EKU)  - Server Authentication (OID 1.3.6.1.5.5.7.3.1)
  4. Certificate FQDN must match the server on which it's installed.

The clients needs to trust the Root CA that issues the certificate for the Application Virtualization Server.

An error can occur if the server certificate is corrupted, is not present, or became invalid. To fix the issue,  import a new certificate from the certificate store.

  1. Launch the Microsoft Management Console (mmc.exe). Click File->Add/Remove Snapin
  2. Choose Certificates in the available Snapins. Click Add.
  3. Choose Computer account on the dialog and click Next.
  4. Choose Local Computer and click Finish. Click OK in the Add/Remove Snapins dialog.
  5. Click Certificates\Trusted Root Certification Authorities\Certificates node.
  6. Double click the certificate to check its validaity.
  7. If the certificate is  invalid/corrupt, you need to import new certificate. You can import a new certificate using the Action->All Tasks->Import file menu.
  8. If you import a new certificate, you need to restart the Application Virtualization Server service for the import to take effect.

Element properties:

TargetMicrosoft.AppVirtualization.Server.45.VirtualApplicationServer
Parent MonitorMicrosoft.AppVirtualization.Server.45.Security_HWS.HealthState
CategoryEventCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.2SingleEventLogManualReset3StateMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Security - Diagnoser - Application
{0}
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.AppVirtualization.Server.45.VirtualApplicationServer.Security_Diagnoser_Application" Accessibility="Public" Target="Microsoft.AppVirtualization.Server.45.VirtualApplicationServer" TypeID="Windows!Microsoft.Windows.2SingleEventLogManualReset3StateMonitorType" ParentMonitorID="Microsoft.AppVirtualization.Server.45.Security_HWS.HealthState">

  <Category>EventCollection</Category>

  <AlertSettings AlertMessage="Microsoft.AppVirtualization.Server.45.VirtualApplicationServer.Security_Diagnoser_Application.Alert">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Yellow" HealthState="Warning" MonitorTypeStateID="FirstEventRaised"/>

    <OperationalState ID="Red" HealthState="Error" MonitorTypeStateID="SecondEventRaised"/>

    <OperationalState ID="Green" HealthState="Success" MonitorTypeStateID="ManualResetEventRaised"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</FirstComputerName>

    <FirstLogName>Application</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Application Virtualization Server</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">41511</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</SecondComputerName>

    <SecondLogName>Application</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Application Virtualization Server</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">41510</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">41586</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>