Re: Domain authentication

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 10/01/05

  • Next message: Steven L Umbach: "Re: Question about download blockers and Parental Controls..." 
    Date: Sat, 1 Oct 2005 10:19:41 -0500

    There is no easy solution since internet access "usually" only needs the
    right default gateway IP address and does not require any sort of computer
    or user authentication. There are ways to control access to switches on
    those switches that support 802.1X though this requires an infrastructure
    that distributes computer certificates to 802.1X capable domain computers to
    use for authentication via an IAS/radius server before port access is
    allowed. Microsoft Server 2000/2003 can be a Certificate Authority and IAS
    server. Another solution could be to use Microsoft ISA 2004 to manage your
    internet gateway. Then an ipsec require policy could possibly be configured
    on the ISA 2004 server that would prevent non domain computers from
    accessing it if user based rules were enabled on it or it otherwise required
    communications with the client computer so that it was not just a default
    gateway for the computer. The ISA 2004 newsgroup would be a good place to
    ask a question about such a possibility and you can download and try ISA
    2004 for free with the Evaluation Edition to see if it suits your needs. A
    non technical solution would be a strict computer use policy that employees
    review and sign that prohibits unauthorized computers on the network. Such
    policies need to state possible consequences and be enforced to be
    effective. An unauthorized computer can be a huge risk as in it could
    contain a backdoor or a worm on it. --- Steve

    http://www.microsoft.com/isaserver/evaluation/overview/default.mspx ---
    ISA 2004
    http://www.hp.com/rnd/pdf_html/guest_vlan_paper.htm --- example of 802.1X
    using an HP Procurve switch

    "HiFi_Guy" <HiFi_Guy@discussions.microsoft.com> wrote in message
    news:7C3557A1-1BC5-44A0-9E92-DADCEA4DB1D1@microsoft.com...
    > HI friends. i m running windows 2003 server having more then 300 clients.
    > i want users to join domain if they want to use internet, if they just log
    > locally
    > on their computers they should not be able to use internet..so any idea
    > about this
    > plz reply as soon as possible
    >
    > have a nice day.
    >

  • Next message: Steven L Umbach: "Re: Question about download blockers and Parental Controls..."

    Relevant Pages

    • Re: The Web site cannot be found - errors
      ... problems connecting with the internet. ... Internet Connection Wizard from the server. ... > files and ISA cache on all ...
      (microsoft.public.windows.server.sbs)
    • RE: Internet Usage Reports
      ... There is no other application on the SBS server box that can monitor ... internet activities as your needs rather than ISA server. ... Microsoft Internet Security and Acceleration Server 2004 is the ... Microsoft is providing this information as a convenience to you. ...
      (microsoft.public.windows.server.sbs)
    • RE: ISA 2004 Rules
      ... internet website from the ISA server itself. ... All Users or SBS Internet Users ... Then can you access this problematic page from the workstation side this ...
      (microsoft.public.windows.server.sbs)
    • Re: Connect the SBS to a remote IIS for Internet Printing
      ... the server can access the Internet with no problems at all. ... Checking network connection, and after a few seconds it says The ... the problem is cause by the configuration of ISA. ...
      (microsoft.public.windows.server.sbs)
    • Re: weird gateway to gateway vpn issue
      ... || each site is configured to connect to the local site ISA server. ... web sites from site B I have to disconnect the gateway to gateway ... site B can get out to the internet but users on site A then ...
      (microsoft.public.isa.vpn)