Re: Windows 2003 server Network Security

If you are using managed switches they may have the capability to manage
port access by mac address either from a table of mac addresses that can be
manually configured and from putting the switch in learning mode when you
are sure only authorized devices are connected to the network and many
switches can do 802.1X which requires the computer be authenticated before
the switch port allows access though it also requires compatible operating
systems and a Certificate Authority. Currently there is not way to use Group
Policy to configure "wired" 802.1X like there is for wireless 802.1X.

Another possibility is to implement ipsec in your domain that can be managed
via Group Policy. Computers that have an ipsec require policy will not
communicate with computers that do not have a compatible authentication
method and in a domain by default Kerberos would be used for computer
authentication that would rule out non domain computers. Ipsec is a somewhat
complex topic and special considerations must be made for domain controllers
since they are the KDC but the link below on ipsec domain isolation is a
great start. Possibly something like ISA 2004 as your firewall and using
ipsec could be used to prevent users on non domain computers from accessing
the internet since the computer would need to access the ISA 2004 server to
authenticate the domain user. Otherwise it is very difficult to stop users
from accessing the internet if all they need is access to the default
gateway that can found out rather easily and a user could use static IP
configuration to bypasss restrictions placed on a DHCP scope. --- Steve

http://www.microsoft.com/technet/security/topics/architectureanddesign/ipsec/ipsecch1.mspx
http://support.microsoft.com/?kbid=254949 --- important info on domain
ipsec.

"Larry Bird" <LarryBird@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:AA0A4EB4-869F-4E84-8D61-2EBB09D1A19A@xxxxxxxxxxxxxxxx
>I want to lock down my network from PCs for Laptops outside the company.
> Basically I do not want anyone to be able to plug in his or her laptop
> computer via an RJ45 connection and have any access to resources without
> signing in with a valid userid and password. I don't want them to have a
> DHCP IP address to surf the Internet unless authorized via their userid
> and
> password.
>
> Where do I start to implement these restrictions?
>
> Thanks
>
>


.

Relevant Pages

  • Re: Certificates
    ... unless it has an ipsec certificate. ... 802.1x authentication which will not allow a computer access to the switch ... 802.1x switches are used and user certificates are not required.. ...
    (microsoft.public.win2000.networking)
  • Re: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows"
    ... After I pointed out that "IPsec based auth" is not a basic netlogon ... authentication protocol like Kerberos, LM, NTLM and NTLMv2, you said I was ... based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
    (Pen-Test)
  • RE: Passwords with Lan Manager (LM) under Windows
    ... A device's security associations are contained in its Security Association Database ... Internet Protocol Security (IPSec) provides application-transparent encryption services for IP network traffic as well as other network access protections for the Windows 2000 operating system. ... As for "article you reference does indeed use the phrase "IPSec Authentication," but as any who reads it ...
    (Pen-Test)
  • Re: Kerberos machine authentication - apparent authentication fail
    ... as the case may be) which will delay authentication until ... I also have an Intel network adapter and WAP that does not have this> problem and even works well with 802.1X EAP-TLS for domain logon. ... In> most cases [ipsec a possible exception] kerberos authentication is not> needed to access domain resources as long as the client and server use a> common authentication method for lm/ntlm/ntlmv2. ... The main issue is to> NEVER include an ISP dns server in the preferred server list in the tcp/ip> properties or DHCP scope of any domain computer or any computer you want to> join to the domain in which case your computers may be trying to locate the> domain _srv records on the ISP dns server and fail. ...
    (microsoft.public.windows.server.security)
  • Re: IPsec - restrict communcation
    ... IPsec can use three different methods to initially authenticate machines: ... permit, block, or negotiate security, as well as authentication methods ... you don't need the communications to be private. ...
    (microsoft.public.security)