?
Solved

Active directory authenticated Cisco VPN users

Posted on 2006-11-16
8
Medium Priority
?
613 Views
Last Modified: 2012-06-27
Hello there.
I have setup authentication to be Active directory on my Cisco 3030 VPN concentrator and created 2 groups (one for admins and the other for normal users), both authenticating against a windows 2003 domain controller.

I've allocated 2 different IP pools for the said groups and restricting user access based on IP address on my firewall, which sits right after the VPN concentrator.

My problem is, users who are part of the normal user group can get admin access by just copying the profile from an admin user and consequently get admin access onto the systems.

Is there anyway I can prevent this from happening using Active directory features ?

Hope I made myself clear.

Thanks in advance

Shiv
0
Comment
Question by:shivanthan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
8 Comments
 
LVL 10

Accepted Solution

by:
Phadke_hemant earned 800 total points
ID: 17954209
how come they copy the admin user profile? this means they have rights on the drive and mostly they are member of loca admin on the machines
remove the normal users from the local admin group from all the machines and recreate their profiles so that they cannot copy the admin profile and will not get the rights
0
 

Author Comment

by:shivanthan
ID: 17955656
Hi..thanks for the comment.
I already had a look at this option but need one which uses features of active directory and identify the users differently, and not letting them use the profile which is not meant for them.

Thanks
Shiv
0
 
LVL 5

Expert Comment

by:snowsurfer
ID: 17956500
Are you using RADIUS?
0
 
LVL 10

Expert Comment

by:Phadke_hemant
ID: 17963121
users can use other profile only if they have rights on that machine so you need to remove users from Local Administrators group on those machines and addd them to power users only. only this is not sufficient as they have already copied the admin profile so you need to delete the old profiles also
0
 

Author Comment

by:shivanthan
ID: 17963192
Yes, I am using Microsoft IAS server for the authentication.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question