Solved

Active directory authenticated Cisco VPN users

Posted on 2006-11-16
8
562 Views
Last Modified: 2012-06-27
Hello there.
I have setup authentication to be Active directory on my Cisco 3030 VPN concentrator and created 2 groups (one for admins and the other for normal users), both authenticating against a windows 2003 domain controller.

I've allocated 2 different IP pools for the said groups and restricting user access based on IP address on my firewall, which sits right after the VPN concentrator.

My problem is, users who are part of the normal user group can get admin access by just copying the profile from an admin user and consequently get admin access onto the systems.

Is there anyway I can prevent this from happening using Active directory features ?

Hope I made myself clear.

Thanks in advance

Shiv
0
Comment
Question by:shivanthan
  • 2
  • 2
8 Comments
 
LVL 10

Accepted Solution

by:
Phadke_hemant earned 200 total points
ID: 17954209
how come they copy the admin user profile? this means they have rights on the drive and mostly they are member of loca admin on the machines
remove the normal users from the local admin group from all the machines and recreate their profiles so that they cannot copy the admin profile and will not get the rights
0
 

Author Comment

by:shivanthan
ID: 17955656
Hi..thanks for the comment.
I already had a look at this option but need one which uses features of active directory and identify the users differently, and not letting them use the profile which is not meant for them.

Thanks
Shiv
0
 
LVL 5

Expert Comment

by:snowsurfer
ID: 17956500
Are you using RADIUS?
0
 
LVL 10

Expert Comment

by:Phadke_hemant
ID: 17963121
users can use other profile only if they have rights on that machine so you need to remove users from Local Administrators group on those machines and addd them to power users only. only this is not sufficient as they have already copied the admin profile so you need to delete the old profiles also
0
 

Author Comment

by:shivanthan
ID: 17963192
Yes, I am using Microsoft IAS server for the authentication.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now