SBS2008 Grant VPN access to one server only.

Hi all, we're currently using SBS2008 to control VPN access to all our server.
We have some external consultants that I want to grant access to one server only.
I don't want to allow any access to our email ( so don't want to create an email address for the user ID) and I don't want them to see any of the shares, files, other computers etc..
Just one particular server, which happens to be an AS400.

One way is to create a very restricted User ID somehow and grant VPN access.
Is there a way to ONLY allow this user ID access to just the AS400 in question in VPN under SBS2008?

The other way I suppose is to set up a Hardware VPN between them and us and only allow them access to the specific server via the VPN router.

Has anyone had to do something like this before?
afurnessAsked:
Who is Participating?
 
Rob WilliamsConnect With a Mentor Commented:
They should still be able to authenticate to the domain using the VPN and then logon only to the one server of your choice. Regardless of what server or PC to to which they are logging on, the VPN authentication is a separate process than logging onto the RRAS server, and should be allowed so long as they are a member of the "Virtual Private Network Users" group.

However, the above restriction will not stop them from accessing files through a share or similar method, if for example there is a mapped drive on their server. For that you need to make sure their account is not a member of any group that has NTFS/security permissions to access a shared resource.
For this reason, I never create a share that allows "domain users" or "Everyone access" NTFS/Security permission access. (should be everyone share access).  Instead create a group such a "file users" and grant them access, and do not add users such as your VPN users to that group. Alternatively you can always use the deny permission for your VPN users. Just be careful with deny you don't include yourself.
0
 
Rob WilliamsCommented:
In active directory under the user's properties, on the Account tab, you can click the "Logon to" button. By default it is set to all computers. You can specify the computer/server to which you want to grant them access.
0
 
afurnessAuthor Commented:
Our VPn server is also our Dc etc and a file server, can I ensure this user cannot see any of the files on this server as well?
By removing access to logon onto this server, will that  stop them being able to log into the VPN?
0
 
afurnessAuthor Commented:
OK thanx that all makes sense.. :)
0
All Courses

From novice to tech pro — start learning today.