Solved

Network Access Protection - Windows Server 2008

Posted on 2013-01-08
2
356 Views
Last Modified: 2013-01-09
I am looking to better understand at what stage the NAP client initializes during the windows OS startup process.  At some point during the winlogon initialization, the NAP client reports system status to the NAP enforcement server. If the NAP client logging in meets the
NPS requirements, it will be allowed to log into the network.  Does this occur prior to establishing a secure channel to the domain controller? Since NAP is a window service, I would imagine that the service control manager starts prior to the NAP client.  Any insight you could provide would be much appreciated.
0
Comment
Question by:novanation
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 18

Accepted Solution

by:
Sushil Sonawane earned 250 total points
ID: 38755920
0
 
LVL 1

Assisted Solution

by:NisheshPrasad
NisheshPrasad earned 250 total points
ID: 38757682
Hi

We know that NAP is enforced against certain services that the Domain Provides. For example - DHCP or Wireless.

Lets take DHCP as an example.

If NAP is enforced on a DHCP Scope, what it essentially implies is that before your clients can get an IP Address from the Windows DHCP Server, the DHCP Server would point your clients to the NAP Enforcement Server to "pass or meet" the NAP Policies.

Now - how do you "Enforce" the Clients to go through a NAP Server. In other words - how do you ensure that the NAP Agent will do what it is supposed to do and when it is supposed to do it ? You configure Group Policies to enable the NAP Agent on each client and ALSO you configure the "type" of NAP Enforcement you want to put in place - in this case DHCP Quarantine Enforcement.

To achieve the above scenario - your clients "WILL" have to connect to a Domain Controller and Process its GPOs first - and to do this there "WILL" be a secured a channel created first between the client and the domain controller BEFORE the client even reaches a NAP Server for Policy Enforcements.

Hope this helps.
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There's a lot of hype surrounding blockchain technology. Here's how it works and some of the novel ways it' s now being used - including for data protection.
I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question