Solved

Group Policy for dot1x

Posted on 2014-03-17
1
635 Views
Last Modified: 2014-03-18
Hello,

Would love some help on some Windows server work for a Cisco guy :)

We are developing a Dot1x solution and will need to push config from Win2008 to about 40-50 domain computers.  We are enabling computer authentication with certificates.  We have developed the GPO piece just fine but are looking for any best practices for deployment.  Here are some particular areas of concern we are facing:

 - Only a certain group of computers need dot1x (all Win7) - is putting this group in the security filter best practice?
 - We only utilize one domain policy currently. Should we develop a separate policy to push out just these few dot1x config items?
 - When does the GPO controller "push" its config out to workstations?
 - For the certificates, can you tell what templates are currently available for a certain group for auto-enroll?
- Lastly, best way to view computers that were successfully updated?


I apologize for the amount of questions stuffed into here but as I mentioned before, I'm a network guy looking for some Windows help.  Thanks.
0
Comment
Question by:L8C
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 22

Accepted Solution

by:
Jakob Digranes earned 500 total points
ID: 39936107
* It might be good to filter these by security, OR - even better, create an new OU for Wireless Computers. But both work
* This is no definite answer to, depends on your likings. I'd create a separate policy, either COMPUTERS or WIRELESS and put settings in one of those
* GPO pushed during boot, and if you use GPUPDATE /FORCE in WIndows later on
* You can AUTO-ENROLL more or less all templates as long as you set permissions correct. I'd recommend copying COMPUTER TEMPLATE, call it something like MachineCert and let the wireless group be able ot autoenroll in security. Remember cert need correct intended purpose (client authentication) and Computer Template does
* No easy way in Windows to see this, but there's probably some 3rd party software - but as long as computers reboot they'll get the policy
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
This Micro Tutorial will give you basic overview of the control panel section on Windows 7. It will depth in Network and Internet, Hardware and Sound, etc. This will be demonstrated using Windows 7 operating system.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Suggested Courses

631 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question