GPO - Only allow computers/users access who are on Domain

I am trying to setup a policy to restrict:-

Computers - only allow those that have joined the domain access to network/internet

Users - restrict access to network/internet to those only on Domain.

Not sure if this is possible on GPO - or 3rd party software is required.
Darrin CrawfordAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Alex Green3rd Line Server SupportCommented:
That would be done on a network level, wouldn't it?
0
Alex Green3rd Line Server SupportCommented:
Ah Radius, it's a radius server I believe you need.
0
Abhi PappiTechnical Lead - Network SupportCommented:
Hi,

GPOs are using to manage the AD joined computers and AD users. You will not be able to manage work group computers/users using GPOs. You may need to use proxy application or network devices for authorization to restrict network and internet access.

Thanks,
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

KimputerCommented:
Most simple way to "fool" non-tech users, use your DHCP server to give out "normal" IP nr (with wrong DNS/gateway) to unknown MAC, have known PC's (domain joined) reserved by MAC with the correct DNS/gateway
Obviously, tech savvy ppl will compare IP info with "working" PC's to solve it.
But obviously, doesn't cost you a thing.
0
Alex Green3rd Line Server SupportCommented:
Right,

It can't be done with Active directory or group policy, what you're looking for is called NAC, Network access control. That talks to the radius server, matches up the machine GUID with the SSID of the computer account in AD and then it'll error lock the port if it doesn't match anything.

The other way is with MAC address databases, this has a massive admin overhead

https://www.cisco.com/c/en/us/products/security/nac-appliance-clean-access/index.html

There you go
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Alex Green3rd Line Server SupportCommented:
Another great link here

https://www.thesecurityblogger.com/why-migrate-from-cisco-nac-appliance-to-ise/

ISE is another way of doing it, I believe it superseded NAC
0
Mark BillExchange, AD, SQL, VMware, HPE, 3PAR, FUD, Anti MS Tekhnet, Pro EE, #1Commented:
Use network level/radius/3rd party programs to achieve this.
This can be done by AD group membership this way.
0
Alex Green3rd Line Server SupportCommented:
Well, you'll need an active directory reference point but it's still done on a network level.
0
Shaun VermaakTechnical Specialist/DeveloperCommented:
Computers - only allow those that have joined the domain access to network/internet
You can block access to domain-joined resources with a GPO that sets an inbound Windows Firewall rule that only allows domain users and computers
fw.png
Users - restrict access to network/internet to those only on Domain.
Can you configure LDAP authentication on your Internet gateway?
0
Alex Green3rd Line Server SupportCommented:
That won't stop people accessing the network and running things against it.
0
Shaun VermaakTechnical Specialist/DeveloperCommented:
Hence why I said
domain-joined resources
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.