Re: Restrict Access to Domain Servers from Workgroup Computers
- From: "Roger Abell [MVP]" <mvpNoSpam@xxxxxxx>
- Date: Sun, 25 Feb 2007 09:27:49 -0700
"Trevor Hillary" <trevh@xxxxxxxxxxxxxxxx> wrote in message
news:%23no72XPVHHA.5068@xxxxxxxxxxxxxxxxxxxxxxx
Is it possible to restrict the access to resources on domain servers fromNo, that is not a directly supportable scenario.
workstation computers even if the the user has a valid User ID and
password? It looks as though the use of IPSec is a possibility but the
customer would like to selecively allow non domain workstations access to
resources possibly using certificates. Note that this is based on the
client workstation not related to who is logged in.
When you mention use of IPsec you identify the one current way
to do what you are after. Since you say anyone on the the allowed
machines you would need to
1. have the shares on a server where it is OK for all access to be
disallowed to machines not allowed to access the shares (i.e.
IPsec will control all access to the sharing machine, not just
access to the shares)
2a. have Guest access enabled on the sharing machine (so that all
accounts on the allowed machines have transparent access)
or
2b. have NTFS permissions on the shares that allow all domain
accounts (and then everyone will have to provide credentials
when connecting from an allowed machine)
3. have ability to identify the allowed machines for IPsec (just
doing this based on IPs is not very strong and unworkable if
client machines use DHCP).
Alternatives are certs or preshared key.
It is item 1 that usually makes this unworkable as a solution, since
it basically dedicates the server to this purpose.
.
- References:
- Restrict Access to Domain Servers from Workgroup Computers
- From: Trevor Hillary
- Restrict Access to Domain Servers from Workgroup Computers
- Prev by Date: Re: Permissions don't seem to work in W2K Server
- Next by Date: Re: GPOs for software distribution
- Previous by thread: Restrict Access to Domain Servers from Workgroup Computers
- Next by thread: Permissions don't seem to work in W2K Server
- Index(es):
Relevant Pages
|
