Re: Preventing users from c onnecting to shares NOT on the domain..

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Javier J (no.mail_at_please.no)
Date: 01/19/05 

Date: Wed, 19 Jan 2005 21:45:56 +0100

Hi!!!

I'll give you a little more detail about what I am looking trying to do:

- The domain is a Windows 2000 Domain, with W2000 Pro Client computers
and some WXP Pro. There is no "signing" of digital traffic going on.

There is a number (abotut 50) client PCs that have to be specially
hardened. Those are all located on the same OU, so if any changes can be
done at the OU leve, that'd be a bonus. From the (admitedly slight) idea
I have about it, Kerberos settings are domain-wide, but domain-wide
changes are out of the question at the moment.

I can make almost any change to the Computers in the OU, but the Domain
is out of my reach (at least, at the moment)

I've done some testing using the GPOs that MS provides with the "Group
Policy Common Scenarios" docs and acompanying supporting information.
I'm using a "mix-and-match" version of the AppStation Scenario for the
computers on the OU.

The computers in the OU _should_ be able to access any of the servers on
the Domain (ie., it's not possible to make a choice that limits them to
a single server), but that might be possible to change.

 From looking into the GPO settings on the sample OUs, I've seen
settings about "digital sign" and "encrypt" communications, so I was
wondering if there is some combination of settings that requires that
all SMB traffic be two-way signed. From my understanding of the matter,
that'd mean both computers are members of the same domain...

Thanks a lot for the promtp response...

Miha Pihler [MVP] wrote:
> Hi Javier,
>
> If you want to prevent your computers from talking to computers that are not
> part of your domain, create an IPSec policy that would require
> authentication where you would use Kerberos as authenticating protocol.
> Computers that are not members of domain will not be able to authenticate
> and your clients will not want to talk to them.
>
> Your clients would need to be Windows 2000 or newer Microsoft operating
> system.
>
> Step-by-Step Guide to Internet Protocol Security (IPSec)
> http://www.microsoft.com/windows2000/techinfo/planning/security/ipsecsteps.asp
>
> Assigning IPSec policy
> http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_ipsecpolassign.mspx
>

Relevant Pages

  • Re: outlook refreshing
    ... and the clients would pick up the new settings. ... Yes I did change the DNS ... On the new computers and the rebuilt computers this is not ... > If is it just affecting Outlook, and its set as a MAPI client, that would ...
    (microsoft.public.exchange2000.connectivity)
  • Re: outlook refreshing
    ... and the clients would pick up the new settings. ... Yes I did change the DNS ... On the new computers and the rebuilt computers this is not ... > If is it just affecting Outlook, and its set as a MAPI client, that would ...
    (microsoft.public.win2000.dns)
  • RE: id- 1030 source - Userenv
    ... Thanks for using the SBS newsgroup! ... I understand that the issue to be: all client ... computers got 1030 error and can not connect to the SBS 2003 server box. ... Click Internet Protocol, ...
    (microsoft.public.windows.server.sbs)
  • Re: Preventing users from c onnecting to shares NOT on the domain..
    ... - The domain is a Windows 2000 Domain, with W2000 Pro Client computers ... There is a number client PCs that have to be specially ... I have about it, Kerberos settings are domain-wide, but domain-wide ... I can make almost any change to the Computers in the OU, ...
    (microsoft.public.win2000.security)
  • RE: Remote Web Workplace - Connect to client workstations
    ... In Connect to Client desktops item lists all client computers on your SBS ... network that are running Windows XP or above; In Connect to Server desktops ... On the Tools menu, click Internet Options. ...
    (microsoft.public.windows.server.sbs)