|
Posted by Steven L Umbach on August 28, 2006, 1:52 am
Please log in for more thread options That is a good point that you could access a share on your laptop from your
domain computer to transfer data. In that case an ipsec policy could be
implemented that could require ipsec [even null ESP] to all outbound traffic
from the domain workstations with exceptions for the IP addresses of the
domain controller and internet traffic outside the subnet and make sure that
regular domain users can not add workstations to the domain unlike default
configuration. Again that is not a 100 percent solution if someone was able
to put their computer on the network with the IP address of a domain
controller though usually tcp/ip will detect an existing IP address and deny
access via the duplicate IP address I believe. The user should consider
another server for file serving so that he could implement and ipsec require
policy on it. I hope Vista allows domain controllers to use ipsec for
traffic used for authentication to it [which includes SMB] between domain
controllers and domain workstations or at least improve on current situation
so that SMB can be protected. I read that is a good possibility.
Steve
>> That of course is normally a great solution but in this case it sounds
>> like the file server is the domain controller which means ipsec could not
>> be implemented as an ipsec require policy on a DC will cause problems
>> with the
>
> Good catch Steve, I overlooked the "single server" part of the post.
> (but IPsec can, just not simply, be used on a DC).
>
>> domain member computers. Since it is may be a small network some else
>> mentioned that this worked for them. They configured the users account
>> properties in ADUC so that they were restricted to what computer they
>> could logon to and then they could not access domain resources from a non
>> domain computer assuming that the non domain computer did not have a name
>> in the list. That never occurred to me that it would work for network
>> logon and I
>
> But, I log into my domain workstation and map a drive that is shared by
> my plugged in laptop at 10.0.1.53, i.e. .0.1.63\stash$
>
>> tried it out and sure enough it worked giving some obscure message when I
>> tired to access a domain share. While it is not a foolproof security
>> solution it may help in smaller networks. Alas as you said none of this
>> will most likely stop a determined user from copying files anyhow from
>> their domain computer.
>>
>> Steve
>>
>>
>>> Search on ms.com for the guidance papers on using
>>> IPsec for "doman isolation"
>>>
>>> You could apply techniques from them to all only domain
>>> members to have network traffic with the fileshare server.
>>>
>>> However, your users could/would just save copies to their
>>> workstations and copy to their non-domain laptops/devices
>>> from there (or email the docs out).
>>>
>>> Your attempt to accomplish this by setting permissions to
>>> administrators and domain computers did not work because
>>> the access is not being done by the domain computers but by
>>> the account logged into the domain comp, so the check is
>>> against that user account, not the computer account.
>>>
>>>> Single Windows Server 2003. All workstations are Windows XP SP2.
>>>>
>>>> I'm trying to restrict access to the shared files on the Server to
>>>> computers
>>>> that are members of the Domain and so far it isn't working out too
>>>> well.
>>>>
>>>> Basically, we are allowing people to bring in laptop computers and
>>>> connect
>>>> to our network for Internet access and for access to certain printers
>>>> but do
>>>> not want to allow access to any shared files on the Server. We don't
>>>> want
>>>> any files copied to a laptop and leaving the premises. These computers
>>>> are
>>>> Workgroup computers; not Domain computers. I tried setting the
>>>> Permissions
>>>> for the shared files to only allow access by Administrators and Domain
>>>> Computers, but this cut off access by all computers even though the
>>>> computers I tested with were clearly members of the Domain Computers
>>>> group.
>>>>
>>>> Any idea what I'm missing here? Do the Permissions/Security settings
>>>> need
>>>> to be some combination of Domain Computers and Authenticated Users in
>>>> order
>>>> to accomplish this?
>>>>
>>>> Please help.
>>>>
>>>> Thanks.
>>>>
>>>> James
>>>
>>>
>>
>>
>
>
| 
XML Sitemap