|
Posted by Roger Abell on July 12, 2005, 8:44 am
Please log in for more thread options Shared folder access is checked within the user account context.
So, to control access based on machines rather than users you
need to use something that does its checks based on machines,
applied at a level in addition to the user access checks, and
that something right now appears to be IPsec.
You could consider moving the folders to a non-DC in order
to support your objective.
--
Roger Abell
Microsoft MVP (Windows Security)
> Thanks Steven,
>
> Unfortuneatly the shared folders reside on a Win 2003 Server that also
acts
> as the backup domain controller, so from what you mentioned below I won't
be
> able to use ipsec on my server. Isn't there any other method of preventing
> non-domain computers accessing shared folders?
>
> Regards,
> ----------------------
>
> "Steven L Umbach" wrote:
>
> > One solution would be to use ipsec with an ipsec server require policy
on
> > the server which by default will then allow only domain computers with a
> > compatible ipsec policy to access the server. By default ipsec in a
forest
> > will use kerberos for "computer" authentication before a security
> > association will allow communications. Note this will not work if the
server
> > is a domain controller as you must configure ipsec policies to exempt
domain
> > controllers from ipsec ESP/AH with other domain computers for at least
> > authentication and AD traffic. Ipsec policies must be carefully planned
and
> > tested first so as to not lockout domain computers from legitmate
traffic.
> > See the links below if interested. --- Steve
> >
> >
http://www.microsoft.com/technet/security/topics/architectureanddesign/ipsec/default.mspx
> > --- using ipsec for domain isolation
> > http://support.microsoft.com/default.aspx?scid=kb;en-us;Q254949
> >
> >
> > > Hi,
> > >
> > > Is there a way of preventing shared folder access from a non-domain
member
> > > computer?
> > >
> > > Currently if a user brings his personal laptop to the office and gives
the
> > > pathname to his shared folder in Windows explorer he is asked for the
> > > username and password. Since the same user has an account on the
domain he
> > > can then access the shared folder on his personal laptop. Is there a
way
> > > of
> > > preventing this?
> >
> >
> >
| 
XML Sitemap