Deploy NAP For DHCP to limit illegal clients

We found that there are often computer access company networks that do not meet the company's security policy. Obtaining TCP/IP configuration from the company's DHCP server to access the corporate network poses a huge risk. In fact, we can use Windows Server 2008 Network Access Protection (NAP) technology to control these clients to obtain configuration from the DHCP server, in order to control their access to the company's intranet. Below the author deployment environment for a demonstration of the deployment and testing of "NAP for DHCP", I hope to help everyone.

Environment Description:

Ctocio: Windows Server 2008 DHCP Server, NAP Server

Test: Windows Vista Client

1. NAP Server Configuration

(1). Configure Health Policy Server

Log in to Ctocio as administrator administrator, click Start → Manage Tools to open the Network Policy Server window. Expand NPS (Local)→Network Access Protection→System Health Validator, double-click Windows Security Health Validator in the content panel, and click Configure in the Windows Security Health Validator Properties dialog box. Just check "Enable firewall for all network connections" under "Firewall", cancel all other options (note that you don't need to cancel the selection of "Windows Update"), click "OK" to close the "Windows Security Health Validator Properties" dialog frame. (Figure 1)

Figure 1 Windows Security Health Verification Program

 It should be noted that the “Windows Security Health Verifier” is a SHV provided by Microsoft. It is mainly used to monitor the status of the client computer security center. Of course, if you want to monitor the security configuration of third-party manufacturers' products, you need to install SHV developed by other manufacturers.

(2). Configure update server group

In the right pane of the Network Policy Server window, under Network Access Protection, right-click Update Server Group and click New. In the pop-up dialog box, enter "Windows Settings Update Server Group 1" in the "Group Name", then click "Add", enter 192.168.1.1 under "IP Address or DNS Name", and then click "OK" twice. Explain that the servers included in this group should actually be placed on servers in the restricted network for patching clients, such as WSUS servers, virus database upgrade servers, and so on. (Figure 2)

Figure 2 New WSUS Server
Previous 12 3 4 5 Next Read More