Will IPSEC rules whit the authentication method which depends on Kerberos
Authentication
be sufficient in this scenario ?
Will this method not necessitate that a Kerberos machine ticket is
negotiated before
SMB share authentication works ?
Non-domain workstations will fail to establish IPSEC and therefore,
regardless if user knows
about correct AD credentials, they wont be able to map the shares.
You would have to be extra careful about creating right kind of IPSEC rules
if your file
servers are also Domain Controllers because you wouldn't want the
workstation to fail to
negotiate the Kerberos ticket based on too-strict IPSEC rules.
slawek
----- Original Message -----
From: "Raoul Armfield" <armfield@amnh.org>
To: "Kevin Green" <securityfocus@kevin.3drealms.com>
Cc: <focus-ms@securityfocus.com>
Sent: Friday, June 10, 2005 15:53
Subject: Re: Restricting file server to access to domain computers only.
Kevin Green wrote:
Hello focus-ms,
Does anyone know how to prohibit computers from connecting to a Windows
2003 Server share unless the
system they are connecting from is a member of the domain.
I a few "power users" and developers who keep removing there systems from
the domain, and just
connecting to the server by browsing and using there domain credentials
to login. There access is
allowed and needed for them to do there work. If I don't allow them to
connect unless there system is
a part of the domain, that will solve the problem.
Cant you restrict access to the Authenticated users group. IIRC this will
make it so that you have to be authenticated by the DC before you can
access the share.
Kevin
---------------------------------------------------------------------------
---------------------------------------------------------------------------
--
Raoul Armfield
Support Specialist
IT-Call Center
armfield at amnh dot org
American Museum of Natural History
Central Park West at 79th Street
New York, New York 10024-5192
(212) 313-7258
5152 1277 A04B 04C2 BBE4
3EE8 8369 3541 8B93 42DA
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
