Re: Restricting file server to access to domain computers only.

Kevin

Even easier than using certificates as suggested by
one respondent, implement a domain-wide IPSec policy
for all communications, using Kerberos as opposed to
PSK or certificates, for the authentication method.
Whether you choose to also encrypt or just
authenticate communications is up to you. 

FWIW, Microsoft implements IPSec domain-wide on their
corporate network for several reasons, not limited to
domain isolation and slowing/stopping worms. Some
articles about this include:

http://www.microsoft.com/technet/community/columns/secmgmt/sm121504.mspx

http://www.microsoft.com/technet/community/columns/secmgmt/sm0105.mspx

http://www.microsoft.com/technet/security/topics/architectureanddesign/ipsec/default.mspx


Regards

John


> Hello focus-ms,
>
> Does anyone know how to prohibit computers from
connecting to a 
Windows 2003 Server share unless the
> system they are connecting from is a member of the
domain.
> I a few "power users" and developers who keep
removing there systems 
from the domain, and just
> connecting to the server by browsing and using there
domain 
credentials to login.  There access is
> allowed and needed for them to do there work.  If I
don't allow them 
to connect unless there system is
> a part of the domain, that will solve the problem.
>
> Kevin

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

---------------------------------------------------------------------------
---------------------------------------------------------------------------