Using Group Policy Filtering to Create a NAP DHCP Enforcement Policy

[LEFT][CODE]http://www.windowsecurity.com/articles/Using-Group-Policy-Filtering-Part1.html[/CODE]

[IMG]http://www.windowsecurity.com/img/upl/tomshinder1106731923065.jpg[/IMG]
[B][B]Thomas Shinder[/B][/B]


[SIZE=3][B]PART-1[/B][/SIZE]

How to implement Group Policy to control DHCP Network Access Policy enforcement. This improves the level of granularity you can apply to DHCP enforcement for NAP clients.
Network Access Protection is a new network access control feature included with Windows Server 2008. Network Access Protection or NAP allows you to control which computers can participate on your network. The ability to participate on your network is determined by whether or not a NAP client computer can meet the security requirements set forth in your NAP policies.
NAP has a number of “moving parts” that makes it inherently complex to configure. In addition to the number of moving parts, is the issue of what type of NAP enforcement you want to enable. For example, there are a number of NAP Enforcement Clients that control access to the network based on IP addressing information, or based on whether or not a client has a health certificate that allows it to connect to the network.
In this article series I will help you put together a simple DHCP NAP enforcement solution. When you use DHCP NAP enforcement, the DHCP server becomes your network access server. This means that it’s the responsibility of the DHCP server to provide the NAP client computers information appropriate to their level of compliance. If the NAP client computer is compliant, it receives IP addressing information that will allow it to connect to other computers on your network. If the NAP client computer is not complaint with your network health policies, then the NAP client will be assigned IP addressing information that limits what computers the client can connect to. Typically, your NAP policy will allow your non-compliant computers to connect to domain controllers and network infrastructure server, as well as machines that will enable the non-compliant computer to remediate and thus become compliant.
In the DHCP NAP Enforcement scenario, other servers are required. While the DHCP server is the network access server in this scenario, you need a RADIUS server that will contain your NAP policies. There are a number of policies that are stored on the NAP compatible RADIUS server, such as health policies, network policies, and connection request policies. In Windows Server 2008, the Network Policy Server (NPS) is used as the RADIUS server that will contain your NAP policies. The NPS server will work with your DHCP server and inform your DHCP server if the client is NAP compliant or non-compliant with your policies.
In order to set your heath policy, you will need at least one Security Health Validator (SHV) installed on the NPS server. By default, Windows Server 2008 provides you with the Windows Security Health Validator that you can use to set your network health policies.
On the client side, there are two components that you need to enable – the NAP Agent and the NAP Enforcement client. The NAP Agent collects the information about the security state of the NAP client computer and the NAP Enforcement Agent is used to enforce NAP policy, depending on the type of NAP enforcement you choose. In the scenario we’ll use in this series, we’ll be enabling the DHCP NAP enforcement agent.
The example network is a very simple one. It includes three machines:

[LIST][*]A Windows Server 2008 Domain Controller. No other services are installed on this machine. The IP address assigned to this computer is [B]10.0.0.2 [/B]and this machine is the domain controller in the [B]msfirewall.org[/B] domain.[*]A Windows Server 2008 member in the [B]msfirewall.org[/B] domain. The IP address of this computer is [B]10.0.0.3[/B]. This computer will have the DHCP and NPS services installed on it, which we will do during the course of this article series.[*]A Windows Vista client computer. This machine is a member of the [B]msfirewall.org[/B] domain.[*]In this article series we’ll perform the following procedures:[*]Create a Security Group that the NAP client computers will be placed in[*]Install NPS and DHCP services on the member server[*]Use the NAP wizard to create the NAP DHCP enforcement policy[*]Review the NAP Connection request policy[*]Review the NAP Network policies[*]Review the NAP Health policies[*]Configure the DHCP server to communicate with the NPS server for NAP enforcement[*]Configure the NAP settings in Group Policy[*]Enter the Vista computer into the NAP enforcement computers group[*]Test the solution[/LIST]
Again, there are a number of “moving parts” to the configuration of NAP, so read through these instructions a couple of times before implementing it in your own lab. Make sure that you understand why we’re doing each step, and never hesitate to contact me at [EMAIL="tshinder@isaserver.org"][U]tshinder@isaserver.org[/U][/EMAIL] if you have any questions about the configuration.
Let’s get started!
[B]Create a Security Group for NAP Client Computers[/B]

The first thing we’ll do is create a security group for the computers that will have NAP policy applied to them. Open the [B]Active Directory Users and Computers[/B] console and then right click on the [B]Users[/B] node. Point to [B]New[/B] and click [B]Group[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0021218104395025.jpg[/IMG]
Figure 1[/B]
In the [B]New Object – Group[/B] dialog box, enter [B]NAP Enforced Computers[/B] in the [B]Group Name[/B] text box. Select the [B]Global[/B] option from the [B]Group scope[/B] list and select the [B]Security[/B] option from the [B]Group type[/B] list. Click [B]OK[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0041218104395056.jpg[/IMG]
Figure 2[/B]
[B]Install NPS and DHCP on the NPS Server Machine[/B]

The NPS computer will host the Network Policy Server and the DHCP server roles. Note that you can put the DHCP server on a computer other than the NPS server that will host the NAP policies, but you will still need to configure that “remote” DHCP server as both a DHCP server and a NPS server, and then configure that NPS server for forward the authentication requests to your NAP server. To make things a little easier, we’ll just put the NPS and DHCP server on the same machine.
In the [B]Server Manager[/B] console, click on the [B]Roles[/B] node and then click on the [B]Add Roles[/B] link as seen in the figure below.
[B][IMG]http://www.windowsecurity.com/img/upl/image0061218104395056.jpg[/IMG]
Figure 3[/B]
Click [B]Next[/B] on the [B]Before You Begin[/B] page.
[B][IMG]http://www.windowsecurity.com/img/upl/image0081218104422838.jpg[/IMG]
Figure 4[/B]
On the [B]Select Server Roles[/B] page, put a checkmark in the [B]DHCP Server and Network Policy and Access Services[/B] checkboxes. Click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0101218104422838.jpg[/IMG]
Figure 5[/B]
Read the information on the [B]Network Policy and Access Services[/B] page and then click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0121218104422869.jpg[/IMG]
Figure 6[/B]
We don’t need all the role services provided by the [B]Network Policy and Access Services[/B] role. We only need the RADIUS (Network Policy Server) role. Put a checkmark in the [B]Network Policy Server[/B] checkbox. Don’t select any of the other options. Click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0141218104449369.jpg[/IMG]
Figure 7[/B]
Read the information on the [B]DHCP Server[/B] page and click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0161218104449369.jpg[/IMG]
Figure 8[/B]
The [B]Server Manager[/B] makes life a bit easier on us than in the past, as it offers us the opportunity to configure the DHCP server during the installation process. On the [B]Select Network Connection Bindings [/B]page, select the IP address that you want the DHCP server to listen on. The selection you make here depends on the complexity of your DHCP environment, as you might have one of more DHCP relays configured in your organization and thus have more than one IP address bound to the DHCP server. That’s not the case in this scenario, as we have a single IP address bound to this machine. Put a checkmark in the IP address checkbox and then click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0181218104449385.jpg[/IMG]
Figure 9[/B]
On the [B]Specify IPv4 DNS Server Settings[/B] page, you have the chance to configure some DHCP options. Enter the domain name of your domain in the [B]Parent Domain[/B] text box and enter the IP address of your DNS server in the [B]Preferred DNS Server IPv4 Address[/B] text box. In this example our domain name is [B]msfirewall.org[/B] so we’ll enter that domain name and the IP address of our DNS server is [B]10.0.0.2[/B], so we’ll enter that IP address. We don’t have an alternate DNS server in this example so we’ll click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0201218104475010.jpg[/IMG]
Figure 10[/B]
We don’t have a WINS server on this example network so we won’t enter anything on the [B]Specify IPv4 WINS Server Settings[/B] page. Just select the [B]WINS is not required for applications on this network[/B] option and click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0221218104475025.jpg[/IMG]
Figure 11[/B]
In the [B]Add or Edit DHCP Scopes[/B] page, click the [B]Add[/B] button. In the [B]Add Scope [/B]dialog box, enter the [B]Scope Name[/B], [B]Starting IP Address[/B], [B]Ending IP Address[/B], [B]Subnet Mask[/B], [B]Default Gateway[/B], and select a lease duration. The figure below shows our entries for these options on the example network. Click [B]OK[/B] in the [B]Add Scope[/B] dialog box.
[B][IMG]http://www.windowsecurity.com/img/upl/image0241218104475056.jpg[/IMG]
Figure 12[/B]
Click [B]Next[/B] on the [B]Add or Edit DHCP Scopes[/B] dialog box.
[B][IMG]http://www.windowsecurity.com/img/upl/image0261218104496244.jpg[/IMG]
Figure 13[/B]
We are not using IPv6 on this example network, so select the [B]Disable DHCPv6 stateless mode for this server[/B] option and click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0281218104496260.jpg[/IMG]
Figure 14[/B]
In order to operate in our domain, this DHCP server needs to be authorized in Active Directory. Select the [B]Use current credentials [/B]option if you’re logged in as a domain administrator. If not, then select the [B]Use alternate credentials[/B] option and click [B]Specify[/B]. In this example I’m logged on as a domain admin and so we’ll select the [B]Use current credentials [/B]option and then click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0301218104496260.jpg[/IMG]
Figure 15[/B]
Review your settings in the [B]Confirm Installation Selections[/B] page and click [B]Install[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0321218104517760.jpg[/IMG]
Figure 16[/B]
Click [B]Close[/B] on the [B]Installation Results[/B] page after you see that the installation of the NPS and DHCP servers has completed successfully.
[B][IMG]http://www.windowsecurity.com/img/upl/image0341218104517775.jpg[/IMG]
Figure 17[/B]
[B]Summary[/B]

In this, part 1 in our series of using NAP DHCP enforcement we went over some basic NAP concepts. Then we created a security group for our NAP client computers and then finished up with installing the DHCP and NPS server components of the solution. In the second part of the series, we’ll use the NAP wizard to create a NAP DHCP enforcement policy and then take a closer look at the settings created by the wizard. See you then! –Tom
[/LEFT]

[LEFT][CODE]http://www.windowsecurity.com/articles/Using-Group-Policy-Filtering-Part2.html[/CODE]

[SIZE=3][B]PART-2[/B][/SIZE]

In the first part of this series on how to configure a DHCP NAP enforcement policy we went through some of the basics of how NAP works, and then installed the DHCP and NPS services on the NAP policy server. In this, part two of the series, we’ll look at how to use the NAP policy wizard to automatically create the Network, Health and Connection policies that will be used to control access to the network.
[CENTER][URL="http://www.amazon.com/exec/obidos/ASIN/1597491993/isaserver1-20/"]
[/URL][/CENTER]
[B]Use the NAP Wizard to Create a NAP DHCP Enforcement Policy[/B]

Now we can begin the fun part – creating the NAP DHCP Enforcement Policy. After we run the wizard, the wizard will create the following policies:

[LIST][*]Health Policies[*]Connection Request Policies[*]Network Policies[*]Remediation Server Group policies[/LIST]
We’ll take a closer look at each of these policies after we finish the wizard.
Open the [B]Network Policy Server[/B] console from the [B]Administrative Tools[/B] menu. From there, you will see in the middle pane of the console the [B]Getting Started[/B] page. In the [B]Standard Configuration[/B] section, select the [B]Network Access Protection (NAP) [/B]option from the [B]Select a configuration scenario from the list and then click the link below to open the scenario wizard[/B].
Now click the [B]Configure NAP[/B] link.
[B][IMG]http://www.windowsecurity.com/img/upl/image0021218716035921.jpg[/IMG]
Figure 1[/B]
On the [B]Select Network Connection Method For Use with NAP[/B] page, in the [B]Network connection method[/B] section select the [B]Dynamic Host Configuration Protocol (DHCP)[/B] option from the drop down list. Remember, when we use NAP, we have to choose an enforcement method, and that’s what you’re doing here. The DHCP server becomes the “network access server” in this scenario and it’s the DHCP server that’s responsible for the level of network access the NAP client can have.
The [B]Policy name[/B] text box will automatically be populated with [B]NAP DHCP[/B] for the name that will be appended to a number of policies created by the wizard. We’ll see this later when we finish the NAP wizard.
Click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0041218716035921.jpg[/IMG]
Figure 2[/B]
On the [B]Specify NAP Enforcement Server Running DHCP Server[/B] page, you can include the IP address of the DHCP server that will act as the network access servers. You use this option when the DHCP server and the NPS server hosting the NAP policies are not located on the same server.
If you want to add remote DHCP NAP enforcement servers, they must be configured as RADIUS clients, which means that you need to configure those machines as NPS servers as well. The difference is that these NPS servers do not host the NAP policy settings. They just proxy the RADIUS requests to the NPS server hosting the NAP policy settings. I recommend that configuration in a large production environment, where the DHCP server and the NAP servers will both be relatively busy. In addition, it’s likely that you’ll have multiple DHCP servers in your company, and you want all of them to be able to communicate with your NAP policy server or servers.
In this example network we are co-locating the DHCP and NPS servers on the same machine, so we won’t add any remote DHCP servers to the list. Click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0061218716035921.jpg[/IMG]
Figure 3[/B]
You have the option to enable NAP on a per-scope basis when using DHCP enforcement. If you don’t want to apply NAP enforcement policy to all DHCP scopes, you can enter the scopes that you do want NAP policy applied to on the [B]Specify DHCP Scopes[/B] page. In our example network, we want to enable NAP policy on all scopes, so we won’t enter any specific scopes on this page. Click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0081218716172343.jpg[/IMG]
Figure 4[/B]
You can also allow or deny access to specific groups of users or computers in your NAP policy. In this example we will apply policy to all machines and users. Click [B]Next[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0101218716172343.jpg[/IMG]
Figure 5[/B]
All computers need access to certain servers on the network. These include infrastructure servers, such as Active Directory, DNS, DHCP and WINS servers. All machines will need access to remediation servers, which are machines that non-compliant machines can access in order to reach compliance.
In the [B]Specify a NAP Remediation Server Group and URL[/B] page, you click the [B]Group[/B] button to open the [B]New Remediation Server Group[/B] dialog box. In the [B]New Remediation Server Group[/B] dialog box, enter a group name in the [B]Group Name[/B] text box. In this example we’ll name the group [B]Network Services[/B].
Click the [B]Add[/B] button in the [B]New Remediation Server Group[/B] dialog box. This brings up the [B]Add New Server[/B] dialog box where you can servers that will be members of the remediation group. In the [B]Add New Server[/B] dialog box, enter a name for the server in the [B]Friendly name[/B] text box. In this example we’ll enter a name for the domain controller, so we’ll enter [B]DC[/B] into this text box. The IP address of the domain controller is 10.0.0.2, so we’ll enter that into the [B]IP address or DNS name[/B] text box. If you know the name of the DNS server, you can enter the name in the text box and then click the [B]Resolve[/B] button.
Click [B]OK[/B] in the [B]Add New Server[/B] dialog box.
[B][IMG]http://www.windowsecurity.com/img/upl/image0121218716172375.jpg[/IMG]
Figure 6[/B]
You now see the name of the remediation server group and the IP address of the server that you added to the group. Remember, the purpose of this group is to remove it from the restrictions of NAP policy. The domain controller in this example is a machine that all domain members needs to be able to communicate with in order to log on. If you don’t allow your NAP clients, compliant or not, to connect to the domain controller, then they won’t be able to log on to the network in order to try to become compliant after log on.
Click [B]OK[/B] in the [B]New Remediation Server Group[/B] dialog box.
[B][IMG]http://www.windowsecurity.com/img/upl/image0141218716194265.jpg[/IMG]
Figure 7[/B]
Click [B]Next[/B] on the [B]Specify a NAP Remediation Server Group and URL[/B] page. Note that we also have the option to enter a [B]Troubleshooting URL[/B] on this page. We won’t use one in this example, but it’s something that you can include if you want to point users to a Web page that shows them how to become compliant if their computers end up becoming non-compliant and are unable to auto-remediate.
[B][IMG]http://www.windowsecurity.com/img/upl/image0161218716194265.jpg[/IMG]
Figure 8[/B]
On the [B]Define NAP Health Policy [/B]page, you have the option to select which System Health Validators you want to use to define the Health Policy. By default, there is only a single System Health Validator included with Windows Server 2008, which is the [B]Windows Security Health Validator[/B]. Third party vendors have the option to include their own System Health Validators that you can install into the NAP policy server. However, I’m unaware of any of them at this time.
Make sure that there is a checkmark in the [B]Windows Security Health Validator [/B] checkbox. Also, put a checkmark in the [B]Enable auto-remediation[/B] [B]of client computers[/B] checkbox. This option allows the NAP client components to try to remediate the problem itself if possible. For example, if the Windows Firewall is disabled, the NAP agent will try to enable the Windows Firewall itself.
In the [B]Network Access restrictions for NAP-ineligible client computers[/B], you determine what you want to do with machines that are not NAP capable. You have two options:

[LIST][*][B]Deny full network access to NAP-ineligible client computers. Allow access to a restricted network only[/B][*][B]Allow full network access to NAP-ineligible client computers[/B][/LIST]
The first option is the more secure one, while the second option is the more liberal one. You selection depends on your design goals for NAP. You might want to allow non-NAP capable computers complete access to the network during your NAP deployment and then after your complete your NAP deployment, then you turn the switch and force all machines to be NAP compliant.
Click [B]Next[/B] on the [B]Define NAP Health Policy[/B] page.
[B][IMG]http://www.windowsecurity.com/img/upl/image0181218716194265.jpg[/IMG]
Figure 9[/B]
On the [B]Completing NAP Enforcement Policy and RADIUS Client Configuration[/B] page you can see the [B]Health Policies[/B], [B]Connection Request Policy[/B], [B]Network Policies[/B] and [B]Remediation Server Group[/B] that will be created by the wizard. We’ll take a closer look at each of these policies in a little bit.
[B][IMG]http://www.windowsecurity.com/img/upl/image0201218716227171.jpg[/IMG]
Figure 10[/B]
Notice that there is a [B]Configuration Details[/B] link. When you click that link it will bring up a Web page that provides details about each of the policies that will be created by the wizard.
[B][IMG]http://www.windowsecurity.com/img/upl/image0221218716227171.jpg[/IMG]
Figure 11[/B]
[B]Summary[/B]

In this, part 2 of our series on DHCP enforcement for NAP clients, we went through the NAP policy wizard and explored each of the options provided by the wizard. We saw that the NAP policy wizard makes it relatively simple to create a comprehensive NAP policy, as it creates a number of Network, Health, and Connection policies that control what machines can participate in the network. In the next part of this series, we’ll look at each of these rules in more detail and explain the function and rationale behind each of these rules. See you then! –Tom
[/LEFT]

[LEFT][CODE]http://www.windowsecurity.com/articles/Using-Group-Policy-Filtering-Part3.html[/CODE]

[SIZE=3][B]PART-3[/B][/SIZE]

In part 2 of this series on configuration NAP for DHCP enforcement, we went over the NAP configuration wizard in the NPS console. The NAP configuration wizard created a number of policies, including connection request policies, health policies and network policies. In this, part 3 of the article series, we’ll look more closely at these policies and see what they do in the NAP DHCP enforcement solution.
[B]Connection Request Policy[/B]

A connection request policy allows you to designate whether connection requests are processed locally or forwarded to remote RADIUS servers. In the figure below you can see that the wizard created a [B]NAP DHCP[/B] connection request policy that has specific conditions and settings. As you can see in the figure below, the single condition applied to this policy is that it is applied at all times for all days of the week, and that the only Setting is that the Authentication provider is the Local Computer (the machine that is running the NPS service).
Let’s double click on this policy and see what shows up.
[IMG]http://www.windowsecurity.com/img/upl/image0021220371153023.jpg[/IMG]
[B]Figure 1[/B]
On the [B]Overview[/B] tab, you can see that the policy is enabled and that the network connection method is DHCP. This means that the DHCP server is the network access server for this network and the DHCP network access server communicates with the RADIUS (NPS) server to determine whether or not to allow access to the network, and what type of access the computer should be allowed to the network based on the client health state.
[IMG]http://www.windowsecurity.com/img/upl/image0041220371153023.jpg[/IMG]
[B]Figure 2[/B]
On the [B]Conditions[/B] tab you can see the conditions that appeared in the NPS console earlier. The only conditions applied to this rule is that it is applied at all hours for all days of the week.
[IMG]http://www.windowsecurity.com/img/upl/image0061220371153023.jpg[/IMG]
[B]Figure 3[/B]
On the [B]Settings[/B] page, click the [B]Authentication[/B] link in the left pane of the page. Here you can see that the Authentication settings are set to [B]Authenticate requests on this server[/B]. This RADIUS (NPS) server is the server that performs the authentication. In some cases you might want to put the DHCP server on a machine separate from the NPS server that is doing the authentication. In that case, you would still need to install NPS on the DHCP server machine, but then you would configure that NPS server to forward authentication requests to a remote RADIUS (NPS) server by using the [B]Forward requests to the following remote RADIUS server group for authentication[/B] as seen in the figure below.
Click [B]OK[/B] in the [B]NAP DHCP Properties[/B] dialog box.
[IMG]http://www.windowsecurity.com/img/upl/image0081220371617179.jpg[/IMG]
[B]Figure 4[/B]
As you can see, the connection request policy sets conditions and authentication settings for the overall NAP policy. Now let’s take a look at the NAP Network Policies.
[B]Network Policies[/B]

NAP Network Policies allow you to designate who is authorized to connect to the network and the circumstances under which they can or cannot connect. You can see that the NAP wizard has created three Network Policies for our overall NAP policy:

[LIST][*][B]NAP DHCP Compliant [/B]This Network Rule applies to machines that are NAP compliant[*][B]NAP DHCP Noncompliant [/B]This Network Rule applies to machines that are not NAP compliant[*][B]NAT DHCP Non NAP-Capable [/B]This Network Rule applies to machines that aren’t able to process NAP policies[/LIST]
In the following three figures, you can see the [B]Conditions[/B] and [B]Settings[/B] for each of these rules. The main difference between these three rules is the level of access each of these rules provides clients to the network. For fully compliant DHCP clients, full access is allowed to the network. For non-compliant or unable to apply NAP machines, then they are allowed limited network access with the hope that they will be able to use that limited network access to remediate and then meet compliance requirements.
[IMG]http://www.windowsecurity.com/img/upl/image0101220371617179.jpg[/IMG]
[B]Figure 5[/B]
[IMG]http://www.windowsecurity.com/img/upl/image0121220371617179.jpg[/IMG]
[B]Figure 6[/B]
[IMG]http://www.windowsecurity.com/img/upl/image0141220371654336.jpg[/IMG]
[B]Figure 7[/B]
Let’s double click on one of these rules and see what lies beneath. When you double click on the [B]NAP DHCP Noncompliant Properties[/B] rule, the first tab you see is the [B]Overview[/B] tab. Here we can see that the policy is enabled, that the [B]Access Permission[/B] is to [B]Grant access[/B] and that the users [B]dial-in[/B] properties should be ignored (since DHCP clients aren’t dialing into the network). Finally, you can see that the [B]Network connection method[/B] is [B]DHCP server[/B].
[IMG]http://www.windowsecurity.com/img/upl/image0161220371654351.jpg[/IMG]
[B]Figure 8[/B]
On the [B]Conditions[/B] tab, you can see that the [B]NAP DHCP Noncompliant[/B] Health Policy will be applied when the [B]NAP DHCP Noncompliant Properties[/B] Network Rule is applied. We’ll look at the Health Policies in more details in a little bit.
[IMG]http://www.windowsecurity.com/img/upl/image0181220371654351.jpg[/IMG]
[B]Figure 9[/B]
On the [B]Constraints[/B] page, the wizard has configured the constraints on the Network Policy. The only constraint is that only a health check should be applied and that there are no other authentication requirements.
[IMG]http://www.windowsecurity.com/img/upl/image0201220371680648.jpg[/IMG]
[B]Figure 10[/B]
Click on the [B]Settings[/B] tab and then click on the [B]NAP Enforcement[/B] link in the left pane of the dialog box. In the right pane you can see that the wizard has configured the level of access allowed for this Network Policy. In this case the wizard has configured the policy to [B]Allow limited access[/B]. Limited access is defined as access only to IP addresses, network IDs, and servers that are required for basic network services and to enable remediation. You can add more of these by clicking the [B]Configure[/B] button in the [B]Remediation Server Group and Troubleshooting URL[/B] frame.
If you click the [B]Configure[/B] button, you’ll see that the [B]Network Services[/B] group that we created appears as the remediation server group that applies to this network policy.
Note that based on our selections in the wizard, the Network Policy is also configured to enable Auto remediation, as there is a checkmark in the [B]Enable auto-remediation of client computers[/B] checkbox.
[IMG]http://www.windowsecurity.com/img/upl/image0221220371680664.jpg[/IMG]

[B]Figure 11[/B]
[B]Health Policies[/B]

Health Policies are used with NAP to allow you to designate the configuration required to NAP-capable client computers to access the network. In essence, the Health Policies are used to determine if the machine meets that definition of a compliant computer. As you can see in the figure below, the wizard has created two Health Policies:

[LIST][*][B]NAP DHCP Compliant[/B][*][B]NAP DHCP Noncompliant[/B][/LIST]
The purpose of each one should be clear. The compliant policy defines computers who are compliant with out network health policies and the non-compliant policy defines what it is to be non-compliant with our network health policy.
In the figure below you can see that I have double clicked on the [B]NAP DHCP Noncompliant [/B]entry to bring up the [B]NAP DHCP Noncompliant Properties[/B] dialog box. Here you can see that in order to meet the requirements of this policy, the client must fail one or more SHV checks using the [B]Windows Security Health Validator[/B]. That all there is to it! Guess what the definition of the DHCP compliant policy is? You guessed it. The client passes all of the SHV checks for the [B]Windows Security Health Validator[/B].
[IMG]http://www.windowsecurity.com/img/upl/image0241220371680664.jpg[/IMG]

[B]Figure 12[/B]
When you expand the [B]Network Access Protection [/B]node in the left pane of the [B]Network Policy Server[/B] console, you’ll see that there are two nodes: the [B]System Health Validator[/B] node and the [B]Remediation Server Group[/B] node. Click on the [B]System Health Validator [/B]node.
Here you can see in the right pane of the console a list of System Health Validators that are used to determine the Health Policy we saw earlier. By default, there’s only a single SHV, which is the [B]Windows Security Health Validator[/B]. When you click on this SHV, you can see in the bottom pane under the SHV a list of error code configurations. You can see that the wizard has set for each of these error codes that the client should be deemed non-compliant.
Let’s take a closer look by double clicking on the [B]Windows Security Health Validator[/B] entry.
[IMG]http://www.windowsecurity.com/img/upl/image0261220371711758.jpg[/IMG]
[B]Figure 13[/B]
This brings up the [B]Windows Security Health Validator Properties[/B] dialog box. Here you can see the [B]Error code resolution [/B]settings. These error code resolution settings are used to determine how to handle situations where various error codes are encountered during the NAP enforcement process. The defaults configured by the wizard are the most secure and I recommend that you keep them as they are.
Click the [B]Configure[/B] button to configure the settings for this SHV.
[IMG]http://www.windowsecurity.com/img/upl/image0281220371711758.jpg[/IMG]
[B]Figure 14[/B]
This brings up the [B]Windows Security Health Validator[/B] dialog box, which has two tabs: a [B]Windows Vista [/B]tab and a [B]Windows XP[/B] tab. In this example we’ll focus on the Windows Vista tab since that’s the only client we’ll be testing when we complete the configuration.
The Windows Security Health Validator allows you to configure the following:

[LIST][*][B]Firewall[/B] You can force a firewall to be enabled on the Vista client in order to be compliant with health policy[*][B]Virus Protection[/B] You can force that virus protection be enabled in order to be complaint. In addition, you can require that the virus protection be up to date in order to be compliant.[*][B]Spyware Protection[/B] You can force that an antispyware application be enabled to be compliant. In addition, you can force that the antispyware application be up to date in order to be compliant.[*][B]Automatic Updating[/B] When automatic updating is enabled, the NAP agent on the client will try to fix the problem. For example, if the user disables the Windows Firewall, the NAP agent on the client machine will try to turn the firewall back on[*][B]Security Update Protection[/B] When this option is enabled, you can choose to restrict clients from accessing the network based on their current state of security updates. You can use the drop down list seen in the figure below to set what type of security updates are required. You also have the option to set the minimum number of hours allowed since the client has checked for new security updates and whether you want to allow the clients to use Windows Server Update Servers or Windows Update (Microsoft Update is allowed by default).[/LIST]
[IMG]http://www.windowsecurity.com/img/upl/image0301220371711773.jpg[/IMG]
[B]Figure 15[/B]
The figure below shows the SHV settings for the [B]Windows Security Health Validator[/B] for the Windows XP client. Notice that the anti-malware options aren’t included here.
[IMG]http://www.windowsecurity.com/img/upl/image0321220371711789.jpg[/IMG]
[B]Figure 16[/B]
[B]Summary[/B]

In this, part 3 of our article series on NAP DHCP enforcement, we looked at the details of the Health, Network and Connection Request policies created by the NAP wizard. In addition, we took a detailed look at the of the Windows Security Health Validator. In the next and last part of the series, we’ll examine the DHCP server setup and then test our NAP policies. See you then! –Tom
[/LEFT]

[LEFT][CODE]http://www.windowsecurity.com/articles/Using-Group-Policy-Filtering-Part4.html[/CODE]

[SIZE=3][B]PART-4[/B][/SIZE]

In the first three articles in this series on how to configure a NAP DHCP Enforcement policy, we went over the basics of NAP and then created a DHCP Enforcement policy on the NPS server that hosts the NAP policies. In this, part 4 and the final article in the series, we’ll finish up the configuration by settings up the DHCP server to work with the NPS server and the NAP policies, and then configure Group Policy so that NAP policy and NAP components are automatically configured for any machine that belongs to the NAP computers security group in Active Directory. At the end, we’ll finish up by testing the solution to see if it actually works.
[CENTER][URL="http://www.amazon.com/exec/obidos/ASIN/1597491993/isaserver1-20/"]
[/URL][/CENTER]
[B]Configure the DHCP Server[/B]

Now that we have the NAP policies set up with the help of the NAP wizard, we can move our attention to configuration of the DHCP server. Remember, the DHCP server is the network access server in a DHCP NAP scenario, and so we need to configure the DHCP server to communicate with the NAP components in order to work.
Open the DHCP console from the [B]Administrative Tools[/B] menu. In the DHCP console, expand the server name, then expand the [I]IPv4[/I] node, and then expand the [B]Scope[/B] node. Click on the [B]Scope Options [/B]node[B]. [/B]Right click on an empty area in the right pane as seen in the figure below, and click the [B]Configure Options[/B] command.
[B][IMG]http://www.windowsecurity.com/img/upl/image0021221733892451.jpg[/IMG]
Figure 1[/B]
In the [B]Scope Options[/B] dialog box, click on the [B]Advanced [/B]tab. In the [B]Vendor class[/B] drop down box, make sure that it says [B]DHCP Standard Options[/B]. In the [B]User class[/B] drop down list box, make sure that you select the [B]Default Network Access Protection Class[/B] entry. The DHCP option that we’re going to configure here will be applied to clients to identify themselves as NAP clients that are non-compliant.
In the list of [B]Available Options[/B], find the [B]006 DNS Servers[/B] entry and put in the IP address of the DNS server in the [B]IP address[/B] text box and then click [B]Add[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0041221733892467.jpg[/IMG]
Figure 2[/B]
Find the [B]015 DNS Domain Name[/B] option and enter in the [B]String value[/B] text box a name that will be used by non-compliant NAP clients. This will allow you to easily identify non-compliant computers. Click [B]OK[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0061221733892467.jpg[/IMG]
Figure 3[/B]
You will now see entries for both the [B]None[/B] and the [B]Default Network Access Protection Class[/B]. The latter class options will be assigned to non-compliant computers when DHCP enforcement is used with NAP.
[B][IMG]http://www.windowsecurity.com/img/upl/image0081221733916389.jpg[/IMG]
Figure 4[/B]
But before NAP can use these settings, we need to configure the scope to work with NAP. Click on the [B]Scope[/B] node under the[I] IPv4[/I] node in the left pane of the console and then right click it. In the [B]Scope Properties[/B] dialog box, click the [B]Network Access Protection[/B] tab. Select the [B]Enable for this scope[/B] option and then select the [B]Use default Network Acce3ss Protection profile[/B] option.
The [B]Use custom profile [/B]option looks interesting, but there is no documentation on the Internet, including the [URL="http://www.microsoft.com/"]www.microsoft.com[/URL] Web site, that provides any information on how this option might be used. I’ll blog about this in the future if I figure out how to make this work.
Click [B]OK[/B] in the [B]Scope Properties[/B] dialog box.
[B][IMG]http://www.windowsecurity.com/img/upl/image0101221733916405.jpg[/IMG]
Figure 5[/B]
[B]Configure NAP Settings in Group Policy[/B]

While we can manually configure NAP on each machine that will participate in our NAP security framework, manual configuration is not very scalable. To solve this problem, Microsoft has included the necessary Group Policy extensions required to make NAP configurable from Group Policy.
There are three things we need to do in Group Policy to centralize the configuration:

[LIST][*]Enable the NAP Agent on the machines participating in NAP[*]Configure the NAP Enforcement Agent (in this case, it will be the DHCP NAP Enforcement Agent)[*]Configure the Group Policy Object to apply only to machines that belong to the security group containing the machines that will participate in NAP network access controls.[/LIST]
Before performing the following steps, you need to create a Group Policy Object named [B]NAP Client Settings[/B]. This can be done in the Group Policy Management Console. If you don’t know how to do this, check the Help in the Group Policy Management console, as it’s quite easy. Make sure that the Group Policy Object is in the domain that your computers are in.
[B]Enable the NAP Agent[/B]

After you create the [B]NAP Client Settings[/B] Group Policy Object, open that GPO in the [B]Group Policy Management Editor[/B]. You can do that by right clicking on the GPO in the Group Policy Management Console and then clicking the [B]Edit[/B] command.
In the [B]Group Policy Management Editor[/B], expand the [B]Computer Configuration[/B] node and then expand the [B]Policies[/B] node. Expand the [B]Windows Settings[/B] node and then click the [B]System Services[/B] node.
In the [B]System Services[/B] node, you’ll see an entry in the right pane for [B]Network Access Protection Agent[/B]. Double click on that entry. In the [B]Network Access Protection Agent Properties[/B] dialog box, put a checkmark in the [B]Define this policy setting[/B] checkbox and then select the [B]Automatic[/B] option. Click [B]OK[/B].
These steps enable the NAP agent on co9mputers where this GPO is enforced. The NAP Agent has to be enabled in order for NAP processing to work correctly.
[B][IMG]http://www.windowsecurity.com/img/upl/image0121221733916405.jpg[/IMG]
Figure 6[/B]
[B]Enable the DHCP Enforcement Client[/B]

The next step is to enable the DHCP Enforcement Client on the NAP enabled computers. In the Group Policy Management editor, expand the [B]Computer Configuration[/B], expand the [B]Windows Settings[/B] node, and then expand the [B] Network Access Protection[/B] node. Expand the [B]NAP Client Configuration[/B] node and then click on the [B]Enforcement Clients[/B] node.
When on the [B]Enforcement Clients[/B] node, the right pane of the console will show the various enforcement clients available for NAP. You can enable one or more enforcement methods; you are not limited to a single enforcement client. In this example we are using only DHCP enforcement, so right click on the [B]DHCP Quarantine Enforcement Client[/B] entry and click [B]Enable[/B], as seen in the figure below.
[B][IMG]http://www.windowsecurity.com/img/upl/image0141221733942358.jpg[/IMG]
Figure 7[/B]
Click on the [B]NAP Client Configuration[/B] node in the left pane of the console as seen in the figure below. Right click on the [B]NAP Client Configuration[/B] node and then click [B]Apply[/B]. This applies the Enforcement Client settings into Group Policy.
I have found that there times when the Enforcement Client settings do not “take”. This has lead to a confusing and time consuming troubleshooting exercise for me in the past. What you might want to do is after you apply the Enforcement Client settings is to close the Group Policy Management Console and the Group Policy Management Editor and then open them again and check the Enforcement Client Settings. If you find that the Enforcement Client Settings are not enabled, then enable them again. Usually after the second attempt they will keep.
[B][IMG]http://www.windowsecurity.com/img/upl/image0161221733942358.jpg[/IMG]
Figure 8[/B]
[B]Use Group Policy Security Filtering to Apply the GPO to the NAP Enforced Computers Security Group[/B]

Our final step in Group Policy is to apply the GPO settings in the [B]NAP Client Settings [/B]GPO to the computers that belong to the [B]NAP Enforced Computers[/B] security group that we created earlier. Open the [B]Group Policy Management [/B]console and then expand the forest name and then expand the domains node. Then expand your domain name and click on the [B]NAP Client Settings[/B] GPO.
In the right pane of the console you’ll see a section named [B]Security Filtering[/B]. You can use this feature to apply the Group Policy settings in this GPO to the security group we created for the NAP client computers.
In the [B]Security Filtering[/B] section, click on the [B]Authenticated Users[/B] entry and click the [B]Remove [/B] button.
[B][IMG]http://www.windowsecurity.com/img/upl/image0181221733942373.jpg[/IMG]
Figure 9[/B]
You will see a [B]Group Policy Management[/B] dialog box asking if [B]Do you want to remove this delegation privilege?[/B] Click [B]OK[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0201221733963889.jpg[/IMG]
Figure 10[/B]
Now click the [B]Add[/B] button. This will bring up the [B]Select User, Computer or Group[/B] dialog box. Enter [B]NAP Enforced Computers[/B] in the [B]Enter the object name to select[/B] text box, and click [B]Check Names[/B] to confirm that the group can be found. Then click [B]OK[/B].
[B][IMG]http://www.windowsecurity.com/img/upl/image0221221733963889.jpg[/IMG]
Figure 11[/B]
You will now see in the [B]Security Filtering[/B] section the security group that the NAP enabled computers will be placed in.
[B][IMG]http://www.windowsecurity.com/img/upl/image0241221733963936.jpg[/IMG]
Figure 12[/B]
[B]Enter the Vista Computer into the NAP Enforced Computers Security Group[/B]

With the Group Policy settings in place, we are ready to put our Vista client computer into the [B]NAP Enforced Computers[/B] security group. Open the [B]Active Directory Users and Computers[/B] console and click the [B]Users[/B] node in the left pane of the console.
Double click on the [B]NAP Enforce Computers[/B] entry. This brings up the [B]NAP Enforced Computers Properties[/B] dialog box. Click the [B]Members [/B]tab and then click the [B]Add[/B] button.
In the [B]Select Users, Contacts, Computers or Groups[/B] dialog box, enter the name of the computer that will participate in NAP enforcement. In this example, we have a domain member computer named [B]VISTA2[/B] and we’ll enter that into the [B]Enter the object names to select[/B] text box.
[B][IMG]http://www.windowsecurity.com/img/upl/image0261221733985248.jpg[/IMG]
Figure 13[/B]
If the machine that you want to participate in the NAP enforcement group hasn’t yet joined the domain, you can instead create the computer account in the Active Directory by using the Add Computer option in the Active Directory Users and Computers console. You can then later join this machine to the domain. In the example network that we’re using in this article, the VISTA2 computer is already a domain member.
At this point you might want to consider running the [I]gpupdate /force[/I] command on the domain controller. Also, if your NAP enforced computers are already joined to the domain, you might want to restart those computers so that the new Group Policy settings are applied.
The most problematic area in the NAP solution are the Group Policy timings. In a production network you’ll have plenty of time to wait for Group Policy propagation, but in a lab environment we tend to get impatient and want things to work right away. If you find that the settings aren’t being applied to the client, then be patient. Restart the client a couple of times or run the [I]gpupdate /force[/I] command on the client. If NAP still isn’t working, then recheck all of your settings in the NAP configuration and also in Group Policy. There are a lot of “moving parts” and it’s easy to miss a step.
Now let’s see the NAP solution in action.
[B]Test the Solution[/B]

Remember that when you’re using DHCP enforcement, the clients must be using DHCP to obtain IP addressing information. When you open a command prompt and run the [I]ipconfig[/I]command, you will IP addressing information for the DHCP client. In the figure below, you can see that the this client is not NAP compliant, as it received the domain name [I]restricted.msfirewall.org,[/I] which is a DHCP option we created for non-compliant NAP clients.
[B][IMG]http://www.windowsecurity.com/img/upl/image0281221733985248.jpg[/IMG]
Figure 14[/B]
At the command prompt, run the [B]Route Print[/B] command. Notice the routes to the DHCP server and the domain controller. Notice that there are no other routing interfaces to the on subnet network ID. This means that this NAP client will be able to reach the DHCP server and the domain controller, but no other machines on the network. This machine is locked down because the routing table entries prevent access to any other IP addresses except those we’ve configured in NAP (remember that the domain controller is in the remediation group, and the DHCP is automatically allowed since it is the network access server that controls the level of network access).
[B][IMG]http://www.windowsecurity.com/img/upl/image0301221733985264.jpg[/IMG]
Figure 15[/B]
These findings are what you would see if the machine were not joined to the domain or if the NAP settings aren’t being applied to the client.
Now let’s see what things look like when the NAP settings are applied.
Run the [I]ipconfig[/I] command again and you’ll see that you get the non-restricted domain name assigned to the client.
[B][IMG]http://www.windowsecurity.com/img/upl/image0321221734007123.jpg[/IMG]
Figure 16[/B]
Run the [B]Route Print[/B] command. Here you’ll see that we have a default gateway configured. In addition, we now have a routing interface to the on subnet network ID. The special routing interfaces to the DHCP server and the domain controller have been removed.
[B][IMG]http://www.windowsecurity.com/img/upl/image0341221734007123.jpg[/IMG]
Figure 17[/B]
Let’s test the auto-remediation feature. Recall that we enabled auto-remediation in the Windows Security SHV. This allows the NAP Agent to try and fix security problems that might crop up on the NAP client. For example, if the firewall is disabled on the NAP client, the NAP Agent can turn the firewall back on.
In the figure below, you can see that I’ve turned off the Windows Firewall on the Vista client. Try this on your own Vista client.
[B][IMG]http://www.windowsecurity.com/img/upl/image0361221734007139.jpg[/IMG]
Figure 18[/B]
Wait a few second. Bam! You’ll see that the state of the Windows firewall automatically changes to being on again without any intervention on your part.
[B][IMG]http://www.windowsecurity.com/img/upl/image0381221734023217.jpg[/IMG]
Figure 19[/B]
Note that you didn’t see anything in the system tray for this. If you want to see a system tray notification, then you’ll need to configure things so that the NAP Agent will not be able to auto-remediate. If you go back to the Windows SHV on the NPS server, you can change it so that an AV program is required. If there is no AV program on the client, then you’ll see a system tray notification balloon regarding the security configuration of the computer does not meet network requirements. If you click the balloon, you’ll see a dialog box like that in the figure below.
[B][IMG]http://www.windowsecurity.com/img/upl/image0401221734023233.jpg[/IMG]
Figure 20[/B]
[B]Summary[/B]

In this, the last part of our four part series on using DHCP enforcement with NAP, we went over the DHCP server configuration and then set things up in Group Policy to automate policy deployment. We then finished up by testing the solution and confirming the NAP DHCP policy enforcement actually worked. And it did! In the future I’ll do more articles NAP configuration using different enforcement methods. Then we’ll take a closer look at more sophisticated options, such as using multiple NAP and DHCP servers (or enforcement servers). See you then! –Tom
[/LEFT]