Network Access Protection (NAP) is an attractive security capability of Vista in combination with at least one Windows Server 2008. NAP lets administrators set conditions under which workstations are allowed to connect to the main network. For example, a laptop user who turned off her firewall over the weekend will not be granted access Monday morning until she turns the firewall back on. Or, even better, the NAP client will automatically turn the firewall back on without her intervention: something called “auto-remediation.”
NAP also provides for the automatic redirection of “unhealthy” clients to a separate subnet or subdomain, where they could, for example, download security updates in order to bring themselves into compliance with the health policies. System health policies can be enforced by DHCP (Dynamic Host Configuration Protocol) running on Windows Server 2008 for clients accessing the network locally, and by the RRAS (Routing and Remote Access) service for clients accessing the network remotely. Third-party antivirus software vendors are expected to create agents that can extend NAP to include rules for updated virus signatures.
The Group Policy settings for NAP include the following:
• Which enforcement clients you want to run;
• The way the NAP client should appear (you can specify custom text and a custom image); and
• So-called “health registration” settings which specify the encryption methods that clients can use to communicate with Health Registration Authority servers, if you’re using certificates.
See recent blog posts…
New Group Policy Settings in WS2008 – A powerful toolset
A step by step on how to add a role to Server Core
