Network Access Protection with MSIT | adambomb

gr@nt

If NAP prevents a non-healthy computer from acquiring an ip address i.e. lacking Windows patches or an antivirus, then how is it able to acquire them conveniently?

Or is it connected to another server exclusively dedicated to this function?

adambomb

you can specify what to do with unhealthy machines. Typically, you'd configure your network to put the machines on a remediation v-lan where they can only access a remediation server that pushes down any required patches, antivirus signatures, etc.
You might also have a v-lan that has internet access only, so guests on your network that don't meet your criteria for health can still get to the net.

cedson -MSFT-

It does not prevent you from acquiring an IP address - it provides an IP with a set of settings that prevents you from communicating with any machines on the network other than those specified via the access policy. These are termed as 'fixup servers'.

Please see documents/whitepapers/other info at http://www.microsoft.com/nap for more information.

-Chris

NAPDude
NAP'ing the World

No comment (oh wait) on Adam's hair (or lack thereof), since he had to mention mine!

Jeff Sigman

PS - Thanks to Adam for making this video happen! Let us know if you like it and we can continue a series all about NAP. Make sure to check out the NAP blog.

mcampbell

Any key differences between this and any standard NAC appliance?

CannedSoda

Enterprise CA required or Standalone okay to test?

NAPDude
NAP'ing the World

Hey Matt, good question.

1.) Integrated client available in XP SP3 and Vista.
2.) Able to enforce NAP orthogonally to the logged-on user (since it is an NT service).
3.) 3rd parties can build on top of client and server and extend the scope of what "health" means.
4.) The TCG adopted our Statement of Health (SoH) protocol as a standard - anyone can read the standard and interoperate.
5.) Check out this demo video I made to get a better idea of the experience.

I hope you try it out for yourself!

Jeff Sigman
Senior Program Manager - NAP

ZippyV
Fired Up

So, a networking guy hit by blaster because he didn't have his firewall on. Hmmm, fake story!

mcampbell

NAPDude wrote:

Hey Matt, good question.

1.) Integrated client available in XP SP3 and Vista.
2.) Able to enforce NAP orthogonally to the logged-on user (since it is an NT service).
3.) 3rd parties can build on top of client and server and extend the scope of what "health" means.
4.) The TCG adopted our Statement of Health (SoH) protocol as a standard - anyone can read the standard and interoperate.
5.) Check out this demo video I made to get a better idea of the experience.

I hope you try it out for yourself!

Jeff Sigman
Senior Program Manager - NAP

The live meeting site says that the webcast has expired.