Configuration settings for the Internet Authentication Service (IAS) in Windows Server 2003 are stored in .MDB files. Configuration settings for Network Policy Server (NPS) in Windows Server 2008 are stored in .XML files. If you install Windows Server...

I just got back from TechEd 2008 North America (Orlando) where I presented two “breakout” sessions on NAP . It went off with a bang and most people really loved the sessions / demos. I have blogged a couple times in the past that I would document exactly...

The following blog post has been extracted from the "Network Access Protection Deployment Planning Guide", by Susie Bernard (March 2007). Introduction Whether your organization is small, medium, or large, deploying an enterprise software solution...

NAP 802.1X Configuration Walkthrough – Part 2 This is a continuation from Part 1 . Step 2 – Windows Server 2008 NPS, the heart of NAP I am going to take a slightly different approach than the 802.1X step-by-step guide . Feel free to follow...

Ever wanted to tighten the security to the point that only some machines are allowed access on 802.1x/Wireless network? Well here’s the solution, combine MAC filtering, with EAP Authentication and you get, User AND machine authentication all in one. ...

We visit many customers and partners around the world. One thing we hear consistently is “NAP client enforcement MUST BE SUPPORTED on XP”. Which OS’es would block / hinder your NAP deployments if they weren’t supported? Any nice-to-have’s (non-blocking...

I don't remember when I first starting hearing about Network Access Protection (NAP) but I know it was over a year ago, because I used to mention it in passing when I talked to customers about Windows Server 2003 R2 . I think it was originally a feature...

NPS templates, the flagship feature of NPS in Windows Server 2008 R2, provides a huge reduction in cost of ownership and deployment for all NPS environments. NPS templates separate common RADIUS configuration elements such as RADIUS shared secrets and...

This is a continuation from Part 1 and Part 2 . Step 3 – NAP Clients, it’s just too easy NAP can be configured from the command-line, the MMC (except on XP SP3) and of course Group Policy (GP). Since this is a workgroup scenario, I am going to...

My NAP overview session went very well yesterday. All the demos went off perfect, and I thought {most} of the audience got a lot out of it. If you attended the session and have feedback, I’d love to hear it. I have a repeat session this Friday , so I...

Greetings, fellow disciples of NAP! Here is a summary of the different system health agents (SHAs) that are currently available from Microsoft. Note: The following text was shamelessly “leveraged” from our own Greg Lindsay’s upcoming Network Access...

When you create a new RADIUS client or modify the settings of an existing RADIUS client from the RADIUS Clients node of the Network Policy Server snap-in, there is a RADIUS client is NAP-capable check box. Here is an example. What is this check...

In my last post I committed to coming back and giving you a more information on the many enforcement options available with Network Access Protection (VPN, DHCP, IPSEC, 802.1x). With that in mind I thought I would start with 802.1x based Network...

Hi everyone! My name is Greg Lindsay, and I’m a technical writer on the Windows Server User Assistance team. I’ve been lucky to be assigned the task of writing about NAP, and just published 4 new step by step guides for Beta 3. I’ve enjoyed working on...

Hi everyone! As you may have heard, we have shown a rack filled up with switches to demonstrate NAP 802.1x enforcement interoperability at RSA and Interop 2007. Apparently, there are lots of NAPPERS out there who want to know exact models...

Windows 7 and Windows Server 2008 R2 are now available as public betas. In Windows 7, the NAP client user interface (UI) has been integrated into the Windows Action Center (previously known as the Windows Security Center). For example, Network Access...

As you are already aware, the beta version of Windows Server 2008 R2 is now available to the public for beta testing. See http://www.microsoft.com/windowsserver2008/en/us/R2-Beta.aspx for more information and the link to download the beta. Here is...

In my previous blog post, System Health Agents (SHAs) that are available from Microsoft , I described the SHAs (and their corresponding system health validators [SHVs]) that you can use with Windows Security Center in Windows Vista and Windows XP with...

NAP Clients for Linux and Macintosh are available from Avenda and UNETsystem, Inc. Avenda The Avenda Linux NAP Agent includes 802.1X enforcement, the Avenda System Health Agent (SHA), and the Avenda Linux NAP Agent System Health Validator (SHV)...

In Windows Server 2008, a system health validator (SHV) installed on the NPS server can be configured in a single way. This works well if your system health requirements are the same for all of your NAP enforcement methods and all of your computers. However...

One of the most common challenges I hear about when deploying secure 802.1x (for both wireless and wired scenarios) and remote access is deploying certificates to your IAS servers. With Windows 2003 environments that have Active Directory deployed...

I’m Carol Bailey, Senior Technical Writer for System Center Configuration Manager 2007 (formally SMS 2003), and I’m involved with many of the security-related features in Configuration Manager – including Internet-based client management, desired configuration...

Since I spend nearly 1/3 of my week answering (or ignoring :->) emails about the XP NAP Client, I thought it might be smart to give a very concise Q&A. Here goes: Questions Jeff’s (brilliant) Answers How do I get...

I recorded a video earlier today because of how excited I was to show off the latest development in the world of NAP. The NAP team has worked directly with the Solutions Accelerators team as well as the Forefront team to bring you integration between NAP and Forefront Client Security (FCS) 1.0. Once released, it will be a free download through the Solutions Accelerators TechNet site....

As I learned at Tech Ed 2007, Microsoft NAP still has two large misconceptions out in the world: 1. NAP is solely based on DHCP technology - 100% FALSE 2. Deploying NAP requires a complete "rip and replace" of your existing AD/Server infrastructure...