Network Access Protection (NAP) : Forefront

Microsoft Assessment and Planning Toolkit 3.2 Released

MS NAP Team — Wed, 05 Nov 2008 19:37:00 GMT

The Microsoft Assessment and Planning (MAP) Toolkit is an integrated platform with tools and guidance that make it easier for you to assess your current IT infrastructure and determine the right Microsoft technologies for your needs. The MAP Toolkit 3.2 has been released and is available here. It includes a new feature to perform readiness assessment for a deployment of NAP with Microsoft Forefront.

Consume and enjoy!

Joe Davies
Senior Program Manager

FYI: In a previous blog post (located here), I described the beta of the MAP Toolkit 3.2.

Microsoft Assessment and Planning Toolkit 3.2 Beta Released

MS NAP Team — Thu, 16 Oct 2008 19:13:00 GMT

The existing MAP Toolkit 3.1 is located here and includes desktop Windows Security Center assessment, which is instrumental in analyzing your network prior to a NAP deployment. Click here for the NAP blog post that describes this in detail.

The MAP Toolkit 3.2 beta includes a new feature to perform readiness assessment for a deployment of NAP with Microsoft Forefront.

Click here to get on the MAP 3.2 beta and try it out!

Joe Davies
Senior Program Manager

New case study for Blue Ridge Networks published

MS NAP Team — Mon, 08 Sep 2008 23:35:00 GMT

Salutations, fellow NAP fans!

Check out this new case study for Blue Ridge Networks that was published today.

This case study describes how Blue Ridge Neworks, a NAP partner, used Solution Accelerators to integrate NAP, Microsoft Forefront Client Security, and their EdgeGuard product. The study details the situation, the solution, and the benefits of the resulting integration.

Enjoy.

Joe Davies
Senior Program Manager

This posting is provided "AS IS" with no warranties, and confers no rights.

System Health Agents (SHAs) that are available from Microsoft

MS NAP Team — Thu, 04 Sep 2008 01:16:00 GMT

Greetings, fellow disciples of NAP!

Here is a summary of the different system health agents (SHAs) that are currently available from Microsoft.

Note: The following text was shamelessly “leveraged” from our own Greg Lindsay’s upcoming Network Access Protection Design Guide. Thanks Greg!

Microsoft provides the following SHAs for the NAP platform:

· Windows Security Health Agent (WSHA)

· System Center Configuration Manager SHA (SCCM SHA)

· Forefront Client Security SHA (FCS SHA)

For the SHAs available from our NAP partners, click here.

Note Each of these SHAs has a corresponding system health validator (SHV).

Windows Security Health Agent (WSHA)

The WSHA is included with Windows Vista and Windows XP with Service Pack 3 and monitors the operational status of the Windows Security Center (WSC) on NAP client computers. The WSHA monitors the following:

· Firewall: If required, the NAP client must have a firewall enabled for all network connections.

· Virus Protection: If required, the NAP client computer must have an antivirus application installed, registered with WSC, and turned on. The NAP client can also be required to have an up-to-date antivirus signature file installed.

· Spyware Protection: If required, the NAP client must have an antispyware application installed, registered with WSC, and turned on. The NAP client can also be required to have an up-to-date antispyware signature file installed. Spyware protection only applies to NAP clients running Windows Vista.

· Automatic Updating: If required, the NAP client must be configured to check for updates from Windows Update. You can also require the NAP client to automatically download and install updates.

· Security Update Protection: If required, the NAP client must have security updates installed based on one of four possible values that match security severity ratings from the Microsoft Security Response Center (MSRC). You can also specify the use of Windows Server Update Services (WSUS) or Windows Update to obtain security updates.

Common point of confusion: The capability of the NAP platform is sometimes equated to the capability of the WSHA and if there is a system health check that is not supported by WSHA, then the NAP platform cannot support it. This is, of course, not correct, and is most likely based on an oversimplification of NAP functionality that is included with Windows. However, just like Windows includes basic functionality for drawing (the Paint program) and supports much more capable drawing programs (such as Adobe Illustrator), NAP is a platform that allows any kind of system health check through the installation of additional SHAs, which can be developed using the NAP APIs. Additional SHAs can verify all kinds of things, from contacting an intrusion detection system (IDS) to ensure that your computer is not performing an address scan on the intranet (an IDS SHA) to automatically calling your Aunt Brenda to make sure that she is wearing her sweaters around the house because it is starting to get cold (the AB SHA :>).

System Center Configuration Manager SHA (SCCM SHA)

The SCCM SHA monitors a NAP client computer for compliance with required software updates that you specify. When a computer connects to the network, the SCCM SHA provides the current state of compliance, a site code, and a health state reference. The health state reference and site code are used to check whether or not a client computer has received the latest software update requirements from a Microsoft Systems Management Server (SMS) management point. If the health state is determined to be out of date, the client computer downloads a new set of requirements and health is evaluated again.

When you deploy a software update with SCCM, you can select the update for NAP evaluation and specify a date and time when the policy will become effective. Only those updates that have been enabled for NAP evaluation in the Configuration Manager console are required to be installed on compliant NAP clients.

For more information about SCCM and NAP, see Network Access Protection in Configuration Manager.

Forefront Client Security SHA (FCS SHA)

The FCS SHA monitors the operational health of FCS on the client computer. The administrator-defined health policy on the SHV determines whether the client computer is compliant before it is allowed to access the network. To monitor and report on FCS-related aspects of computer health, the FCS SHA queries NAP client registry settings, checks the status of system services, and verifies that the NAP client has the latest patches and malware signature definitions. The FCS SHA also sends data to the FCS server management system, which provides manageability, data collection, and reporting services.

The FCS SHA monitors the NAP client’s level of Forefront protection. Noncompliance with the FCS SHA does not necessarily mean that the computer has a virus or some other active threat, but that the FCS configuration is either incorrect or not up-to-date as defined in the health policy. The FCS SHA can restart services on noncompliant NAP clients, automatically update configuration settings, and install software updates if required.

For more information about the FCS SHA, see the Microsoft Forefront Integration Kit for Network Access Protection.

Joe Davies
Senior Program Manager

This posting is provided "AS IS" with no warranties, and confers no rights.

NAP @ TechEd Podcast

JeffSigman — Wed, 11 Jun 2008 23:14:00 GMT

NAP - with Jeff Sigman and Others

Jeff Sigman – Microsoft
Chris Boscolo - Napera Networks, Inc.
Alex Chalmers - Ball State University
Pattabhi Attaluri - Avenda Systems

In this podcast from Tech·Ed NA 2008 IT Pro, Jeff Sigman talks about Network Access Protection (NAP). Alex Chalmers of Ball State University shares his experiences rolling out a large NAP deployment. Chris Boscolo (Napera Networks, Inc.) and Pattabhi Attaluri (Avenda Systems) talk about products their companies provide to add value to a NAP environment.

PowerPoint from the session.

Special thanks to Kevin Remde for making this podcast happen!

Day 2, NAP’ing TechEd

JeffSigman — Wed, 11 Jun 2008 21:17:00 GMT

My NAP overview session went very well yesterday. All the demos went off perfect, and I thought {most} of the audience got a lot out of it. If you attended the session and have feedback, I’d love to hear it. I have a repeat session this Friday, so I have time to make some corrections and changes.

The show this year has followed the TechEd Europe model – one week of Dev TechEd, one week of IT Pro TechEd. Most people I have spoken to at the show appreciated the split as it lowered the crowds of having one huge show. Some folks did mention that they wear both hats – Developer and IT Pro and they wished it was still a one-stop shop. I think the split is a good thing overall as it feels like a focused event...

Virtualization is, of course, a hot topic at the show this year. Its section on the show floor is jam-packed. The interest in network security and compliance is still high though as my first session had over 400 people attend.

While I was speaking yesterday, we officially announced the availability of the “Microsoft Forefront Integration Kit for Network Access Protection” (aka FCS NAP) as a free download. I have been showing off this integration for months – I am pumped that it is now available to all!

More later from the show floor – I am typing this in the “TechEd Bloggers Lounge”. Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

Launch date for the FCS + NAP Solution Accelerator Kit Revealed

JeffSigman — Tue, 13 May 2008 21:45:00 GMT

In case you have been asleep on the keyboard, Microsoft is releasing a NAP integration kit for Forefront Client Security 1.0 (FCS). I worked tirelessly (just in case my boss reads this) to make sure it will be a huge success!

Frank Simorjay of the Solution Accelerators team has been blogging recently about the NAP + FCS kit over on his team blog. In case you missed it, he just mentioned the RTM launch date.

May 19^th, 2008!!

Very exciting, I can’t wait for this to be publicly available! Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}

{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

FCS + NAP Update

JeffSigman — Tue, 06 May 2008 22:40:00 GMT

The fine folks over at the Solution Accelerators team are making GREAT progress on the Forefront Client Security 1.0 NAP integration (FCS NAP). Check out their latest here. This product extension to FCS/NAP should be shipping publicly very soon! Very cool.

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}

{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

The World on {NAP}

JeffSigman — Mon, 05 May 2008 21:31:00 GMT

In case you haven’t noticed, {NAP} is being deployed across the globe! It is an exciting time with Windows Server 2008, Vista and XP SP3 NAP released and available to the world. Check out the great things 13 of our customers are saying below.

The full details of these customer deployments are in this word document. Check it out!!

City of Uppsala

Size
6,000 employees

Vertical
Government – Local

Country/Region
Sweden

PCL Constructors

Size
3,000 employees

Vertical
Building and Construction

Country/Region
Canada

Continental Airlines

Size:
44,000 employees

Vertical:
Aviation

Country/Region
United States

Rijksmuseum Amsterdam

Size:
420 employees

Vertical:
Museums

Country/Region
Netherlands, The

Fulton County

Size:
5,000 employees

Vertical:
Government - Central IT

Country/Region
United States

Microsoft Corporation

Size:
77,000 employees

Vertical:
Software Engineering

Country/Region
United States

La Trobe University

Size:
3,000 employees

Vertical:
Higher Education Institutions

Country/Region
Australia

KoçSistem

Size:
900 employees

Vertical:
IT Services

Country/Region
Turkey

Petron Corporation

Size:
1,300 employees

Vertical:
Oil & Gas

Country/Region
Philippines

University of Hradec Králové

Size:
800 employees

Vertical:
Universities

Country/Region
Czech Republic

City of Helsinki

Size:
40,000 employees

Vertical:
Government - Local

Country/Region
Finland

Government of Alberta

Size:
30,000 employees

Vertical:
Government - Regional / State

Country/Region
Canada

“With Windows Server 2008 Network Access Protection, all of our users will be able to access whatever network resources they need, regardless of their physical location or the state of their computers.”

Maurice Moes

Senior Architect and Project Manager, BRAIN FORCE

BRAIN FORCE

Size:
1,400 employees

Vertical:
Information Technology

Country/Region
Netherlands, The

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}

{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

Exclusive Video! NAP + Forefront Client Security (FCS)

MS NAP Team — Fri, 22 Feb 2008 11:54:00 GMT

I recorded a video earlier today because of how excited I was to show off the latest development in the world of NAP. The NAP team has worked directly with the Solutions Accelerators team as well as the Forefront team to bring you integration between NAP and Forefront Client Security (FCS) 1.0. Once released, it will be a free download through the Solutions Accelerators TechNet site....(read more)