Network Access Protection (NAP) : SCCM

System Health Agents (SHAs) that are available from Microsoft

MS NAP Team — Thu, 04 Sep 2008 01:16:00 GMT

Greetings, fellow disciples of NAP!

Here is a summary of the different system health agents (SHAs) that are currently available from Microsoft.

Note: The following text was shamelessly “leveraged” from our own Greg Lindsay’s upcoming Network Access Protection Design Guide. Thanks Greg!

Microsoft provides the following SHAs for the NAP platform:

· Windows Security Health Agent (WSHA)

· System Center Configuration Manager SHA (SCCM SHA)

· Forefront Client Security SHA (FCS SHA)

For the SHAs available from our NAP partners, click here.

Note Each of these SHAs has a corresponding system health validator (SHV).

Windows Security Health Agent (WSHA)

The WSHA is included with Windows Vista and Windows XP with Service Pack 3 and monitors the operational status of the Windows Security Center (WSC) on NAP client computers. The WSHA monitors the following:

· Firewall: If required, the NAP client must have a firewall enabled for all network connections.

· Virus Protection: If required, the NAP client computer must have an antivirus application installed, registered with WSC, and turned on. The NAP client can also be required to have an up-to-date antivirus signature file installed.

· Spyware Protection: If required, the NAP client must have an antispyware application installed, registered with WSC, and turned on. The NAP client can also be required to have an up-to-date antispyware signature file installed. Spyware protection only applies to NAP clients running Windows Vista.

· Automatic Updating: If required, the NAP client must be configured to check for updates from Windows Update. You can also require the NAP client to automatically download and install updates.

· Security Update Protection: If required, the NAP client must have security updates installed based on one of four possible values that match security severity ratings from the Microsoft Security Response Center (MSRC). You can also specify the use of Windows Server Update Services (WSUS) or Windows Update to obtain security updates.

Common point of confusion: The capability of the NAP platform is sometimes equated to the capability of the WSHA and if there is a system health check that is not supported by WSHA, then the NAP platform cannot support it. This is, of course, not correct, and is most likely based on an oversimplification of NAP functionality that is included with Windows. However, just like Windows includes basic functionality for drawing (the Paint program) and supports much more capable drawing programs (such as Adobe Illustrator), NAP is a platform that allows any kind of system health check through the installation of additional SHAs, which can be developed using the NAP APIs. Additional SHAs can verify all kinds of things, from contacting an intrusion detection system (IDS) to ensure that your computer is not performing an address scan on the intranet (an IDS SHA) to automatically calling your Aunt Brenda to make sure that she is wearing her sweaters around the house because it is starting to get cold (the AB SHA :>).

System Center Configuration Manager SHA (SCCM SHA)

The SCCM SHA monitors a NAP client computer for compliance with required software updates that you specify. When a computer connects to the network, the SCCM SHA provides the current state of compliance, a site code, and a health state reference. The health state reference and site code are used to check whether or not a client computer has received the latest software update requirements from a Microsoft Systems Management Server (SMS) management point. If the health state is determined to be out of date, the client computer downloads a new set of requirements and health is evaluated again.

When you deploy a software update with SCCM, you can select the update for NAP evaluation and specify a date and time when the policy will become effective. Only those updates that have been enabled for NAP evaluation in the Configuration Manager console are required to be installed on compliant NAP clients.

For more information about SCCM and NAP, see Network Access Protection in Configuration Manager.

Forefront Client Security SHA (FCS SHA)

The FCS SHA monitors the operational health of FCS on the client computer. The administrator-defined health policy on the SHV determines whether the client computer is compliant before it is allowed to access the network. To monitor and report on FCS-related aspects of computer health, the FCS SHA queries NAP client registry settings, checks the status of system services, and verifies that the NAP client has the latest patches and malware signature definitions. The FCS SHA also sends data to the FCS server management system, which provides manageability, data collection, and reporting services.

The FCS SHA monitors the NAP client’s level of Forefront protection. Noncompliance with the FCS SHA does not necessarily mean that the computer has a virus or some other active threat, but that the FCS configuration is either incorrect or not up-to-date as defined in the health policy. The FCS SHA can restart services on noncompliant NAP clients, automatically update configuration settings, and install software updates if required.

For more information about the FCS SHA, see the Microsoft Forefront Integration Kit for Network Access Protection.

Joe Davies
Senior Program Manager

This posting is provided "AS IS" with no warranties, and confers no rights.

NAP @ TechEd Podcast

JeffSigman — Wed, 11 Jun 2008 23:14:00 GMT

NAP - with Jeff Sigman and Others

Jeff Sigman – Microsoft
Chris Boscolo - Napera Networks, Inc.
Alex Chalmers - Ball State University
Pattabhi Attaluri - Avenda Systems

In this podcast from Tech·Ed NA 2008 IT Pro, Jeff Sigman talks about Network Access Protection (NAP). Alex Chalmers of Ball State University shares his experiences rolling out a large NAP deployment. Chris Boscolo (Napera Networks, Inc.) and Pattabhi Attaluri (Avenda Systems) talk about products their companies provide to add value to a NAP environment.

PowerPoint from the session.

Special thanks to Kevin Remde for making this podcast happen!

The World on {NAP}

JeffSigman — Mon, 05 May 2008 21:31:00 GMT

In case you haven’t noticed, {NAP} is being deployed across the globe! It is an exciting time with Windows Server 2008, Vista and XP SP3 NAP released and available to the world. Check out the great things 13 of our customers are saying below.

The full details of these customer deployments are in this word document. Check it out!!

City of Uppsala

Size
6,000 employees

Vertical
Government – Local

Country/Region
Sweden

PCL Constructors

Size
3,000 employees

Vertical
Building and Construction

Country/Region
Canada

Continental Airlines

Size:
44,000 employees

Vertical:
Aviation

Country/Region
United States

Rijksmuseum Amsterdam

Size:
420 employees

Vertical:
Museums

Country/Region
Netherlands, The

Fulton County

Size:
5,000 employees

Vertical:
Government - Central IT

Country/Region
United States

Microsoft Corporation

Size:
77,000 employees

Vertical:
Software Engineering

Country/Region
United States

La Trobe University

Size:
3,000 employees

Vertical:
Higher Education Institutions

Country/Region
Australia

KoçSistem

Size:
900 employees

Vertical:
IT Services

Country/Region
Turkey

Petron Corporation

Size:
1,300 employees

Vertical:
Oil & Gas

Country/Region
Philippines

University of Hradec Králové

Size:
800 employees

Vertical:
Universities

Country/Region
Czech Republic

City of Helsinki

Size:
40,000 employees

Vertical:
Government - Local

Country/Region
Finland

Government of Alberta

Size:
30,000 employees

Vertical:
Government - Regional / State

Country/Region
Canada

“With Windows Server 2008 Network Access Protection, all of our users will be able to access whatever network resources they need, regardless of their physical location or the state of their computers.”

Maurice Moes

Senior Architect and Project Manager, BRAIN FORCE

BRAIN FORCE

Size:
1,400 employees

Vertical:
Information Technology

Country/Region
Netherlands, The

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}

{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

TechNet Radio Interview: Extend Network Access Protection Using Microsoft System Center Configuration Manager

JeffSigman — Tue, 22 Apr 2008 20:54:00 GMT

While I was down in San Francisco for RSA a couple weeks ago a buddy of mine, Jeff Wettlaufer, interviewed me on the show floor to find out what was going on at the show and discuss NAP + SCCM. We adlibbed over 90% of it (I don’t believe in scripts). Hope you enjoy!

April 22, 2008

Extend Network Access Protection Using Microsoft System Center Configuration Manager

Learn how Microsoft System Center Configuration Manager can extend the capabilities of the Network Access Protection (NAP) feature in Windows Server 2008. Jeff Wettlaufer, System Center technical product manager, interviews Jeff Sigman, senior program manager for NAP, in this episode of TechNet Radio

Length: 0: 34:30

WMA | MP3 High | MP3 Low
To save to your computer, right click and choose 'save target as…'.

Participants

Eric Ostrowski
Your Show Host and TechNet Radio Producer

Jeff Wettlaufer
Sr. Technical Product Manager - System Center

Jeff Sigman
Senior Program Manager - NAP

A shout out to Eric & JeffW for making this happen. Thanks guys!

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

Gotchas, FAQs, Best Practices, and Tips for Implementing NAP in Configuration Manager (SCCM + NAP)

MS NAP Team — Mon, 21 Apr 2008 23:41:00 GMT

My previous guest post walked you through what was happening in the background with Configuration Manager NAP when a noncompliant computer connected to the network, and was restricted and remediated for a software update. This post follows up with some gotchas, FAQs, best practices, and tips for implementing NAP in Configuration Manager.

I’m Carol Bailey, Senior Technical Writer for System Center Configuration Manager 2007 (formally SMS 2003), and I’m involved with many of the security-related features in Configuration Manager – including Internet-based client management, desired configuration management, ….. and Network Access Protection (NAP).

Gotchas:

The prereqs. Of particular note for NAP, you must extend the Active Directory schema for Configuration Manager 2007: Prerequisites for Network Access Protection.
Remediation in Configuration Manager does not include installing the Configuration Manager client (SCCM SHA) if it is not installed. If the policies on the NAP health policy server (NPS) include the Configuration Manager System Health Validator (SCCM SHV) and do not exclude computers that do not have the Configuration Manager client (SCCM SHA) installed, the computer will be deemed noncompliant and cannot be automatically remediated. In the Network Access Protection dialog box, you’ll see “SHA Not Present” with ID 79745. In this scenario, either configure exemption policies for computers that should not have the Configuration Manager client (SCCM SHA) installed, or provide a method of manually installing the client that works when the computer is on the restricted network.
Until you enable the Network Access Protection client agent (aka NAPAgent; not enabled by default), the Policies node under the Network Access Protection node in the Configuration Manager console does not display, and neither does the NAP Evaluation tab in the software update, or the NAP option in the Deploy Software Update Wizard.
If the NAP health policy server (NPS) allows full network access (“reporting mode”), Configuration Manager will not remediate on the unrestricted network. This facility is supported through standard Configuration Manager software updates. Additionally, if the NAP health policy server (NPS) is enforcing health policies, Configuration Manager will always remediate noncompliant computers, even if the option on the NAP health policy server Enable auto-remediation of client computers is not enabled. For more information, see About Network Access Protection Remediation and Configuring Network Policies for Configuration Manager Network Access Protection.
Unlike software update deployments, NAP policies in Configuration Manager are not targeted to collections – they are automatically targeted to all clients assigned to the site.
Like other objects that are created in a Configuration Manager hierarchy, NAP policies flow down the hierarchy. However, unlike other objects, child sites cannot create their own NAP policies. For more information: About Network Access Protection in Configuration Manager Hierarchies.
Do not expect NAP in Configuration Manager to offer real-time enforcement. While NAP helps keep computers compliant over the long run, enforcement delays might be several hours or more due to a variety of factors, including the settings of various configuration parameters. However, you can minimize these delays if you have a zero-day exploit situation (see How to Configure a Configuration Manager NAP Policy for a Zero-Day Exploit in Network Access Protection).

FAQs:

Q: Does NAP in Configuration Manager require you to be running Windows Server 2008 on the servers?

A: No, only the server with the Network Policy Server (NPS) role and configured as a NAP health policy server must be running Windows Server 2008. This is the server onto which you install the Configuration Manager System Health Validator (SCCM SHV) point.

Q: I’m using DHCP and VPN enforcement. Which servers need to be added to the Remediation Server Group on the Network Policy Server (NPS)?

A: The Configuration Manager remediation servers (management point, software update point, and distribution points) are automatically added to the Remediation Server Group – there is no need to manually add them. However, you will still need to add servers that provide infrastructure services, such as DNS servers and domain controllers. More information: Configuring Remediation Server Groups for Configuration Manager Network Access Protection.

Q: Why is the Configure button not available for the Configuration Manager System Health Validator (SCCM SHV) on the Network Policy Server (NPS)?

A: With the exception of mapping error conditions to compliant or noncompliant, configuration for the Configuration Manager System Health Validator (SCCM SHV) is done through the Configuration Manager console, by configuring the properties of the System Health Validator Point Component Properties. To help you understand these configuration options and the consequences of changing the default values, use the F1 help: System Health Validator Point Component Properties.

Q: How do you configure NAP for a cross-forest scenario?

A: See About Network Access Protection and Multiple Active Directory Forests. As with all Configuration Manager site system servers, the Configuration Manager System Health Validator (SCCM SHV) must reside on a member server; it is not supported in a workgroup environment. However, it can be installed in a different forest than the site server’s forest.

Q: Do you have a step-by-step or checklist for configuring NAP in Configuration Manager?

A: See Administrator Checklist: Configure Network Access Protection for Configuration Manager and you might also find the following useful: Example Scenarios for Implementing Network Access Protection in Configuration Manager.

Q: Why is my Configuration Manager client going into restriction when it has all the software updates that are configured for NAP?

A: The Configuration Manager System Health Validator (SCCM SHV) makes a number of checks for compliance. A client might be noncompliant because it hasn’t downloaded the latest policies; its statement of health has expired; or it’s from an unknown site. For more information, see About Compliance for Network Access Protection in Configuration Manager.

Q: I’ve heard that the Configuration Manager client might use a cached statement of health (SoH) rather than performing a fresh evaluation when it is asked for its health state – what’s going on here?

A: There are several scenarios under which the client can use a cached statement of health (SoH). Using a cached statement of health results in faster connections, but the NAP evaluation information might be out of date. For more information, see About the Statement of Health (SoH) in Network Access Protection and NAP Evaluation Conditions for Configuration Manager Clients.

Q: I’m testing NAP in Configuration Manager, and clients have full network access when they should be restricted. How can I troubleshoot this?

A: There are multiple possible reasons for this scenario. Check Computers Have Full Network Access When They Should Not Using Network Access Protection.

Q: I’m testing NAP in Configuration Manager, and clients are failing to remediate. How can I troubleshoot this?

A: There are multiple possible reasons for this scenario. Check Client Fails to Successfully Remediate with Network Access Protection.

Q: What log files are specific to Configuration Manager NAP?

A: See Log Files for Network Access Protection.

Best Practices:

For a complete list, see Best Practices for Network Access Protection and Network Access Protection Security Best Practices:

· Confirm the successful installation of software updates on the unrestricted network using the software updates feature in Configuration Manager before configuring software updates for Network Access Protection (NAP).

· Test average remediation times to set expectations.

· Educate users in advance to encourage them to install software updates before the NAP effective date.

· Do not install the WSUS system health agent on a computer that has the Configuration Manager client installed with the Network Access Protection client agent enabled.

Tips:

Factor in early the collaboration that will needed between different groups and define the processes that will be used for a smooth transfer of responsibilities. Probably more than any other feature in Configuration Manager, NAP requires careful coordination with multiple teams. For a list of the different roles and processes that might be involved, see Determine Administrator Roles and Processes for Network Access Protection.
Be prepared for the political consequences of restricting network access. In the heat of the moment it can be difficult to justify this preventative action when it impacts short term business continuity. For examples of how implementing Network Access Protection can affect users in their working environment, see Example Scenarios for Implementing Network Access Protection in Configuration Manager.
Installing software updates can result in requiring a reboot, which is enforced when remediating on the restricted network. If this is unacceptable in your working environment, consider enforcing compliance on the full network for a limited time (deferred enforcement) – in this scenario the reboot is requested but not enforced until the grace period ends. For more information, see the section “Remediation Restarts and Retries” in About Network Access Protection Remediation and the flowchart Enforced Compliance with Network Access Protection in Configuration Manager.
Download and take the Network Access Protection quiz (available as one of the Configuration Manager quizzes). It’s fun, informative, and checks that you’re in good shape to start implementing NAP in Configuration Manager. (Hint, many of the answers are in this post!).

If you have any questions or feedback about the documentation for Configuration Manager NAP, you can e-mail me (Carol.Bailey@Microsoft.com) or my documentation team (SMSDocs@Microsoft.com).

- Carol

This posting is provided AS IS with no warranties and confers no rights.

The Low Down on Configuration Manager NAP Remediation (SCCM + NAP)

MS NAP Team — Mon, 21 Apr 2008 23:40:00 GMT

NAP was always one of the principal new features for Configuration Manager, and I’ve been with the Configuration Manager NAP feature team right from Beta 1, over three years ago now. I’ve seen it through from specs, to test passes, TAP exit criteria, Dogfooding, and to its implementation on the MS IT network. It’s really exciting to know that with the release of Windows Server 2008, it’s now fully supported on customer production networks. Despite Configuration Manager being released in August last year, we couldn’t fully support our NAP feature when the dependent operating system wasn’t yet released.

Because of my involvement with Configuration Manager NAP, I was asked to attend the RSA Conference in San Francisco to help with the expo booths that were running NAP demos. We had demos that showed a noncompliant computer being restricted and remediated for a software update, Windows security settings, and the Forefront services. You can watch a similar demo, with callouts: NAP clickthrough

This demo shows the user experience of NAP, and the administrator interface for the configuration piece, but what’s really going on under the hood? This post gives you the technical low down of how NAP works in Configuration Manager.

But before we look at what’s happening when the noncompliant computer connects to the network, we need to step back to see what’s in place to ensure that noncompliance is reported and remediation is possible (NAP setup). Then we can work through how NAP compliance is evaluated and how NAP remediation works.

As a prerequisite for NAP in Configuration Manager, the administrator has performed the followed actions:

Extended the Active Directory schema for Configuration Manager 2007; created the System Management container and configured the required permissions; installed a Configuration Manager site and configured it to publish to Active Directory Domain Services.
Deployed Configuration Manager clients and assigned them to the site.
Configured the software updates feature, and downloaded software updates that will be enabled for NAP evaluation.
Enabled the Network Access Protection client agent and ensured that clients can support NAP – either natively by using Windows Vista, or by deploying the Network Access Protection client to computers running Windows XP (available in XP SP3).
Installed the System Health Validator (SCCM SHV) point on a Windows Server 2008 computer that is configured as a NAP health policy server (NPS), and on this server policies are configured to restrict network access if the Configuration Manager client is noncompliant.
Verified the underlying NAP infrastructure is working by ensuring that a NAP client with the Windows firewall disabled is restricted and remediated by the Windows NAP health policy server.

Note: There a number of configuration options available when configuring a site for Network Access Protection, but here we will assume that all defaults are used. There’s more information about the configuration options in the Configuration Manager documentation library: Configuring Network Access Protection.

NAP Setup:

The administrator enables the Configuration Manager Network Access Protection client agent (SCCM SHA). This triggers two actions: the first is to include a Network Access Protection policy within the Configuration Manager client’s policy, which the client downloads on a schedule. This instruction tells the client that if any software updates are marked for NAP evaluation, it must assess its compliance. It also includes a health state reference, which acts like a timestamp (it is actually a sequential string of numbers rather than based on any time value). The second action is for the site server to publish the same health state reference to Active Directory Domain Services, as an attribute of the site object.
This health state reference in Active Directory Domain Services is retrieved by the System Health Validator (SCCM SHV) point when it first starts, and on a regular basis. It is used as part of the validation process, as we will see later. This health state reference means that the System Health Validator (SCCM SHV) point never directly communicates with the site server, which allows for cross-forest implementation.
The administrator configures a software update to be included in NAP evaluation. There are multiple ways to achieve this, but one method is to run the New Policies wizard from under the Network Access Protection node. From the wizard, you can select the software updates that you want to be included in NAP evaluation, and configure the effective date – when you want the compliance evaluation of the software update to begin. Configuring a software update for NAP results in creating a Configuration Manager NAP policy in the console (visible in the Policies node), and enables a property of the software update. For more information about how to configure a software update for NAP evaluation, see How to Create a Configuration Manager NAP Policy for Network Access Protection.
Although each software update that is enabled for NAP evaluation creates a new Configuration Manager NAP policy in the console, in the background there is actually only one NAP policy for the site (the one that was created when the Network Access Protection client agent was enabled), and each software update configured for NAP evaluation is added to it. Every time this policy is modified, the health state reference is incremented to denote the change – in both the policy and Active Directory Domain Services.

NAP compliance is evaluated, and remediation is initiated when needed:

Taking the scenario in the demo where the laptop has been off the network for a period of time, missed the deployment of the software update that is now configured for NAP, and the effective date is due:

The computer connects to the network and is asked for its statement of health. The Configuration Manager Network Access Protection client agent (SCCM SHA) evaluates its compliance according to the client policy that it downloaded some time ago. This doesn’t include the software update that the administrator has now configured for NAP evaluation, so it doesn’t know at this point that it’s not compliant. It sends its compliance information to the Configuration Manager System Health Validator (SCCM SHV), which includes its compliance status of compliant, its site code, and the health state reference.
The System Health Validator (SCCM SHV) point receives the client’s statement of health and runs through its validation checks – it doesn’t just take the client’s word for it that it is compliant. When it gets to the check for the health state reference, it compares the client’s health state reference to the one that it downloaded from Active Directory Domain Services, for the client’s site. They don’t match – the client’s health state reference is older, so it knows that the compliance information is out of date. At this point it tells the client and the NAP heath policy server that the computer is noncompliant.
According to the policies on the NAP health policy server (NPS), the client is restricted and remediation is called.
Remediation in this case is to download the latest client policy from the client’s management point, which includes the new software update configured for NAP evaluation. The client re-evaluates its compliance, and this time sends a statement of health (SoH) with a current health state reference but a compliance status of noncompliant.
The Configuration Manager System Health Validator (SCCM SHV) again runs through its checks, and this time the health state reference check passes – so the client’s compliance status is validated. However, because the client is noncompliant with the software update, the System Health Validator (SCCM SHV) again sends a noncompliant status to the client and to the NAP health policy server. This time however, remediation involves downloading and installing the software update.
After the client has installed the software update, it re-evaluates its compliance once again and sends the results in the statement of health. This time the health state reference is current and the compliance status is compliant. The Configuration Manager System Health Validator (SCCM SHV) returns a compliant status to the client and the NAP health policy server (NPS) – and according to the policies configured on the NAP health policy server (NPS), the client has full network access.

There are other checks that the Configuration Manager System Health Validator (SCCM SHV) performs in addition to the health state reference and the compliance status. For more information, see About System Health Validator Points in Network Access Protection.

In my next post, I’ll highlight some gotchas, FAQs, best practices, and tips for implementing NAP in Configuration Manager.

The documentation for Configuration Manager NAP can be found in the feature section of the Configuration Manager documentation library: Network Access Protection in Configuration Manager. Related to the information in this post, you might find the following useful:

Background information

Overview of Network Access Protection

About the Statement of Health (SoH) in Network Access Protection

About NAP Health State References in Network Access Protection

About Network Access Protection Remediation

Verification tasks

How to Verify Client Statements of Health for Network Access Protection

How to Verify Clients are Going into Remediation with Network Access Protection

Flowcharts

System Health Validator Point: Validation Process for Network Access Protection

SoH Response to Non-Compliant Configuration Manager Client with Network Access Protection

If you have any questions or feedback about the documentation for Configuration Manager NAP, you can e-mail me (Carol.Bailey@Microsoft.com) or my documentation team (SMSDocs@Microsoft.com).

- Carol

This posting is provided AS IS with no warranties and confers no rights.

System Center (SCCM 2007) + NAP

MS NAP Team — Fri, 08 Feb 2008 03:32:00 GMT

My buddy Jeff Wettlaufer wrote an awesome post about the NAP integration with System Center 2007. Please check it out here.

Jeff Sigman
Senior Program Manager
Network Access Protection (NAP)

Please check out the NAP Blog, FAQ, Forum, MSDN and Site.

NAP + System Center Configuration Manager = Better Together

MS NAP Team — Mon, 15 Oct 2007 09:27:00 GMT

Ever hear of a little product called SMS? Well, the latest version (System Center Configuration Manager 2007 or SCCM) has just RTM’d and is about to launch. Next month I am flying over to Barcelona for the huge TechEd / IT Forum event to tell Europe about NAP (in case they haven’t heard). This also happens to be where Microsoft is launching SCCM 2007 to the world.

The NAP team and the SCCM team are a rock throw away from each other on the Microsoft campus. Since we were so close (joke :->) we decided to integrate our products! Woohoo! You can enforce, remediate and all the other cool jazz that NAP provides using SCCM 2007! Not too shabby.

I found an amazing SCCM/NAP TechNet site which breaks it down for you, but here is our integration in brief:

· Enforce compliance of software updates as part of a phased deployment. When you have a small number of computers that have failed to install current software updates through standard mechanisms by a target date, you can use Network Access Protection policies in Configuration Manager with an effective date to configure enforced compliance for these few computers.

· Enforce compliance of software updates as part of an expedited deployment. When you have computers that must urgently install one or more critical software updates (for example, to address a zero-day exploit), you can use Network Access Protection policies in Configuration Manager that are configured to be effective as soon as possible.

Man, I am super excited about the coming year for NAP. All eyes are on February 27^th, 2008 - when we launch Windows Server 2008 in Los Angeles. That’s going to be some party, can’t wait!

NAP the WORLD,

Jeff Sigman
Senior Program Manager
Network Access Protection (NAP)

NAP Blog
NAP Forum
NAP Site

This posting is provided "AS IS" with no warranties, and confers no rights.