Network Access Protection (NAP) : SHAs and SHVs

See NAP at TechEd 2009

MS NAP Team — Tue, 12 May 2009 03:53:00 GMT

Hey NAP Fans!

If you are attending TechEd 2009 in Los Angeles this week, be sure to stop by the NAP booth in the Microsoft Technical Learning Center (TLC). It is a great opportunity to meet and speak with NAP team members and learn about some of the enhancements and new scenarios in Windows® 7 and Windows® Server 2008 R2.

Also there are at least two breakout sessions that would be useful for anyone interested in learning more about NAP deployments. Both are on Friday May 15th:

WSV206 Windows Clients and Windows Server 2008 NAP: Why They Are Better Together

Presenter: Jay Ferron

Fri 5/15 | 9:00 AM-10:15 AM | Room 502A

WSV305 Deploying NAP: Best Practices and Lessons Learned

Presenters: Venkatesh Gopalakrishnan, Lambert Green

Fri 5/15 | 2:45 PM-4:00 PM | Room 403B

Hope to see you there,

The NAP Team

SHV Multi-Config in Windows Server 2008 R2

MS NAP Team — Thu, 02 Apr 2009 00:14:00 GMT

In Windows Server 2008, a system health validator (SHV) installed on the NPS server can be configured in a single way. This works well if your system health requirements are the same for all of your NAP enforcement methods and all of your computers. However, some deployments require different sets of health requirements for different enforcement methods and different groups of computers. For example, you might want to specify that desktop computers must have their anti-virus software enabled and VPN-connected computers must have their anti-virus software enabled and signature file up-to-date.

In Windows Server 2008 R2, the NAP platform supports SHVs in multiple configurations to support these more advanced configurations, a feature known as SHV multi-config. Existing SHVs must be updated to take advantage of this new feature and new SHVs should be written to use this feature. The Windows Security Health Validator (WSHV) provided with Windows Server 2008 R2 supports SHV multi-config. For more information, see the new INapComponentConfig3 API at http://msdn.microsoft.com/en-us/library/dd392506(VS.85).aspx.

To see the SHV multi-config support for the WSHV, use the Network Policy Server snap-in and open Network Access Protection-System Health Validators-Windows System Health Validator-Settings. The following figure shows an example.

For a larger version of this figure, click here.

There is a default configuration that you can configure if you only need a single configuration of the WSHV settings. This default configuration cannot be deleted or renamed. When you create health requirement policies with the NAP wizard, it will configure your health policies to use this default configuration.

To create another configuration for the WSHV, do the following:

1. Right-click Settings, and then click New.

2. In the Configuration Friendly Name dialog box, type a name for the new configuration, and then click OK.

3. In the Windows Security Health Validator dialog box, specify the system health requirements and then click OK.

The following figure shows an example of a new WSHV configuration with the name WSHV Settings for DHCP.

For a larger version of this figure, click here.

To specify the use of a non-default configuration for the WSHV in the Network Policy Server snap-in, open Policies-Health Policies, and then double-click the name of the health policy that you want to modify. On the Settings tab, in the SHVs used in this health policy list, click the drop-down arrow in the Setting column for the Windows Security Health Validator SHV to see a list of configurations. The following figure shows an example.

Click the desired configuration of the WSHV, and then click OK.

NAP Product Team

Five Ways to Draw More Value from Microsoft NAP Deployments

MS NAP Team — Wed, 07 Jan 2009 03:07:00 GMT

Here is a guest posting from our NAP Partner Avenda Systems.

When the founders of Avenda Systems decided to build a Policy Platform, one of the first stops included Microsoft. NAP was in the works and discussions with other industry experts led us to embrace the idea of creating a product or products that truly allowed for adding value to the NAP platform.

Early discussions with Microsoft centered on the development of extensible NAP agents for the support of Windows and Vista operating systems, as well as delivering agents for client operating systems other than Windows. The plan was to provide supplemental value to allow organizations to easily deploy NAP in heterogeneous operating system environments and take advantage of NAP’s robust endpoint health policy architecture.

Here are five ways that you can get value from the combination of NAP and products from Avenda Systems:

1. No other Policy Server required

The use of Avenda’s eAgents lets organizations use the resources they have already deployed to support NAP. All three functions of Windows Server 2008, Network Policy Server (NPS)—RADIUS server, RADIUS proxy, and NAP health policy server—are leveraged across all access methods, including wireless, wired, and VPNs.

At some point the need to support managed and unmanaged devices in a NAP environment may warrant the use of a complimentary platform, but the addition of intermediary policy servers should not be required when investigating NAP Partner solutions.

2. Extended control beyond Windows Security Center checks
When using the Windows Security Health Validator (WSHV), policy validation checks are performed to verify the existence and status (running or not) of the following; Firewall, Anti-Virus Protection, Spyware Protection, Automatic Updating, and Security Update Protection. Based on a client’s response, a noncompliant result can cause the client to be put into a restricted network until the condition has been corrected. For example, if a client has turned off Anti-Virus for some reason, they will not be allowed full network access until the Anti-Virus software has been turned on again.

When using Avenda’s Universal System Health Agent (USHA) and Universal System Health Validator (USHV), administrators gain the ability to create fine-grained policies that extend beyond the verification of the status of the applications and services described above. In addition, the client can be requested to provide version numbers, DAT file and engine revisions and the time the last scan was performed, and automatic remediation can be performed for Anti-Virus and Anti-Spyware applications. The Avenda SHV can also be configured to check for and will start or stop certain services and applications that match specified registry values. For example, clients that have Skype installed can be restricted (as detected by registry values). Once on the network, if Skype is installed again, the next health evaluation can restrict the client.

As the adoption of Windows Server 2008 increases, inquiries regarding our eAgents has really picked up. Customers are attracted to the expanse of additional functionality and our ability to quickly integrate new features. Additional features such as server-side policy checks for latest versions and updates of anti-malware products and data files are available as a portal service from Avenda.

3. Supported Operating Systems
Avenda’s eAgents are available for Windows Vista, Windows XP with Service Pack 3, and Windows Server 2008. In addition, we also have a Linux NAP Agent (with 802.1X enforcement) and a Macintosh NAP Agent is in the works.

4. Dissolvable Agents
Many organizations allow guest and partner access and a common concern has been how to treat unmanaged clients (either lacking or have misconfigured supplicants) that attempt to connect to the network. The addition of Avenda’s eTIPS Policy Server, which interacts with Microsoft NPS, supports this requirement. A fully NAP SoH protocol-compliant dissolvable agent (a Java applet), in simple terms, performs Web authentication and health checks through a captive portal.

For transient users, policies can also determine what level of access is allowed, for what length of time and on which days of the week.

5. Avenda’s competitive advantage

When deploying eAgents in a network (especially for educational institutions, companies that are merging, call centers, etc.), it is important for the agent to support and expect to encounter anti-malware products from multiple vendors. Avenda’s eAgents ship with support for all major anti-malware vendors.

"Nortel and Microsoft Discuss Network Access Control" Webcast now available

MS NAP Team — Fri, 21 Nov 2008 04:01:00 GMT

Greetings practitioners of NAPinetics!

The "Nortel and Microsoft Discuss Network Access Control" Webcast that I recorded with Matt Oshida and Terry Singleton of Nortel is now available for viewing at:

http://www2.nortel.com/go/events_detail.jsp?cat_id=-8005&oid=100247172&block=8&locale=en-US

Click "View the Webcast".

Thanks to Matt and Terry for letting me participate. I gave an overview of NAP and NAP architecture to pave the way for a detailed explanation of the combined Nortel and NAP integration architecture.

Enjoy!

Joe Davies
Program Manager

Windows Security Health Agent (WSHA) and Windows Security Health Validator (WSHV) - Update

MS NAP Team — Mon, 06 Oct 2008 19:04:00 GMT

We have had several questions lately about the WSHA/WSHV so we figured it was time to provide an update to what we previously posted last year.

The WSHA is the SHA delivered with Windows Vista and Windows XP SP3. The WSHV is the SHV delivered with Windows Server 2008. They provide the ability to make network access decisions based on the following criteria:

· Firewall is enabled

· Antivirus is enabled and up-to-date

· Antispyware is enabled and up-to-date

· Automatic Updates is enabled

· Security updates are up-to-date

Firewall, antivirus, and antispyware detection is available for both Microsoft and non-Microsoft applications. The WSHA detects any application that reports its status through Windows Security Center.

The WSHA will perform automatic remediation as follows, regardless of which firewall, antivirus, and antispyware products are present on the client:

· Firewall turned off: Turn on Windows Firewall

· Antivirus off or out of date: No automatic remediation is available

· Antispyware off or out of date: Turn on and update Windows Defender

The WSHA/WSHV also detects security update status and can remediate with Windows Server Update Services (WSUS), Windows Update, and Microsoft Update. This is discussed in more detail in a previous blog posting.

More information about the WSHA and WSHV can be found at http://technet.microsoft.com/en-us/library/cc731260.aspx.

Mike Burk
WSHA/WSHV Program Manager

System Health Agents (SHAs) and System Health Validators (SHVs) that are available from NAP partners

MS NAP Team — Tue, 30 Sep 2008 23:21:00 GMT

In my previous blog post, System Health Agents (SHAs) that are available from Microsoft, I described the SHAs (and their corresponding system health validators [SHVs]) that you can use with Windows Security Center in Windows Vista and Windows XP with Service Pack 3, Microsoft System Center Configuration Manager (SCCM), and Microsoft Forefront Client Security (FCS).

Here is the list of SHAs and SHVs that are available from NAP partners (as of 10/6/08).

Partner	Product	Status	Links
Avenda Systems	Windows Universal SHA/SHV	Shipping	Location Datasheet
Blue Ridge Networks	Secure EdgeGuard, which includes an EdgeGuard SHA and SHV	Shipping	Location
Computer Associates	CA Threat Manager r8.1, which includes an eTrust SHA and SHV	Shipping	Location Press Release
Kaspersky Lab	Kaspersky Administration Kit 7.0, which includes a Kaspersky Lab SHA and SHV	In Beta testing	Location Press Release
McAfee	McAfee Network Access Control (MNAC) 3.0, which includes a McAfee SHA and SHV	Shipping	Location
Nortel	Nortel Secure Network Access (SNA), which includes an SNA SHA and SHV	Shipping	Location More Information
Symantec	Symantec Network Access Control 11.0, which includes a SHA and SHV for Symantec NAC	Shipping	Location
UNETsystem	UNET SHA, which includes a UNET SHA and SHV	Shipping	Location

The momentum is building…

Enjoy!

Joe Davies
Senior Program Manager

System Health Agents (SHAs) that are available from Microsoft

MS NAP Team — Thu, 04 Sep 2008 01:16:00 GMT

Greetings, fellow disciples of NAP!

Here is a summary of the different system health agents (SHAs) that are currently available from Microsoft.

Note: The following text was shamelessly “leveraged” from our own Greg Lindsay’s upcoming Network Access Protection Design Guide. Thanks Greg!

Microsoft provides the following SHAs for the NAP platform:

· Windows Security Health Agent (WSHA)

· System Center Configuration Manager SHA (SCCM SHA)

· Forefront Client Security SHA (FCS SHA)

For the SHAs available from our NAP partners, click here.

Note Each of these SHAs has a corresponding system health validator (SHV).

Windows Security Health Agent (WSHA)

The WSHA is included with Windows Vista and Windows XP with Service Pack 3 and monitors the operational status of the Windows Security Center (WSC) on NAP client computers. The WSHA monitors the following:

· Firewall: If required, the NAP client must have a firewall enabled for all network connections.

· Virus Protection: If required, the NAP client computer must have an antivirus application installed, registered with WSC, and turned on. The NAP client can also be required to have an up-to-date antivirus signature file installed.

· Spyware Protection: If required, the NAP client must have an antispyware application installed, registered with WSC, and turned on. The NAP client can also be required to have an up-to-date antispyware signature file installed. Spyware protection only applies to NAP clients running Windows Vista.

· Automatic Updating: If required, the NAP client must be configured to check for updates from Windows Update. You can also require the NAP client to automatically download and install updates.

· Security Update Protection: If required, the NAP client must have security updates installed based on one of four possible values that match security severity ratings from the Microsoft Security Response Center (MSRC). You can also specify the use of Windows Server Update Services (WSUS) or Windows Update to obtain security updates.

Common point of confusion: The capability of the NAP platform is sometimes equated to the capability of the WSHA and if there is a system health check that is not supported by WSHA, then the NAP platform cannot support it. This is, of course, not correct, and is most likely based on an oversimplification of NAP functionality that is included with Windows. However, just like Windows includes basic functionality for drawing (the Paint program) and supports much more capable drawing programs (such as Adobe Illustrator), NAP is a platform that allows any kind of system health check through the installation of additional SHAs, which can be developed using the NAP APIs. Additional SHAs can verify all kinds of things, from contacting an intrusion detection system (IDS) to ensure that your computer is not performing an address scan on the intranet (an IDS SHA) to automatically calling your Aunt Brenda to make sure that she is wearing her sweaters around the house because it is starting to get cold (the AB SHA :>).

System Center Configuration Manager SHA (SCCM SHA)

The SCCM SHA monitors a NAP client computer for compliance with required software updates that you specify. When a computer connects to the network, the SCCM SHA provides the current state of compliance, a site code, and a health state reference. The health state reference and site code are used to check whether or not a client computer has received the latest software update requirements from a Microsoft Systems Management Server (SMS) management point. If the health state is determined to be out of date, the client computer downloads a new set of requirements and health is evaluated again.

When you deploy a software update with SCCM, you can select the update for NAP evaluation and specify a date and time when the policy will become effective. Only those updates that have been enabled for NAP evaluation in the Configuration Manager console are required to be installed on compliant NAP clients.

For more information about SCCM and NAP, see Network Access Protection in Configuration Manager.

Forefront Client Security SHA (FCS SHA)

The FCS SHA monitors the operational health of FCS on the client computer. The administrator-defined health policy on the SHV determines whether the client computer is compliant before it is allowed to access the network. To monitor and report on FCS-related aspects of computer health, the FCS SHA queries NAP client registry settings, checks the status of system services, and verifies that the NAP client has the latest patches and malware signature definitions. The FCS SHA also sends data to the FCS server management system, which provides manageability, data collection, and reporting services.

The FCS SHA monitors the NAP client’s level of Forefront protection. Noncompliance with the FCS SHA does not necessarily mean that the computer has a virus or some other active threat, but that the FCS configuration is either incorrect or not up-to-date as defined in the health policy. The FCS SHA can restart services on noncompliant NAP clients, automatically update configuration settings, and install software updates if required.

For more information about the FCS SHA, see the Microsoft Forefront Integration Kit for Network Access Protection.

Joe Davies
Senior Program Manager

This posting is provided "AS IS" with no warranties, and confers no rights.