Network Access Protection (NAP) : WSHA/WSHV

SHV Multi-Config in Windows Server 2008 R2

MS NAP Team — Thu, 02 Apr 2009 00:14:00 GMT

In Windows Server 2008, a system health validator (SHV) installed on the NPS server can be configured in a single way. This works well if your system health requirements are the same for all of your NAP enforcement methods and all of your computers. However, some deployments require different sets of health requirements for different enforcement methods and different groups of computers. For example, you might want to specify that desktop computers must have their anti-virus software enabled and VPN-connected computers must have their anti-virus software enabled and signature file up-to-date.

In Windows Server 2008 R2, the NAP platform supports SHVs in multiple configurations to support these more advanced configurations, a feature known as SHV multi-config. Existing SHVs must be updated to take advantage of this new feature and new SHVs should be written to use this feature. The Windows Security Health Validator (WSHV) provided with Windows Server 2008 R2 supports SHV multi-config. For more information, see the new INapComponentConfig3 API at http://msdn.microsoft.com/en-us/library/dd392506(VS.85).aspx.

To see the SHV multi-config support for the WSHV, use the Network Policy Server snap-in and open Network Access Protection-System Health Validators-Windows System Health Validator-Settings. The following figure shows an example.

For a larger version of this figure, click here.

There is a default configuration that you can configure if you only need a single configuration of the WSHV settings. This default configuration cannot be deleted or renamed. When you create health requirement policies with the NAP wizard, it will configure your health policies to use this default configuration.

To create another configuration for the WSHV, do the following:

1. Right-click Settings, and then click New.

2. In the Configuration Friendly Name dialog box, type a name for the new configuration, and then click OK.

3. In the Windows Security Health Validator dialog box, specify the system health requirements and then click OK.

The following figure shows an example of a new WSHV configuration with the name WSHV Settings for DHCP.

For a larger version of this figure, click here.

To specify the use of a non-default configuration for the WSHV in the Network Policy Server snap-in, open Policies-Health Policies, and then double-click the name of the health policy that you want to modify. On the Settings tab, in the SHVs used in this health policy list, click the drop-down arrow in the Setting column for the Windows Security Health Validator SHV to see a list of configurations. The following figure shows an example.

Click the desired configuration of the WSHV, and then click OK.

NAP Product Team

"How Windows Update Client and NAP Client View Important Updates" post

MS NAP Team — Thu, 13 Nov 2008 03:02:00 GMT

In a previous blog entry, I talked about the very cool blog written by the Microsoft Enterprise Networking Team in Customer Service and Support (CSS).

Louis Hardy, a Senior Support Escalation Engineer and member of a virtual team of CSS engineers that specialize in NAP, recently published the following post in the Enterprise Networking Team blog:

How Windows Update Client and NAP Client View Important Updates

In this post, Louis describes how the Windows Security Health Validator (WSHV) behaves with respect to important updates and a best-practice client configuration to avoid confusion.

Thanks Louis!

Joe Davies

Windows Security Health Agent (WSHA) and Windows Security Health Validator (WSHV) - Update

MS NAP Team — Mon, 06 Oct 2008 19:04:00 GMT

We have had several questions lately about the WSHA/WSHV so we figured it was time to provide an update to what we previously posted last year.

The WSHA is the SHA delivered with Windows Vista and Windows XP SP3. The WSHV is the SHV delivered with Windows Server 2008. They provide the ability to make network access decisions based on the following criteria:

· Firewall is enabled

· Antivirus is enabled and up-to-date

· Antispyware is enabled and up-to-date

· Automatic Updates is enabled

· Security updates are up-to-date

Firewall, antivirus, and antispyware detection is available for both Microsoft and non-Microsoft applications. The WSHA detects any application that reports its status through Windows Security Center.

The WSHA will perform automatic remediation as follows, regardless of which firewall, antivirus, and antispyware products are present on the client:

· Firewall turned off: Turn on Windows Firewall

· Antivirus off or out of date: No automatic remediation is available

· Antispyware off or out of date: Turn on and update Windows Defender

The WSHA/WSHV also detects security update status and can remediate with Windows Server Update Services (WSUS), Windows Update, and Microsoft Update. This is discussed in more detail in a previous blog posting.

More information about the WSHA and WSHV can be found at http://technet.microsoft.com/en-us/library/cc731260.aspx.

Mike Burk
WSHA/WSHV Program Manager