This tip was submitted to the SearchWin2000.com Tip Exchange by member Martin Baker. Let other users know how useful it is by rating the tip below.
If you have non-production machines connected to your LAN, you can lock them out by using IPSec authentication header.
I was recently employed by a client to try and find a way to stop their developers from connecting to their production LAN. They had just deployed a 10,000 seat Win2k environment and fully standardized on server and client builds. The new environment is very tightly controlled with proper procedures (change management, etc.) for everything. They have very tight group policy control on desktops as well. So, they just deployed a nice shiny new environment and had full control -- or so they thought!
They found that their developers could still connect to their production
environment with their "non-standard" PCs. Developers had autonomy to install whatever OS they wanted on their PCs in order to simulate their client's environments for full product testing. The IT team were worried about viruses and access control, among many other concerns. So how could the client's IT team stop these non-production machines from accessing production servers?
The answer was IPSec. We locked them out from a whole range of servers by using IPSec -- authentication header. You can't install IPSec on a Windows 2000 domain controller, but that wasn't too much of an issue since the domain controllers were dedicated controllers, and had no file/print sharing or other services.
To save overhead on the network and servers we didn't configure encryption -- we just used the authentication feature of IPSec.
So, install & configure IPSec on the servers you want to protect, but be careful not to include domain controllers -- and don't configure encryption to save the overhead.
Click here for more information.
