mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 10:23:37 +00:00
initial migration of Windows Firewall content
This commit is contained in:
Brian Lich
@ -405,6 +405,119 @@
|
||||
#### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md)
|
||||
#### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md)
|
||||
#### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md)
|
||||
### [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md)
|
||||
#### [Isolating Windows Store Apps on Your Network](isolating-windows-store-apps-on-your-network.md)
|
||||
#### [Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012](securing-end-to-end-ipsec-connections-by-using-ikev2-in-windows-server-2012.md)
|
||||
#### [Windows Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md)
|
||||
#### [Windows Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md)
|
||||
##### [Understanding the Windows Firewall with Advanced Security Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md)
|
||||
##### [Identifying Your Windows Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
|
||||
###### [Protect Computers from Unwanted Network Traffic](protect-computers-from-unwanted-network-traffic.md)
|
||||
###### [Restrict Access to Only Trusted Computers](restrict-access-to-only-trusted-computers.md)
|
||||
###### [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)
|
||||
###### [Restrict Access to Only Specified Users or Computers](restrict-access-to-only-specified-users-or-computers.md)
|
||||
##### [Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md)
|
||||
###### [Basic Firewall Policy Design](basic-firewall-policy-design.md)
|
||||
###### [Domain Isolation Policy Design](domain-isolation-policy-design.md)
|
||||
###### [Server Isolation Policy Design](server-isolation-policy-design.md)
|
||||
###### [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md)
|
||||
##### [Evaluating Windows Firewall with Advanced Security Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
||||
###### [Firewall Policy Design Example](firewall-policy-design-example.md)
|
||||
###### [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
|
||||
###### [Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
|
||||
###### [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md)
|
||||
##### [Designing a Windows Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md)
|
||||
###### [Gathering the Information You Need](gathering-the-information-you-need.md)
|
||||
####### [Gathering Information about Your Current Network Infrastructure](gathering-information-about-your-current-network-infrastructure.md)
|
||||
####### [Gathering Information about Your Active Directory Deployment](gathering-information-about-your-active-directory-deployment.md)
|
||||
####### [Gathering Information about Your Computers](gathering-information-about-your-computers.md)
|
||||
####### [Gathering Other Relevant Information](gathering-other-relevant-information.md)
|
||||
###### [Determining the Trusted State of Your Computers](determining-the-trusted-state-of-your-computers.md)
|
||||
##### [Planning Your Windows Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md)
|
||||
###### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md)
|
||||
###### [Planning Domain Isolation Zones](planning-domain-isolation-zones.md)
|
||||
####### [Exemption List](exemption-list.md)
|
||||
####### [Isolated Domain](isolated-domain.md)
|
||||
####### [Boundary Zone](boundary-zone.md)
|
||||
####### [Encryption Zone](encryption-zone.md)
|
||||
###### [Planning Server Isolation Zones](planning-server-isolation-zones.md)
|
||||
###### [Planning Certificate-based Authentication](planning-certificate-based-authentication.md)
|
||||
###### [Documenting the Zones](documenting-the-zones.md)
|
||||
###### [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md)
|
||||
####### [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md)
|
||||
####### [Planning Network Access Groups](planning-network-access-groups.md)
|
||||
####### [Planning the GPOs](planning-the-gpos.md)
|
||||
######## [Firewall GPOs](firewall-gpos.md)
|
||||
######### [GPO_DOMISO_Firewall](gpo-domiso-firewall.md)
|
||||
######## [Isolated Domain GPOs](isolated-domain-gpos.md)
|
||||
######### [GPO_DOMISO_IsolatedDomain_Clients](gpo-domiso-isolateddomain-clients.md)
|
||||
######### [GPO_DOMISO_IsolatedDomain_Servers](gpo-domiso-isolateddomain-servers.md)
|
||||
######## [Boundary Zone GPOs](boundary-zone-gpos.md)
|
||||
######### [GPO_DOMISO_Boundary_WS2008](gpo-domiso-boundary-ws2008.md)
|
||||
######## [Encryption Zone GPOs](encryption-zone-gpos.md)
|
||||
######### [GPO_DOMISO_Encryption_WS2008](gpo-domiso-encryption-ws2008.md)
|
||||
######## [Server Isolation GPOs](server-isolation-gpos.md)
|
||||
####### [Planning GPO Deployment](planning-gpo-deployment.md)
|
||||
##### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md)
|
||||
##### [Additional Resources [WFASDesign]](additional-resources-wfasdesign.md)
|
||||
#### [Windows Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md)
|
||||
##### [Planning to Deploy Windows Firewall with Advanced Security](planning-to-deploy-windows-firewall-with-advanced-security.md)
|
||||
##### [Implementing Your Windows Firewall with Advanced Security Design Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md)
|
||||
##### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
|
||||
##### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md)
|
||||
###### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md)
|
||||
###### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md)
|
||||
###### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md)
|
||||
##### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md)
|
||||
###### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md)
|
||||
###### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md)
|
||||
###### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md)
|
||||
###### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md)
|
||||
##### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md)
|
||||
###### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)
|
||||
###### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)
|
||||
##### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md)
|
||||
##### [Procedures Used in This Guide](procedures-used-in-this-guide.md)
|
||||
###### [Add Production Computers to the Membership Group for a Zone](add-production-computers-to-the-membership-group-for-a-zone.md)
|
||||
###### [Add Test Computers to the Membership Group for a Zone](add-test-computers-to-the-membership-group-for-a-zone.md)
|
||||
###### [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md)
|
||||
###### [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)
|
||||
###### [Configure Authentication Methods on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](configure-authentication-methods-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)
|
||||
###### [Configure Data Protection (Quick Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](configure-data-protection--quick-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)
|
||||
###### [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md)
|
||||
###### [Configure Key Exchange (Main Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](configure-key-exchange--main-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)
|
||||
###### [Configure the Rules to Require Encryption on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](configure-the-rules-to-require-encryption-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)
|
||||
###### [Configure the Windows Firewall Log](configure-the-windows-firewall-log.md)
|
||||
###### [Configure the Workstation Authentication Certificate Template[wfas_dep]](configure-the-workstation-authentication-certificate-templatewfas-dep.md)
|
||||
###### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md)
|
||||
###### [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md)
|
||||
###### [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)
|
||||
###### [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)
|
||||
###### [Create a Group Policy Object](create-a-group-policy-object.md)
|
||||
###### [Create an Authentication Exemption List Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](create-an-authentication-exemption-list-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)
|
||||
###### [Create an Authentication Request Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](create-an-authentication-request-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)
|
||||
###### [Create an Inbound ICMP Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](create-an-inbound-icmp-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
###### [Create an Inbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](create-an-inbound-port-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
###### [Create an Inbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](create-an-inbound-program-or-service-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
###### [Create an Outbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2](create-an-outbound-port-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
###### [Create an Outbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2](create-an-outbound-program-or-service-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
###### [Create Inbound Rules to Support RPC on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](create-inbound-rules-to-support-rpc-on-windows-8-windows-7--windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
###### [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md)
|
||||
###### [Enable Predefined Inbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](enable-predefined-inbound-rules-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
###### [Enable Predefined Outbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](enable-predefined-outbound-rules-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
###### [Exempt ICMP from Authentication on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](exempt-icmp-from-authentication-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)
|
||||
###### [Install Active Directory Certificate Services](install-active-directory-certificate-services.md)
|
||||
###### [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)
|
||||
###### [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)
|
||||
###### [Open the Group Policy Management Console to IP Security Policies](open-the-group-policy-management-console-to-ip-security-policies.md)
|
||||
###### [Open the Group Policy Management Console to Windows Firewall](open-the-group-policy-management-console-to-windows-firewall.md)
|
||||
###### [Open the Group Policy Management Console to Windows Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md)
|
||||
###### [Open Windows Firewall with Advanced Security](open-windows-firewall-with-advanced-security.md)
|
||||
###### [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)
|
||||
###### [Start a Command Prompt as an Administrator](start-a-command-prompt-as-an-administrator.md)
|
||||
###### [Turn on Windows Firewall and Configure Default Behavior](turn-on-windows-firewall-and-configure-default-behavior.md)
|
||||
###### [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)
|
||||
##### [Additional Resources[wfas_deploy]](additional-resourceswfas-deploy.md)
|
||||
## [Enterprise security guides](windows-10-enterprise-security-guides.md)
|
||||
### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md)
|
||||
### [Device Guard deployment guide](device-guard-deployment-guide.md)
|
||||
|
||||
@ -0,0 +1,84 @@
|
||||
---
|
||||
title: Add Production Computers to the Membership Group for a Zone (Windows 10)
|
||||
description: Add Production Computers to the Membership Group for a Zone
|
||||
ms.assetid: 7141de15-5840-4beb-aabe-21c1dd89eb23
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Add Production Computers to the Membership Group for a Zone
|
||||
|
||||
|
||||
After you test the GPOs for your design on a small set of computers, you can deploy them to the production computers.
|
||||
|
||||
**Caution**
|
||||
For GPOs that contain connection security rules that prevent unauthenticated connections, be sure to set the rules to request, not require, authentication during testing. After you deploy the GPO and confirm that all of your computers are successfully communicating by using authenticated IPsec, then you can modify the GPO to require authentication. Do not change the boundary zone GPO to require mode.
|
||||
|
||||
|
||||
|
||||
The method discussed in this guide uses the **Domain Computers** built-in group. The advantage of this method is that all new computers that are joined to the domain automatically receive the isolated domain GPO. To do this successfully, you must make sure that the WMI filters and security group filters exclude computers that must not receive the GPOs. Use computer groups that deny both read and apply Group Policy permissions to the GPOs, such as a group used in the CG\_DOMISO\_NOIPSEC example design. Computers that are members of some zones must also be excluded from applying the GPOs for the main isolated domain. For more information, see the "Prevent members of a group from applying a GPO" section in [Assign Security Group Filters to the GPO](../p_server_archive/assign-security-group-filters-to-the-gpo.md).
|
||||
|
||||
Without such a group (or groups), you must either add computers individually or use the groups containing computer accounts that are available to you.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the membership of the group for the GPO.
|
||||
|
||||
In this topic:
|
||||
|
||||
- [Add the group Domain Computers to the GPO membership group](#bkmk-toadddomaincomputerstothegpomembershipgroup)
|
||||
|
||||
- [Refresh Group Policy on the computers in the membership group](#bkmk-torefreshgrouppolicyonacomputer)
|
||||
|
||||
- [Check which GPOs apply to a computer](#bkmk-toseewhatgposareappliedtoacomputer)
|
||||
|
||||
## <a href="" id="bkmk-toadddomaincomputerstothegpomembershipgroup"></a>
|
||||
|
||||
|
||||
**To add domain computers to the GPO membership group**
|
||||
|
||||
1. On a computer that has the Active Directory management tools installed, click the **Start** charm, then click the **Active Directory Users and Computers** tile.
|
||||
|
||||
2. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then the container in which you created the membership group.
|
||||
|
||||
3. In the details pane, double-click the GPO membership group to which you want to add computers.
|
||||
|
||||
4. Select the **Members** tab, and then click **Add**.
|
||||
|
||||
5. Type **Domain Computers** in the text box, and then click **OK**.
|
||||
|
||||
6. Click **OK** to close the group properties dialog box.
|
||||
|
||||
After a computer is a member of the group, you can force a Group Policy refresh on the computer.
|
||||
|
||||
## <a href="" id="bkmk-torefreshgrouppolicyonacomputer"></a>
|
||||
|
||||
|
||||
**To refresh Group Policy on a computer**
|
||||
|
||||
- For a computer that is running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2, [Start a Command Prompt as an Administrator](../p_server_archive/start-a-command-prompt-as-an-administrator.md), and then type the following command:
|
||||
|
||||
``` syntax
|
||||
gpupdate /target:computer /force
|
||||
```
|
||||
|
||||
After Group Policy is refreshed, you can see which GPOs are currently applied to the computer.
|
||||
|
||||
## <a href="" id="bkmk-toseewhatgposareappliedtoacomputer"></a>
|
||||
|
||||
|
||||
**To see which GPOs are applied to a computer**
|
||||
|
||||
- For a computer that is running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2, [Start a Command Prompt as an Administrator](../p_server_archive/start-a-command-prompt-as-an-administrator.md), and then type the following command:
|
||||
|
||||
``` syntax
|
||||
gpresult /r /scope:computer
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,79 @@
|
||||
---
|
||||
title: Add Test Computers to the Membership Group for a Zone (Windows 10)
|
||||
description: Add Test Computers to the Membership Group for a Zone
|
||||
ms.assetid: 47057d90-b053-48a3-b881-4f2458d3e431
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Add Test Computers to the Membership Group for a Zone
|
||||
|
||||
|
||||
Before you deploy your rules to large numbers of computers, you must thoroughly test the rules to make sure that communications are working as expected. A misplaced WMI filter or an incorrectly typed IP address in a filter list can easily block communications between computers. Although we recommend that you set your rules to request mode until testing and deployment is complete, we also recommend that you initially deploy the rules to a small number of computers only to be sure that the correct GPOs are being processed by each computer.
|
||||
|
||||
Add at least one computer of each supported operating system type to each membership group. Make sure every GPO for a specific version of Windows and membership group has a computer among the test group. After Group Policy has been refreshed on each test computer, check the output of the **gpresult** command to confirm that each computer is receiving only the GPOs it is supposed to receive.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the membership of the group for the GPO.
|
||||
|
||||
In this topic:
|
||||
|
||||
- [Add the test computers to the GPO membership groups](#bkmk-toadddomaincomputerstothegpomembershipgroup)
|
||||
|
||||
- [Refresh Group Policy on the computers in each membership group](#bkmk-torefreshgrouppolicyonacomputer)
|
||||
|
||||
- [Check which GPOs apply to a computer](#bkmk-toseewhatgposareappliedtoacomputer)
|
||||
|
||||
## <a href="" id="bkmk-toadddomaincomputerstothegpomembershipgroup"></a>
|
||||
|
||||
|
||||
**To add test computers to the GPO membership groups**
|
||||
|
||||
1. On a computer that has the Active Directory management tools installed, click the **Start** charm, then click the **Active Directory Users and Computers** tile.
|
||||
|
||||
2. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then expand the container that holds your membership group account.
|
||||
|
||||
3. In the details pane, double-click the GPO membership group to which you want to add computers.
|
||||
|
||||
4. Select the **Members** tab, and then click **Add**.
|
||||
|
||||
5. Type the name of the computer in the text box, and then click **OK**.
|
||||
|
||||
6. Repeat steps 5 and 6 for each additional computer account or group that you want to add.
|
||||
|
||||
7. Click **OK** to close the group properties dialog box.
|
||||
|
||||
After a computer is a member of the group, you can force a Group Policy refresh on the computer.
|
||||
|
||||
## <a href="" id="bkmk-torefreshgrouppolicyonacomputer"></a>
|
||||
|
||||
|
||||
**To refresh Group Policy on a computer**
|
||||
|
||||
- For a computer that is running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2, [Start a Command Prompt as an Administrator](../p_server_archive/start-a-command-prompt-as-an-administrator.md), and then type the following command:
|
||||
|
||||
``` syntax
|
||||
gpupdate /target:computer /force
|
||||
```
|
||||
|
||||
After Group Policy is refreshed, you can see which GPOs are currently applied to the computer.
|
||||
|
||||
## <a href="" id="bkmk-toseewhatgposareappliedtoacomputer"></a>
|
||||
|
||||
|
||||
**To see which GPOs are applied to a computer**
|
||||
|
||||
- For a computer that is running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2, [Start a Command Prompt as an Administrator](../p_server_archive/start-a-command-prompt-as-an-administrator.md), and then type the following command:
|
||||
|
||||
``` syntax
|
||||
gpresult /r /scope:computer
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
67
windows/keep-secure/additional-resources-wfasdesign.md
Normal file
67
windows/keep-secure/additional-resources-wfasdesign.md
Normal file
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Additional Resources (Windows 10)
|
||||
description: Additional Resources
|
||||
ms.assetid: 74897052-508d-49b9-911c-5902a1fb0d26
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Additional Resources
|
||||
|
||||
|
||||
For more information about the technologies discussed in this guide, see topics referenced in the following sections.
|
||||
|
||||
## Windows Firewall with Advanced Security
|
||||
|
||||
|
||||
- [Windows Firewall with Advanced Security Overview](http://technet.microsoft.com/library/hh831365) (http://technet.microsoft.com/library/hh831365)
|
||||
|
||||
This TechNet page contains links to a variety of documents available for Windows Firewall with Advanced Security.
|
||||
|
||||
## IPsec
|
||||
|
||||
|
||||
- [IPsec](http://technet.microsoft.com/network/bb531150.aspx) (http://technet.microsoft.com/network/bb531150.aspx)
|
||||
|
||||
This TechNet page contains links to a variety of documents currently available for Internet Protocol security (IPsec) for Windows available as connection security rules.
|
||||
|
||||
## Server and Domain Isolation
|
||||
|
||||
|
||||
- [Server and Domain Isolation](http://technet.microsoft.com/network/bb545651.aspx) (http://technet.microsoft.com/network/bb545651.aspx)
|
||||
|
||||
This TechNet page contains links to documentation about the most common uses for IPsec: server isolation and domain isolation.
|
||||
|
||||
## Group Policy
|
||||
|
||||
|
||||
Group Policy is a key method for implementing firewall and server and domain isolation designs.
|
||||
|
||||
For more information about Group Policy and related technologies, see:
|
||||
|
||||
- **Group Policy**[Group Policy Overview](http://technet.microsoft.com/library/hh831791) (http://technet.microsoft.com/library/hh831791)
|
||||
|
||||
This page contains links to the documents currently available for Group Policy.
|
||||
|
||||
- [WMI Filtering Using GPMC](http://technet.microsoft.com/library/6237b9b2-4a21-425e-8976-2065d28b3147) (http://technet.microsoft.com/library/6237b9b2-4a21-425e-8976-2065d28b3147)
|
||||
|
||||
- [HOWTO: Leverage Group Policies with WMI Filters](http://support.microsoft.com/kb/555253) (http://support.microsoft.com/kb/555253)
|
||||
|
||||
This article describes how to create a WMI filter to set the scope of a GPO based on computer attributes, such as operating system.
|
||||
|
||||
## Active Directory Domain Services
|
||||
|
||||
|
||||
Organizations can use AD DS to manage users and resources, such as computers, printers, or applications, on a network. Server isolation and domain isolation also require AD DS to use the Kerberos V5 protocol for IPsec authentication.
|
||||
|
||||
For more information about AD DS and related technologies, see:
|
||||
|
||||
- [Active Directory Domain Services Overview](http://technet.microsoft.com/library/hh831484) (http://technet.microsoft.com/library/hh831484)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
64
windows/keep-secure/additional-resourceswfas-deploy.md
Normal file
64
windows/keep-secure/additional-resourceswfas-deploy.md
Normal file
@ -0,0 +1,64 @@
|
||||
---
|
||||
title: Additional Resources (Windows 10)
|
||||
description: Additional Resources
|
||||
ms.assetid: 09bdec5d-8a3f-448c-bc48-d4cb41f9c6e8
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Additional Resources
|
||||
|
||||
|
||||
For more information about the technologies discussed in this guide, see topics referenced in the following sections.
|
||||
|
||||
## Windows Firewall with Advanced Security
|
||||
|
||||
|
||||
- [Windows Firewall with Advanced Security Overview](http://technet.microsoft.com/library/hh831365.aspx) (http://technet.microsoft.com/library/hh831365.aspx)
|
||||
|
||||
This TechNet page contains links to a variety of documents available for Windows Firewall with Advanced Security in Windows Server 2012.
|
||||
|
||||
- [Troubleshooting Windows Firewall with Advanced Security in Windows Server 2012](http://social.technet.microsoft.com/wiki/contents/articles/13894.troubleshooting-windows-firewall-with-advanced-security-in-windows-server-2012.aspx#z6d72b831d4c24158874a04e9e9d37c43)
|
||||
|
||||
This wiki article describes how Windows Firewall with Advanced Security works, what the common troubleshooting situations are, and which tools you can use for troubleshooting. The community is encouraged to add their troubleshooting and experiences to this article.
|
||||
|
||||
## IPsec
|
||||
|
||||
|
||||
- [IPsec](http://www.microsoft.com/ipsec) (http://www.microsoft.com/ipsec)
|
||||
|
||||
This TechNet page contains links to a variety of documents currently available for Internet Protocol security (IPsec) in Windows.
|
||||
|
||||
## Group Policy
|
||||
|
||||
|
||||
Group Policy is a key method for implementing firewall and server and domain isolation designs.
|
||||
|
||||
For more information about Group Policy and related technologies, see:
|
||||
|
||||
- [Group Policy Overview](http://technet.microsoft.com/library/hh831791.aspx) (http://technet.microsoft.com/library/hh831791.aspx)
|
||||
|
||||
This page contains links to the documents currently available for Group Policy.
|
||||
|
||||
- [WMI Filtering Using GPMC](http://go.microsoft.com/fwlink/?linkid=93188) (http://go.microsoft.com/fwlink/?linkid=93188)
|
||||
|
||||
- [HOWTO: Leverage Group Policies with WMI Filters](http://go.microsoft.com/fwlink/?linkid=93760) (http://go.microsoft.com/fwlink/?linkid=93760)
|
||||
|
||||
This article describes how to create a WMI filter to set the scope of a GPO based on computer attributes, such as operating system.
|
||||
|
||||
## Active Directory Domain Services
|
||||
|
||||
|
||||
In Windows 8 and Windows Server 2012, organizations can use AD DS to manage users and resources, such as computers, printers, or applications, on a network. Server isolation and domain isolation also require AD DS to use the Kerberos V5 protocol for IPsec authentication.
|
||||
|
||||
For more information about AD DS and related technologies, see:
|
||||
|
||||
- [Active Directory Domain Services Overview](http://technet.microsoft.com/library/hh831484.aspx) (http://technet.microsoft.com/library/hh831484.aspx)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,98 @@
|
||||
---
|
||||
title: Appendix A Sample GPO Template Files for Settings Used in this Guide (Windows 10)
|
||||
description: Appendix A Sample GPO Template Files for Settings Used in this Guide
|
||||
ms.assetid: 75930afd-ab1b-4e53-915b-a28787814b38
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Appendix A: Sample GPO Template Files for Settings Used in this Guide
|
||||
|
||||
|
||||
You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). Creating registry setting preferences as described here was first implemented in Windows Server 2008 and Windows Vista with Service Pack 1 (SP1).
|
||||
|
||||
To manually create the file, build the settings under **Computer Configuration**, **Preferences**, **Windows Settings**, **Registry**. After you have created the settings, drag the container to the desktop. An .xml file is created there.
|
||||
|
||||
To import an .xml file to GPMC, drag it and drop it on the **Registry** node under **Computer Configuration**, **Preferences**, **Windows Settings**. If you copy the following sample XML code to a file, and then drag and drop it on the **Registry** node, it creates a **Server and Domain Isolation** collection with the six registry keys discussed in this guide.
|
||||
|
||||
The following sample file uses item-level targeting to ensure that the registry keys are applied only on the versions of Windows to which they apply.
|
||||
|
||||
**Note**
|
||||
The file shown here is for sample use only. It should be customized to meet the requirements of your organization’s deployment. To customize this file, import it into a test GPO, modify the settings, and then drag the Server and Domain Isolation Settings node to your desktop. The new file will contain all of your customization.
|
||||
|
||||
|
||||
|
||||
``` syntax
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
|
||||
<Collection clsid="{53B533F5-224C-47e3-B01B-CA3B3F3FF4BF}" name="Server and Domain Isolation Settings">
|
||||
|
||||
<Registry
|
||||
clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}"
|
||||
name="Enable PMTU Discovery"
|
||||
status="EnablePMTUDiscovery"
|
||||
image="12"
|
||||
changed="2008-05-30 20:37:37"
|
||||
uid="{52C38FD7-A081-404C-A8EA-B24A9614D0B5}"
|
||||
desc="<b>Enable PMTU Discovery</b><p>
|
||||
This setting configures whether computers can use PMTU
|
||||
discovery on the network.<p>
|
||||
<b>1</b> -- Enable<br>
|
||||
<b>0</b> -- Disable"
|
||||
bypassErrors="1">
|
||||
<Properties
|
||||
action="U"
|
||||
displayDecimal="1"
|
||||
default="0"
|
||||
hive="HKEY_LOCAL_MACHINE"
|
||||
key="System\CurrentControlSet\Services\TCPIP\Parameters"
|
||||
name="EnablePMTUDiscovery" type="REG_DWORD" value="00000001"/>
|
||||
</Registry>
|
||||
|
||||
<Registry
|
||||
clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}"
|
||||
name="IPsec Default Exemptions (Vista and W2K8)"
|
||||
status="NoDefaultExempt"
|
||||
image="12"
|
||||
changed="2008-05-30 20:33:32"
|
||||
uid="{AE5C505D-283E-4060-9A55-70659DFD56B6}"
|
||||
desc="<b>IPsec Default Exemptions for Windows Server 2008
|
||||
and later</b><p>
|
||||
This setting determines which network traffic type is exempt
|
||||
from any IPsec authentication requirements.<p>
|
||||
<b>0</b>: Exempts multicast, broadcast, RSVP, Kerberos, ISAKMP<br>
|
||||
<b>1</b>: Exempts multicast, broadcast, ISAKMP<br>
|
||||
<b>2</b>: Exempts RSVP, Kerberos, ISAKMP<br>
|
||||
<b>3</b>: Exempts ISAKMP only"
|
||||
bypassErrors="1">
|
||||
<Properties
|
||||
action="U"
|
||||
displayDecimal="1"
|
||||
default="0"
|
||||
hive="HKEY_LOCAL_MACHINE"
|
||||
key="SYSTEM\CurrentControlSet\Services\PolicyAgent"
|
||||
name="NoDefaultExempt"
|
||||
type="REG_DWORD"
|
||||
value="00000003"/>
|
||||
<Filters>
|
||||
<FilterOs
|
||||
bool="AND" not="0"
|
||||
class="NT" version="VISTA"
|
||||
type="NE" edition="NE" sp="NE"/>
|
||||
<FilterOs
|
||||
bool="OR" not="0"
|
||||
class="NT" version="2K8"
|
||||
type="NE" edition="NE" sp="NE"/>
|
||||
</Filters>
|
||||
</Registry>
|
||||
|
||||
</Collection>
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,84 @@
|
||||
---
|
||||
title: Assign Security Group Filters to the GPO (Windows 10)
|
||||
description: Assign Security Group Filters to the GPO
|
||||
ms.assetid: bcbe3299-8d87-4ec1-9e86-8e4a680fd7c8
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Assign Security Group Filters to the GPO
|
||||
|
||||
|
||||
To make sure that your GPO is applied to the correct computers, use the Group Policy Management MMC snap-in to assign security group filters to the GPO.
|
||||
|
||||
**Important**
|
||||
This deployment guide uses the method of adding the Domain Computers group to the membership group for the main isolated domain after testing is complete and you are ready to go live in production. To make this method work, you must prevent any computer that is a member of either the boundary or encryption zone from applying the GPO for the main isolated domain. For example, on the GPOs for the main isolated domain, deny Read and Apply Group Policy permissions to the membership groups for the boundary and encryption zones.
|
||||
|
||||
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the relevant GPOs.
|
||||
|
||||
In this topic:
|
||||
|
||||
- [Allow members of a group to apply a GPO](#bkmk-toallowamembersofagrouptoapplyagpo)
|
||||
|
||||
- [Prevent members of a group from applying a GPO](#bkmk-topreventmembersofgroupfromapplyingagpo)
|
||||
|
||||
## <a href="" id="bkmk-toallowamembersofagrouptoapplyagpo"></a>
|
||||
|
||||
|
||||
Use the following procedure to add a group to the security filter on the GPO that allows group members to apply the GPO.
|
||||
|
||||
**To allow members of a group to apply a GPO**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click the **Start** charm, and then click the **Group Policy Management** tile.
|
||||
|
||||
2. In the navigation pane, find and then click the GPO that you want to modify.
|
||||
|
||||
3. In the details pane, under **Security Filtering**, click **Authenticated Users**, and then click **Remove**.
|
||||
|
||||
**Note**
|
||||
You must remove the default permission granted to all authenticated users and computers to restrict the GPO to only the groups you specify.
|
||||
|
||||
|
||||
|
||||
4. Click **Add**.
|
||||
|
||||
5. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to apply the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain.
|
||||
|
||||
## <a href="" id="bkmk-topreventmembersofgroupfromapplyingagpo"></a>
|
||||
|
||||
|
||||
Use the following procedure to add a group to the security filter on the GPO that prevents group members from applying the GPO. This is typically used to prevent members of the boundary and encryption zones from applying the GPOs for the isolated domain.
|
||||
|
||||
**To prevent members of group from applying a GPO**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click the **Start** charm, and then click the **Group Policy Management** tile.
|
||||
|
||||
2. In the navigation pane, find and then click the GPO that you want to modify.
|
||||
|
||||
3. In the details pane, click the **Delegation** tab.
|
||||
|
||||
4. Click **Advanced**.
|
||||
|
||||
5. Under the **Group or user names** list, click **Add**.
|
||||
|
||||
6. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain.
|
||||
|
||||
7. Select the group in the **Group or user names** list, and then select the box in the **Deny** column for both **Read** and **Apply group policy**.
|
||||
|
||||
8. Click **OK**, and then in the **Windows Security** dialog box, click **Yes**.
|
||||
|
||||
9. The group appears in the list with **Custom** permissions.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
74
windows/keep-secure/basic-firewall-policy-design.md
Normal file
74
windows/keep-secure/basic-firewall-policy-design.md
Normal file
@ -0,0 +1,74 @@
|
||||
---
|
||||
title: Basic Firewall Policy Design (Windows 10)
|
||||
description: Basic Firewall Policy Design
|
||||
ms.assetid: 6f7af99e-6850-4522-b7f5-db98e6941418
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Basic Firewall Policy Design
|
||||
|
||||
|
||||
Many organizations have a network perimeter firewall that is designed to prevent the entry of malicious traffic in to the organization's network, but do not have a host-based firewall enabled on each computer in the organization.
|
||||
|
||||
The Basic Firewall Policy Design helps you to protect the computers in your organization from unwanted network traffic that gets through the perimeter defenses, or that originates from inside your network. In this design, you deploy firewall rules to each computer in your organization to allow traffic that is required by the programs that are used. Traffic that does not match the rules is dropped.
|
||||
|
||||
Traffic can be blocked or permitted based on the characteristics of each network packet: its source or destination IP address, its source or destination port numbers, the program on the computer that receives the inbound packet, and so on. This design can also be deployed together with one or more of the other designs that add IPsec protection to the network traffic permitted.
|
||||
|
||||
Many network administrators do not want to tackle the difficult task of determining all the appropriate rules for every program that is used by the organization, and then maintaining that list over time. In fact, most programs do not require specific firewall rules. The default behavior of Windows and most contemporary applications makes this task easy:
|
||||
|
||||
- On client computers, the default firewall behavior already supports typical client programs. Programs designed for Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, and Windows Vista create any required rules for you as part of the installation process. You only have to create a rule if the client program must be able to receive unsolicited inbound network traffic from another computer.
|
||||
|
||||
- When you install a server program that must accept unsolicited inbound network traffic, the installation program likely creates or enables the appropriate rules on the server for you.
|
||||
|
||||
For example, when you install a server role in Windows Server 2012, Windows Server 2008 R2 or Windows Server 2008, the appropriate firewall rules are created and enabled automatically.
|
||||
|
||||
- For other standard network behavior, the predefined rules that are built into Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, and Windows Vista can easily be configured in a GPO and deployed to the computers in your organization.
|
||||
|
||||
For example, by using the predefined groups for Core Networking and File and Printer Sharing you can easily configure GPOs with rules for those frequently used networking protocols.
|
||||
|
||||
With few exceptions, the firewall can be enabled on all configurations of Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, and Windows Vista. Therefore, we recommended that you enable the firewall on every computer in your organization. This includes servers in your perimeter network, on mobile and remote clients that connect to the network, and on all servers and clients in your internal network.
|
||||
|
||||
**Caution**
|
||||
**Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft**.
|
||||
|
||||
By default, in new installations, Windows Firewall is turned on in Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, and Windows Vista.
|
||||
|
||||
If you turn off the Windows Firewall with Advanced Security service you lose other benefits provided by the service, such as the ability to use IPsec connection security rules, Windows Service Hardening, and network protection from forms of attacks that use network fingerprinting. For more information about Windows Service Hardening, see <http://go.microsoft.com/fwlink/?linkid=104976>.
|
||||
|
||||
Third-party firewall software that is compatible with Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, and Windows Vista can programmatically disable only the parts of Windows Firewall with Advanced Security that might need to be disabled for compatibility. This is the recommended approach for third-party firewalls to coexist with the Windows Firewall; third-party party firewalls that comply with this recommendation have the certified logo from Microsoft.
|
||||
|
||||
|
||||
|
||||
An organization typically uses this design as a first step toward a more comprehensive Windows Firewall with Advanced Security design that adds server isolation and domain isolation.
|
||||
|
||||
After implementing this design, your administrative team will have centralized management of the firewall rules applied to all computers that are running Windows in your organization.
|
||||
|
||||
**Important**
|
||||
If you also intend to deploy the [Domain Isolation Policy Design](../p_server_archive/domain-isolation-policy-design.md), or the [Server Isolation Policy Design](../p_server_archive/server-isolation-policy-design.md), we recommend that you do the design work for all three designs together, and then deploy in layers that correspond with each design.
|
||||
|
||||
|
||||
|
||||
The basic firewall design can be applied to computers that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the firewall settings and rules.
|
||||
|
||||
For more information about this design:
|
||||
|
||||
- This design coincides with the deployment goal to [Protect Computers from Unwanted Network Traffic](../p_server_archive/protect-computers-from-unwanted-network-traffic.md).
|
||||
|
||||
- To learn more about this design, see [Firewall Policy Design Example](../p_server_archive/firewall-policy-design-example.md).
|
||||
|
||||
- Before completing the design, gather the information described in [Designing a Windows Firewall with Advanced Security Strategy](../p_server_archive/designing-a-windows-firewall-with-advanced-security-strategy.md).
|
||||
|
||||
- To help you make the decisions required in this design, see [Planning Settings for a Basic Firewall Policy](../p_server_archive/planning-settings-for-a-basic-firewall-policy.md).
|
||||
|
||||
- For a list of detailed tasks that you can use to deploy your basic firewall policy design, see "Checklist: Implementing a Basic Firewall Policy Design" in the [Windows Firewall with Advanced Security Deployment Guide](http://go.microsoft.com/fwlink/?linkid=98308) at http://go.microsoft.com/fwlink/?linkid=98308.
|
||||
|
||||
**Next: **[Domain Isolation Policy Design](../p_server_archive/domain-isolation-policy-design.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
33
windows/keep-secure/boundary-zone-gpos.md
Normal file
33
windows/keep-secure/boundary-zone-gpos.md
Normal file
@ -0,0 +1,33 @@
|
||||
---
|
||||
title: Boundary Zone GPOs (Windows 10)
|
||||
description: Boundary Zone GPOs
|
||||
ms.assetid: 1ae66088-02c3-47e4-b7e8-74d0b8f8646e
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Boundary Zone GPOs
|
||||
|
||||
|
||||
All the computers in the boundary zone are added to the group CG\_DOMISO\_Boundary. You must create multiple GPOs to align with this group, one for each operating system that you have in your boundary zone. This group is granted Read and Apply permissions in Group Policy on the GPOs described in this section.
|
||||
|
||||
**Note**
|
||||
If you are designing GPOs for only Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2, you can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any computers that are incorrectly assigned to more than one group.
|
||||
|
||||
|
||||
|
||||
This means that you create a GPO for a boundary group for a specific operating system by copying and pasting the corresponding GPO for the isolated domain, and then modifying the new copy to provide the behavior required in the boundary zone.
|
||||
|
||||
The boundary zone GPOs discussed in this guide are only for server versions of Windows because client computers are not expected to participate in the boundary zone. If the need for one occurs, either create a new GPO for that version of Windows, or expand the WMI filter attached to one of the existing boundary zone GPOs to make it apply to the client version of Windows.
|
||||
|
||||
In the Woodgrove Bank example, only the GPO settings for a Web service on Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008 are discussed.
|
||||
|
||||
- [GPO\_DOMISO\_Boundary\_WS2008](../p_server_archive/gpo-domiso-boundary-ws2008.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
68
windows/keep-secure/boundary-zone.md
Normal file
68
windows/keep-secure/boundary-zone.md
Normal file
@ -0,0 +1,68 @@
|
||||
---
|
||||
title: Boundary Zone (Windows 10)
|
||||
description: Boundary Zone
|
||||
ms.assetid: ed98b680-fd24-44bd-a7dd-26c522e45a20
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Boundary Zone
|
||||
|
||||
|
||||
In most organizations, some computers must be able to receive network traffic from computers that are not part of the isolated domain, and therefore cannot authenticate. To accept communications from untrusted computers, create a boundary zone within your isolated domain.
|
||||
|
||||
Computers in the boundary zone are trusted computers that can accept communication requests both from other isolated domain member computers and from untrusted computers. Boundary zone computers try to authenticate any incoming request by using IPsec, initiating an IKE negotiation with the originating computer.
|
||||
|
||||
The GPOs you build for the boundary zone include IPsec or connection security rules that request authentication for both inbound and outbound network connections, but do not require it.
|
||||
|
||||
Because these boundary zone computers can receive unsolicited inbound communications from untrusted computers that use plaintext, they must be carefully managed and secured in other ways. Mitigating this additional risk is an important part of deciding whether to add a computer to the boundary zone. For example, completing a formal business justification process before adding each computer to the boundary zone can help ensure that the additional risk is minimized. The following illustration shows a sample process that can help make such a decision.
|
||||
|
||||
|
||||
|
||||
The goal of this process is to determine whether the risk of adding a computer to a boundary zone can be mitigated to a level that makes it acceptable to the organization. Ultimately, if the risk cannot be mitigated, membership must be denied.
|
||||
|
||||
You must create a group in Active Directory to contain the members of the boundary zones. The settings and rules for the boundary zone are typically very similar to those for the isolated domain, and you can save time and effort by copying those GPOs to serve as a starting point. The primary difference is that the authentication connection security rule must be set to request authentication for both inbound and outbound traffic, instead of requiring inbound authentication and requesting outbound authentication as used by the isolated domain.
|
||||
|
||||
Creation of the group and how to link it to the GPOs that apply the rules to members of the group are discussed in the [Planning Group Policy Deployment for Your Isolation Zones](../p_server_archive/planning-group-policy-deployment-for-your-isolation-zones.md) section.
|
||||
|
||||
## GPO settings for boundary zone servers running Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2
|
||||
|
||||
|
||||
The boundary zone GPO for computers running Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2 should include the following:
|
||||
|
||||
- IPsec default settings that specify the following options:
|
||||
|
||||
1. Exempt all ICMP traffic from IPsec.
|
||||
|
||||
2. Key exchange (main mode) security methods and algorithm. We recommend that you use at least DH4, AES and SHA2 in your settings. Use the strongest algorithm combinations that are common to all your supported operating systems.
|
||||
|
||||
3. Data protection (quick mode) algorithm combinations. We recommend that you do not include DES or MD5 in any setting. They are included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems..
|
||||
|
||||
If any NAT devices are present on your networks, use ESP encapsulation. If isolated domain members must communicate with hosts in the encryption zone, ensure that you include algorithms that are compatible with the requirements of the encryption mode policies.
|
||||
|
||||
4. Authentication methods. Include at least computer-based Kerberos V5 authentication. If you want to use user-based access to isolated servers then you must also include user-based Kerberos V5 authentication as an optional authentication method. Likewise, if any of your domain isolation members cannot use Kerberos V5, you must include certificate-based authentication as an optional authentication method.
|
||||
|
||||
- The following connection security rules:
|
||||
|
||||
- A connection security rule that exempts all computers on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, if applicable in your environment.
|
||||
|
||||
- A connection security rule, from **Any IP address** to **Any IP address**, that requests inbound and outbound authentication.
|
||||
|
||||
- A registry policy that includes the following values:
|
||||
|
||||
- Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](../p_server_archive/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**.
|
||||
|
||||
**Note**
|
||||
For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](../p_server_archive/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md)
|
||||
|
||||
|
||||
|
||||
**Next: **[Encryption Zone](../p_server_archive/encryption-zone.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,56 @@
|
||||
---
|
||||
title: Certificate-based Isolation Policy Design Example (Windows 10)
|
||||
description: Certificate-based Isolation Policy Design Example
|
||||
ms.assetid: 509b513e-dd49-4234-99f9-636fd2f749e3
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Certificate-based Isolation Policy Design Example
|
||||
|
||||
|
||||
This design example continues to use the fictitious company Woodgrove Bank, as described in the sections [Firewall Policy Design Example](../p_server_archive/firewall-policy-design-example.md), [Domain Isolation Policy Design Example](../p_server_archive/domain-isolation-policy-design-example.md), and [Server Isolation Policy Design Example](../p_server_archive/server-isolation-policy-design-example.md).
|
||||
|
||||
One of the servers that must be included in the domain isolation environment is a computer running UNIX that supplies other information to the WGBank dashboard program running on the client computers. This computer sends updated information to the WGBank front-end servers as it becomes available, so it is considered unsolicited inbound traffic to the computers that receive this information.
|
||||
|
||||
## Design requirements
|
||||
|
||||
|
||||
One possible solution to this is to include an authentication exemption rule in the GPO applied to the WGBank front-end servers. This rule would instruct the front-end servers to accept traffic from the non-Windows computer even though it cannot authenticate.
|
||||
|
||||
A more secure solution, and the one selected by Woodgrove Bank, is to include the non-Windows computer in the domain isolation design. Because it cannot join an Active Directory domain, Woodgrove Bank chose to use certificate-based authentication. Certificates are cryptographically-protected documents, encrypted in such a way that their origin can be positively confirmed.
|
||||
|
||||
In this case, Woodgrove Bank used Microsoft Certificate Services, included with Windows Server 2008, to create the appropriate certificate. They might also have acquired and installed a certificate from a third-party commercial certification authority. They then used Group Policy to deploy the certificate to the front-end servers. The GPOs applied to the front-end servers also include updated connection security rules that permit certificate-based authentication in addition to Kerberos V5 authentication. They then manually installed the certificate on the UNIX server.
|
||||
|
||||
The UNIX server is configured with firewall and IPsec connection security rules using the tools that are provided by the operating system vendor. Those rules specify that authentication is performed by using the certificate.
|
||||
|
||||
The creation of the IPsec connection security rules for a non-Windows computer is beyond the scope of this document, but support for a certificate that can be used to authenticate such a non-Windows computer by using the standard IPsec protocols is the subject of this design.
|
||||
|
||||
The non-Windows computer can be effectively made a member of the boundary zone or the encryption zone based on the IPsec rules applied to the computer. The only constraint is that the main mode and quick mode encryption algorithms supported by the UNIX computer must also be supported by the Windows-based computers with which it communicates.
|
||||
|
||||
**Other traffic notes:**
|
||||
|
||||
- None of the capabilities of the other designs discussed in this guide are compromised by the use of certificate authentication by a non-Windows computer.
|
||||
|
||||
## Design details
|
||||
|
||||
|
||||
Woodgrove Bank uses Active Directory groups and GPOs to deploy the domain isolation settings and rules to the computers in their organization.
|
||||
|
||||
The inclusion of one or more non-Windows computers to the network requires only a simple addition to the GPOs for computers that must communicate with the non-Windows computer. The addition is allowing certificate-based authentication in addition to the Active Directory–supported Kerberos V5 authentication. This does not require including new rules, just adding certificate-based authentication as an option to the existing rules.
|
||||
|
||||
When multiple authentication methods are available, two negotiating computers agree on the first one in their lists that match. Because the majority of the computers in Woodgrove Bank's network run Windows, Kerberos V5 is listed as the first authentication method in the rules. Certificate-based authentication is added as an alternate authentication type.
|
||||
|
||||
By using the Active Directory Users and Computers snap-in, Woodgrove Bank created a group named NAG\_COMPUTER\_WGBUNIX. They then added the computer accounts to this group for Windows computers that need to communicate with the non-Windows computers. If all the computers in the isolated domain need to be able to access the non-Windows computers, then the **Domain Computers** group can be added to the group as a member.
|
||||
|
||||
Woodgrove Bank then created a GPO that contains the certificate, and then attached security group filters to the GPO that allow read and apply permissions to only members of the NAG\_COMPUTER\_WGBUNIX group. The GPO places the certificate in the **Local Computer / Personal / Certificates** certificate store. The certificate used must chain back to a certificate that is in the **Trusted Root Certification Authorities** store on the local computer.
|
||||
|
||||
**Next: **[Designing a Windows Firewall with Advanced Security Strategy](../p_server_archive/designing-a-windows-firewall-with-advanced-security-strategy.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,42 @@
|
||||
---
|
||||
title: Certificate-based Isolation Policy Design (Windows 10)
|
||||
description: Certificate-based Isolation Policy Design
|
||||
ms.assetid: 63e01a60-9daa-4701-9472-096c85e0f862
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Certificate-based Isolation Policy Design
|
||||
|
||||
|
||||
In the certificate-based isolation policy design, you provide the same types of protections to your network traffic as described in the [Domain Isolation Policy Design](../p_server_archive/domain-isolation-policy-design.md) and [Server Isolation Policy Design](../p_server_archive/server-isolation-policy-design.md) sections. The only difference is the method used to share identification credentials during the authentication of your network traffic.
|
||||
|
||||
Domain isolation and server isolation help provide security for the computers on the network that run Windows and that can be joined to an Active Directory domain. However, in most corporate environments there are typically some computers that must run another operating system, such as Linux or UNIX. These computers cannot join an Active Directory domain, without a third-party package being installed. Also, some computers that do run Windows cannot join a domain for a variety of reasons. To rely on Kerberos V5 as the authentication protocol, the computer needs to be joined to the Active Directory and (for non-windows computers) support Kerberos as an authentication protocol.
|
||||
|
||||
To authenticate with non-domain member computers, IPsec supports using standards-based cryptographic certificates. Because this authentication method is also supported by many third-party operating systems, it can be used as a way to extend your isolated domain to computers that do not run the Windows operating system.
|
||||
|
||||
The same principles of the domain and server isolation designs apply to this design. Only computers that can authenticate (in this case, by providing a specified certificate) can communicate with the computers in your isolated domain.
|
||||
|
||||
For computers that run Windows and that are part of an Active Directory domain, you can use Group Policy to deploy the certificates required to communicate with the computers that are trusted but are not part of the Active Directory domain. For other computers, you will have to either manually configure them with the required certificates, or use a third-party program to distribute the certificates in a secure manner.
|
||||
|
||||
For more information about this design:
|
||||
|
||||
- This design coincides with the deployment goals to [Protect Computers from Unwanted Network Traffic](../p_server_archive/protect-computers-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Computers](../p_server_archive/restrict-access-to-only-trusted-computers.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](../p_server_archive/require-encryption-when-accessing-sensitive-network-resources.md).
|
||||
|
||||
- To learn more about this design, see [Certificate-based Isolation Policy Design Example](../p_server_archive/certificate-based-isolation-policy-design-example.md).
|
||||
|
||||
- Before completing the design, gather the information described in [Designing a Windows Firewall with Advanced Security Strategy](../p_server_archive/designing-a-windows-firewall-with-advanced-security-strategy.md).
|
||||
|
||||
- To help you make the decisions required in this design, see [Planning Certificate-based Authentication](../p_server_archive/planning-certificate-based-authentication.md).
|
||||
|
||||
- For a list of tasks that you can use to deploy your certificate-based policy design, see "Checklist: Implementing a Certificate-based Isolation Policy Design" in the [Windows Firewall with Advanced Security Deployment Guide](http://go.microsoft.com/fwlink/?linkid=98308) at http://go.microsoft.com/fwlink/?linkid=98308.
|
||||
|
||||
**Next: **[Evaluating Windows Firewall with Advanced Security Design Examples](../p_server_archive/evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,68 @@
|
||||
---
|
||||
title: Change Rules from Request to Require Mode (Windows 10)
|
||||
description: Change Rules from Request to Require Mode
|
||||
ms.assetid: ad969eda-c681-48cb-a2c4-0b6cae5f4cff
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Change Rules from Request to Require Mode
|
||||
|
||||
|
||||
After you confirm that network traffic is being correctly protected by using IPsec, you can change the rules for the domain isolation and encryption zones to require, instead of request, authentication. Do not change the rules for the boundary zone; they must stay in request mode so that computers in the boundary zone can continue to accept connections from computers that are not part of the isolated domain.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
In this topic:
|
||||
|
||||
- [Convert a rule in a GPO for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](#bkmk-section1)
|
||||
|
||||
- [Convert a rule for an earlier version of Windows](#bkmk-section2)
|
||||
|
||||
- [Refresh policy on the client computers to receive the modified GPOs](#bkmk-section3)
|
||||
|
||||
## <a href="" id="bkmk-section1"></a>
|
||||
|
||||
|
||||
**To convert a rule from request to require mode for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Connection Security Rules**.
|
||||
|
||||
3. In the details pane, double-click the connection security rule that you want to modify.
|
||||
|
||||
4. Click the **Authentication** tab.
|
||||
|
||||
5. In the **Requirements** section, change **Authenticated mode** to **Require inbound and request outbound**, and then click **OK**.
|
||||
|
||||
## <a href="" id="bkmk-section3"></a>
|
||||
|
||||
|
||||
**To apply the modified GPOs to the client computers**
|
||||
|
||||
1. The next time each computer refreshes its Group Policy, it will receive the updated GPO and apply the modified rule. To force an immediate refresh, [Start a Command Prompt as an Administrator](../p_server_archive/start-a-command-prompt-as-an-administrator.md) and run the following command:
|
||||
|
||||
``` syntax
|
||||
gpupdate /force
|
||||
```
|
||||
|
||||
2. To verify that the modified GPO is correctly applied to the client computers, you can run one of the following commands:
|
||||
|
||||
On computers that are running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2, run the following command:
|
||||
|
||||
``` syntax
|
||||
gpresult /r /scope computer
|
||||
```
|
||||
|
||||
3. Examine the command output for the list of GPOs that are applied to the computer, and make sure that the list contains the GPOs you expect to see on that computer.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,59 @@
|
||||
---
|
||||
title: Checklist Configuring Basic Firewall Settings (Windows 10)
|
||||
description: Checklist Configuring Basic Firewall Settings
|
||||
ms.assetid: 0d10cdae-da3d-4a33-b8a4-6b6656b6d1f9
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Configuring Basic Firewall Settings
|
||||
|
||||
|
||||
This checklist includes tasks for configuring a GPO with firewall defaults and settings that are separate from the rules.
|
||||
|
||||
## <a href="" id="bkmk-section1"></a>
|
||||
|
||||
|
||||
**Checklist: Configuring firewall defaults and settings**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Turn the firewall on and set the default inbound and outbound behavior.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Turn on Windows Firewall and Configure Default Behavior](../p_server_archive/turn-on-windows-firewall-and-configure-default-behavior.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the firewall to not display notifications to the user when a program is blocked, and to ignore locally defined firewall and connection security rules.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](../p_server_archive/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the firewall to record a log file.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure the Windows Firewall Log](../p_server_archive/configure-the-windows-firewall-log.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,125 @@
|
||||
---
|
||||
title: Checklist Configuring Rules for an Isolated Server Zone (Windows 10)
|
||||
description: Checklist Configuring Rules for an Isolated Server Zone
|
||||
ms.assetid: 67c50a91-e71e-4f1e-a534-dad2582e311c
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Configuring Rules for an Isolated Server Zone
|
||||
|
||||
|
||||
The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs for servers in an isolated server zone that are part of an isolated domain. For information about creating a standalone isolated server zone that is not part of an isolated domain, see [Checklist: Implementing a Standalone Server Isolation Policy Design](../p_server_archive/checklist-implementing-a-standalone-server-isolation-policy-design.md).
|
||||
|
||||
In addition to requiring authentication and optionally encryption, servers in an isolated server zone can be accessed only by users or computers who are authenticated members of a network access group (NAG). Computers that are running Windows 2000, Windows XP, or Windows Server 2003 can restrict access in IPsec only to computers that are members of the NAG, because IPsec and IKE in those versions of Windows do not support user-based authentication. If you include user accounts in the NAG, then the restrictions can still apply; they are just enforced at the application layer, rather than the IP layer.
|
||||
|
||||
Computers that are running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 can identify both computers and users in the NAG because IPsec in these versions of Windows supports AuthIP in addition to IKE. AuthIP adds support for user-based authentication. For more information, see “AuthIP in Windows Vista” (<http://go.microsoft.com/fwlink/?linkid=69843>).
|
||||
|
||||
The GPOs for an isolated server or group of servers are similar to those for the isolated domain itself or the encryption zone, if you require encryption to your isolated servers. This checklist refers you to procedures for creating rules as well as restrictions that allow only members of the NAG to connect to the server.
|
||||
|
||||
## <a href="" id="bkmk-section1"></a>
|
||||
|
||||
|
||||
**Checklist: Configuring rules for isolated servers for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2**
|
||||
|
||||
**Note**
|
||||
The GPOs for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 are usually similar. If this is true for your design, create one GPO, configure it by using the tasks in this checklist, and then make a copy of the GPO for the other operating system. For example, create and configure the GPO for Windows 8, make a copy of it for Windows Server 2012, and then follow the steps in this checklist to make the few required changes to the copy.
|
||||
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a GPO for the computers that need to have access restricted to the same set of client computers. If there are multiple servers and they run different versions of the Windows operating system, then start by creating the GPO for one version of Windows. After you have finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.</p>
|
||||
<p>Copy the GPO from the isolated domain or from the encryption zone to serve as a starting point. Where your copy already contains elements listed in the following checklist, review the relevant procedures and compare them to your copied GPO’s element to make sure it is constructed in a way that meets the needs of the server isolation zone.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Copy a GPO to Create a New GPO](../p_server_archive/copy-a-gpo-to-create-a-new-gpo.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the security group filters and WMI filters on the GPO so that only members of the isolated server zone’s membership group that are running the specified version of Windows can read and apply it.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Modify GPO Filters to Apply to a Different Zone or Version of Windows](../p_server_archive/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure IPsec to exempt all ICMP network traffic from IPsec protection.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Exempt ICMP from Authentication on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/exempt-icmp-from-authentication-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the key exchange (main mode) security methods and algorithms to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Key Exchange (Main Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-key-exchange--main-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the data protection (quick mode) algorithm combinations to be used. If you require encryption for the isolated server zone, then make sure that you choose only algorithm combinations that include encryption.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Data Protection (Quick Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-data-protection--quick-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the authentication methods to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Authentication Methods on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-authentication-methods-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that exempts all network traffic to and from computers on the exemption list from IPsec.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Authentication Exemption List Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/create-an-authentication-exemption-list-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that requests authentication for all network traffic.</p>
|
||||
<div class="alert">
|
||||
<strong>Important</strong>
|
||||
<p>Just as in an isolated domain, do not set the rules to require authentication for inbound traffic until you have completed testing. That way, if the rules do not work as expected, communications are not affected by a failure to authenticate.</p>
|
||||
</div>
|
||||
<div>
|
||||
|
||||
</div></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Authentication Request Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/create-an-authentication-request-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the NAG to contain the computer or user accounts that are allowed to access the servers in the isolated server zone.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create a Group Account in Active Directory](../p_server_archive/create-a-group-account-in-active-directory.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a firewall rule that permits inbound network traffic only if authenticated as a member of the NAG.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Restrict Server Access to Members of a Group Only](../p_server_archive/restrict-server-access-to-members-of-a-group-only.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Link the GPO to the domain level of the Active Directory organizational unit hierarchy.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Link the GPO to the Domain](../p_server_archive/link-the-gpo-to-the-domain.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Add your test server to the membership group for the isolated server zone. Be sure to add at least one server for each operating system supported by a GPO in the group.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Test Computers to the Membership Group for a Zone](../p_server_archive/add-test-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
Do not change the rules for any of your zones to require authentication until all of the zones have been set up and are operating correctly.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,126 @@
|
||||
---
|
||||
title: Checklist Configuring Rules for Servers in a Standalone Isolated Server Zone (Windows 10)
|
||||
description: Checklist Configuring Rules for Servers in a Standalone Isolated Server Zone
|
||||
ms.assetid: ccc09d06-ef75-43b0-9c77-db06f2940955
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone
|
||||
|
||||
|
||||
This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs for servers in a standalone isolated server zone that is not part of an isolated domain. In addition to requiring authentication and optionally encryption, servers in a server isolation zone are accessible only by users or computers that are authenticated as members of a network access group (NAG). The GPOs described here apply only to the isolated servers, not to the client computers that connect to them. For the GPOs for the client computers, see [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](../p_server_archive/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md).
|
||||
|
||||
The GPOs for isolated servers are similar to those for an isolated domain. This checklist refers you to those procedures for the creation of some of the rules. The other procedures in this checklist are for creating the restrictions that allow only members of the server access group to connect to the server.
|
||||
|
||||
## <a href="" id="bkmk-section1"></a>
|
||||
|
||||
|
||||
**Checklist: Configuring rules for isolated servers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2**
|
||||
|
||||
**Note**
|
||||
The GPOs for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 are usually similar. If this is true for your design, create one GPO, configure it by using the tasks in this checklist, and then create a copy of the GPO for the other operating system. For example, create and configure the GPO for Windows 8, make a copy of it for Windows Server 2012, and then follow the steps in this checklist to make the few required changes to the copy.
|
||||
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a GPO for the computers that need to have access restricted to the same set of client computers. If there are multiple servers running different versions of the Windows operating system, start by creating the GPO for one version of Windows. After you have finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Creating Group Policy Objects](../p_server_archive/checklist-creating-group-policy-objects.md)</p>
|
||||
<p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Copy a GPO to Create a New GPO](../p_server_archive/copy-a-gpo-to-create-a-new-gpo.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>If you are working on a copy of a GPO, modify the group memberships and WMI filters so that they are correct for the computers for which this GPO is intended.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Modify GPO Filters to Apply to a Different Zone or Version of Windows](../p_server_archive/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure IPsec to exempt all ICMP network traffic from IPsec protection.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Exempt ICMP from Authentication on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/exempt-icmp-from-authentication-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that exempts all network traffic to and from computers on the exemption list from IPsec.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Authentication Exemption List Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/create-an-authentication-exemption-list-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the key exchange (main mode) security methods and algorithms to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Key Exchange (Main Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-key-exchange--main-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the data protection (quick mode) algorithm combinations to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Data Protection (Quick Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-data-protection--quick-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the authentication methods to be used. This procedure sets the default settings for the computer. If you want to set authentication on a per-rule basis, this procedure is optional.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Authentication Methods on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-authentication-methods-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that requests authentication for all inbound network traffic.</p>
|
||||
<div class="alert">
|
||||
<strong>Important</strong>
|
||||
<p>Just as in an isolated domain, do not set the rules to require authentication until your testing is complete. That way, if the rules do not work as expected, communications are not affected by a failure to authenticate.</p>
|
||||
</div>
|
||||
<div>
|
||||
|
||||
</div></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Authentication Request Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/create-an-authentication-request-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>If your design requires encryption in addition to authentication for access to the isolated servers, then modify the rule to require it.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure the Rules to Require Encryption on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-the-rules-to-require-encryption-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the NAG to contain the computer or user accounts that are allowed to access the isolated servers. If you have multiple groups of isolated servers that are accessed by different client computers, then create a NAG for each set of servers.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create a Group Account in Active Directory](../p_server_archive/create-a-group-account-in-active-directory.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a firewall rule that allows inbound network traffic only if it is authenticated from a user or computer that is a member of the zone’s NAG.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Restrict Server Access to Members of a Group Only](../p_server_archive/restrict-server-access-to-members-of-a-group-only.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Link the GPO to the domain level of the Active Directory organizational unit hierarchy.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Link the GPO to the Domain](../p_server_archive/link-the-gpo-to-the-domain.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Add your test server to the membership group for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Test Computers to the Membership Group for a Zone](../p_server_archive/add-test-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
Do not change the rules for any of your zones to require authentication until all zones have been set up and thoroughly tested.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,73 @@
|
||||
---
|
||||
title: Checklist Configuring Rules for the Boundary Zone (Windows 10)
|
||||
description: Checklist Configuring Rules for the Boundary Zone
|
||||
ms.assetid: 25fe0197-de5a-4b4c-bc44-c6f0620ea94b
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Configuring Rules for the Boundary Zone
|
||||
|
||||
|
||||
The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain.
|
||||
|
||||
Rules for the boundary zone are typically the same as those for the isolated domain, with the exception that the final rule is left to only request, not require, authentication.
|
||||
|
||||
## <a href="" id="bkmk-section1"></a>
|
||||
|
||||
|
||||
**Checklist: Configuring boundary zone rules for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2**
|
||||
|
||||
A GPO for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2 can simply be copied and then customized. This checklist assumes that you have already created the GPO for the isolated domain as described in [Checklist: Implementing a Domain Isolation Policy Design](../p_server_archive/checklist-implementing-a-domain-isolation-policy-design.md). After you create a copy for the boundary zone, make sure that you do not change the rule from request authentication to require authentication when you create the other GPOs.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Make a copy of the domain isolation GPO for this version of Windows to serve as a starting point for the GPO for the boundary zone. Unlike the GPO for the main isolated domain zone, this copy is not changed after deployment to require authentication.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Copy a GPO to Create a New GPO](../p_server_archive/copy-a-gpo-to-create-a-new-gpo.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>If you are working on a copy of a GPO, modify the group memberships and WMI filters so that they are correct for the boundary zone and version of Windows for which this GPO is intended.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Modify GPO Filters to Apply to a Different Zone or Version of Windows](../p_server_archive/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Link the GPO to the domain level of the Active Directory organizational unit hierarchy.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Link the GPO to the Domain](../p_server_archive/link-the-gpo-to-the-domain.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Add your test computers to the membership group for the boundary zone. Be sure to add at least one for each operating system supported by a different GPO in the group.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Test Computers to the Membership Group for a Zone](../p_server_archive/add-test-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Verify that the connection security configuration is protecting network traffic with authentication when it can, and that unauthenticated traffic is accepted.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Verify That Network Traffic Is Authenticated](../p_server_archive/verify-that-network-traffic-is-authenticated.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,75 @@
|
||||
---
|
||||
title: Checklist Configuring Rules for the Encryption Zone (Windows 10)
|
||||
description: Checklist Configuring Rules for the Encryption Zone
|
||||
ms.assetid: 87b1787b-0c70-47a4-ae52-700bff505ea4
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Configuring Rules for the Encryption Zone
|
||||
|
||||
|
||||
This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain.
|
||||
|
||||
Rules for the encryption zone are typically the same as those for the isolated domain, with the exception that the main rule requires encryption in addition to authentication.
|
||||
|
||||
**Checklist: Configuring encryption zone rules for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2**
|
||||
|
||||
A GPO for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 can simply be copied and then customized. This checklist assumes that you have already created the GPO for the isolated domain as described in [Checklist: Implementing a Domain Isolation Policy Design](../p_server_archive/checklist-implementing-a-domain-isolation-policy-design.md). You can then copy those GPOs for use with the encryption zone. After you create the copies, modify the main rule to require encryption in addition to the authentication required by the rest of the isolated domain.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Make a copy of the domain isolation GPOs to serve as a starting point for the GPOs for the encryption zone.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Copy a GPO to Create a New GPO](../p_server_archive/copy-a-gpo-to-create-a-new-gpo.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Modify the group memberships and WMI filters so that they are correct for the encryption zone and the version of Windows for which this GPO is intended.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Modify GPO Filters to Apply to a Different Zone or Version of Windows](../p_server_archive/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Add the encryption requirements for the zone.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure the Rules to Require Encryption on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-the-rules-to-require-encryption-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Link the GPO to the domain level of the Active Directory organizational unit hierarchy.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Link the GPO to the Domain](../p_server_archive/link-the-gpo-to-the-domain.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Add your test computers to the membership group for the encryption zone. Be sure to add at least one for each operating system supported by a different GPO in the group.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Test Computers to the Membership Group for a Zone](../p_server_archive/add-test-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Verify that the connection security rules are protecting network traffic.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Verify That Network Traffic Is Authenticated](../p_server_archive/verify-that-network-traffic-is-authenticated.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,107 @@
|
||||
---
|
||||
title: Checklist Configuring Rules for the Isolated Domain (Windows 10)
|
||||
description: Checklist Configuring Rules for the Isolated Domain
|
||||
ms.assetid: bfd2d29e-4011-40ec-a52e-a67d4af9748e
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Configuring Rules for the Isolated Domain
|
||||
|
||||
|
||||
The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain.
|
||||
|
||||
## <a href="" id="bkmk-section1"></a>
|
||||
|
||||
|
||||
**Checklist: Configuring isolated domain rules for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2**
|
||||
|
||||
**Note**
|
||||
The GPOs for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 are usually similar. If this is true for your design, create one GPO, configure it by using the tasks in this checklist, and then make a copy of the GPO for the other operating system. For example, create and configure the GPO for Windows 8, make a copy of it for Windows Server 2012, and then follow the steps in this checklist to make the few required changes to the copy.
|
||||
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a GPO for the computers in the isolated domain running one of the operating systems. After you have finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Creating Group Policy Objects](../p_server_archive/checklist-creating-group-policy-objects.md)</p>
|
||||
<p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Copy a GPO to Create a New GPO](../p_server_archive/copy-a-gpo-to-create-a-new-gpo.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>If you are working on a GPO that was copied from another GPO, modify the group memberships and WMI filters so that they are correct for the isolated domain zone and the version of Windows for which this GPO is intended.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Modify GPO Filters to Apply to a Different Zone or Version of Windows](../p_server_archive/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure IPsec to exempt all ICMP network traffic from IPsec protection.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Exempt ICMP from Authentication on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/exempt-icmp-from-authentication-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that exempts all network traffic to and from computers on the exemption list from IPsec.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Authentication Exemption List Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/create-an-authentication-exemption-list-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the key exchange (main mode) security methods and algorithms to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Key Exchange (Main Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-key-exchange--main-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the data protection (quick mode) algorithm combinations to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Data Protection (Quick Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-data-protection--quick-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the authentication methods to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Authentication Methods on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-authentication-methods-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the rule that requests authentication for all inbound network traffic.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Authentication Request Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/create-an-authentication-request-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Link the GPO to the domain level of the AD DS organizational unit hierarchy.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Link the GPO to the Domain](../p_server_archive/link-the-gpo-to-the-domain.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Add your test computers to the membership group for the isolated domain. Be sure to add at least one for each operating system supported by a different GPO in the group.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Test Computers to the Membership Group for a Zone](../p_server_archive/add-test-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Verify that the connection security rules are protecting network traffic to and from the test computers.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Verify That Network Traffic Is Authenticated](../p_server_archive/verify-that-network-traffic-is-authenticated.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
Do not change the rules for any of your zones to require authentication until all of the zones have been set up and are operating correctly.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,97 @@
|
||||
---
|
||||
title: Checklist Creating Group Policy Objects (Windows 10)
|
||||
description: Checklist Creating Group Policy Objects
|
||||
ms.assetid: e99bd6a4-34a7-47b5-9791-ae819977a559
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Creating Group Policy Objects
|
||||
|
||||
|
||||
To deploy firewall or IPsec settings or firewall or connection security rules, we recommend that you use Group Policy in AD DS. This section describes a tested, efficient method that requires some up-front work, but serves an administrator well in the long run by making GPO assignments as easy as dropping a computer into a membership group.
|
||||
|
||||
The checklists for firewall, domain isolation, and server isolation include a link to this checklist.
|
||||
|
||||
## About membership groups
|
||||
|
||||
|
||||
For most GPO deployment tasks, you must determine which computers must receive and apply which GPOs. Because different versions of Windows can support different settings and rules to achieve similar behavior, you might need multiple GPOs: one for each operating system that has settings different from the others to achieve the same result. For example, Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 use rules and settings that are incompatible with Windows 2000, Windows XP, and Windows Server 2003. Therefore, if your network included those older operating systems you would need to create a GPO for each set of operating systems that can share common settings. To deploy typical domain isolation settings and rules, you might have five different GPOs for the versions of Windows discussed in this guide. By following the procedures in this guide, you only need one membership group to manage all five GPOs. The membership group is identified in the security group filter for all five GPOs. To apply the settings to a computer, you make that computer's account a member of the membership group. WMI filters are used to ensure that the correct GPO is applied.
|
||||
|
||||
## About exclusion groups
|
||||
|
||||
|
||||
A Windows Firewall with Advanced Security design must often take into account domain-joined computers on the network that cannot or must not apply the rules and settings in the GPOs. Because these computers are typically fewer in number than the computers that must apply the GPO, it is easier to use the Domain Members group in the GPO membership group, and then place these exception computers into an exclusion group that is denied Apply Group Policy permissions on the GPO. Because deny permissions take precedence over allow permissions, a computer that is a member of both the membership group and the exception group is prevented from applying the GPO. Computers typically found in a GPO exclusion group for domain isolation include the domain controllers, DHCP servers, and DNS servers.
|
||||
|
||||
You can also use a membership group for one zone as an exclusion group for another zone. For example, computers in the boundary and encryption zones are technically in the main domain isolation zone, but must apply only the GPO for their assigned role. To do this, the GPOs for the main isolation zone deny Apply Group Policy permissions to members of the boundary and encryption zones.
|
||||
|
||||
**Checklist: Creating Group Policy objects**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Review important concepts and examples for deploying GPOs in a way that best meets the needs of your organization.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Identifying Your Windows Firewall with Advanced Security Deployment Goals](../p_server_archive/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)</p>
|
||||
<p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Planning Group Policy Deployment for Your Isolation Zones](../p_server_archive/planning-group-policy-deployment-for-your-isolation-zones.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the membership group in AD DS that will be used to contain computer accounts that must receive the GPO.</p>
|
||||
<p>If some computers in the membership group are running an operating system that does not support WMI filters, such as Windows 2000, create an exclusion group to contain the computer accounts for the computers that cannot be blocked by using a WMI filter.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create a Group Account in Active Directory](../p_server_archive/create-a-group-account-in-active-directory.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a GPO for each version of Windows that has different implementation requirements.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create a Group Policy Object](../p_server_archive/create-a-group-policy-object.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create security group filters to limit the GPO to only computers that are members of the membership group and to exclude computers that are members of the exclusion group.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Assign Security Group Filters to the GPO](../p_server_archive/assign-security-group-filters-to-the-gpo.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create WMI filters to limit each GPO to only the computers that match the criteria in the filter.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create WMI Filters for the GPO](../p_server_archive/create-wmi-filters-for-the-gpo.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>If you are working on a GPO that was copied from another, modify the group memberships and WMI filters so that they are correct for the new zone or version of Windows for which this GPO is intended.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Modify GPO Filters to Apply to a Different Zone or Version of Windows](../p_server_archive/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Link the GPO to the domain level of the Active Directory organizational unit hierarchy.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Link the GPO to the Domain](../p_server_archive/link-the-gpo-to-the-domain.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Before adding any rules or configuring the GPO, add a few test computers to the membership group, and make sure that the correct GPO is received and applied to each member of the group.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Test Computers to the Membership Group for a Zone](../p_server_archive/add-test-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,69 @@
|
||||
---
|
||||
title: Checklist Creating Inbound Firewall Rules (Windows 10)
|
||||
description: Checklist Creating Inbound Firewall Rules
|
||||
ms.assetid: 0520e14e-5c82-48da-8fbf-87cef36ce02f
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Creating Inbound Firewall Rules
|
||||
|
||||
|
||||
This checklist includes tasks for creating firewall rules in your GPOs.
|
||||
|
||||
## <a href="" id="bkmk-section1"></a>
|
||||
|
||||
|
||||
**Checklist: Creating inbound firewall rules for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that allows a program to listen for and accept inbound network traffic on any ports it requires.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Inbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-program-or-service-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that allows inbound network traffic on a specified port number.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Inbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-port-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that allows inbound ICMP network traffic.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Inbound ICMP Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-icmp-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create rules that allow inbound RPC network traffic.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create Inbound Rules to Support RPC on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-inbound-rules-to-support-rpc-on-windows-8-windows-7--windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Enable Predefined Inbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/enable-predefined-inbound-rules-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,61 @@
|
||||
---
|
||||
title: Checklist Creating Outbound Firewall Rules (Windows 10)
|
||||
description: Checklist Creating Outbound Firewall Rules
|
||||
ms.assetid: 611bb98f-4e97-411f-82bf-7a844a4130de
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Creating Outbound Firewall Rules
|
||||
|
||||
|
||||
This checklist includes tasks for creating outbound firewall rules in your GPOs. Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 support the use of outbound rules.
|
||||
|
||||
**Important**
|
||||
By default, in Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2, outbound filtering is disabled. Because all outbound network traffic is permitted, outbound rules are typically used to block traffic that is not wanted on the network. However, it is a best practice for an administrator to create outbound allow rules for those applications that are approved for use on the organization’s network. If you do this, then you have the option to set the default outbound behavior to block, preventing any network traffic that is not specifically authorized by the rules you create.
|
||||
|
||||
|
||||
|
||||
**Checklist: Creating outbound firewall rules for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that allows a program to send any outbound network traffic on any port it requires.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Outbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2](../p_server_archive/create-an-outbound-program-or-service-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that allows outbound network traffic on a specified port number.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Outbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2](../p_server_archive/create-an-outbound-port-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Enable Predefined Outbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/enable-predefined-outbound-rules-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,100 @@
|
||||
---
|
||||
title: Checklist Creating Rules for Clients of a Standalone Isolated Server Zone (Windows 10)
|
||||
description: Checklist Creating Rules for Clients of a Standalone Isolated Server Zone
|
||||
ms.assetid: 6a5e6478-add3-47e3-8221-972549e013f6
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone
|
||||
|
||||
|
||||
This checklist includes tasks for configuring connection security rules and IPsec settings in the GPOs for client computers that must connect to servers in an isolated server zone.
|
||||
|
||||
## <a href="" id="bkmk-section1"></a>
|
||||
|
||||
|
||||
**Checklist: Configuring isolated server zone client rules for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2**
|
||||
|
||||
**Note**
|
||||
The GPOs for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 are usually similar. If this is true for your design, create one GPO, configure it by using the tasks in this checklist, and then create a copy of the GPO. For example, create and configure the GPO for Windows 8, create a copy of it for Windows Server 2012, and then follow the steps in this checklist to make the required changes (if any) to the copy.
|
||||
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a GPO for the client computers that must connect to servers in the isolated server zone, and that are running one of the versions of Windows. After you have finished the tasks in this checklist, you can make a copy of it.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Creating Group Policy Objects](../p_server_archive/checklist-creating-group-policy-objects.md)</p>
|
||||
<p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Copy a GPO to Create a New GPO](../p_server_archive/copy-a-gpo-to-create-a-new-gpo.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>To determine which computers receive the GPO, assign the NAG for the isolated servers to the security group filter for the GPO. Make sure that each GPO has the WMI filter for the correct version of Windows.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Modify GPO Filters to Apply to a Different Zone or Version of Windows](../p_server_archive/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure IPsec to exempt all ICMP network traffic from IPsec protection.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Exempt ICMP from Authentication on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/exempt-icmp-from-authentication-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that exempts all network traffic to and from computers on the exemption list from IPsec.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Authentication Exemption List Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/create-an-authentication-exemption-list-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the key exchange (main mode) security methods and algorithms to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Key Exchange (Main Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-key-exchange--main-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the data protection (quick mode) algorithm combinations to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Data Protection (Quick Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-data-protection--quick-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the authentication methods to be used.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Authentication Methods on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-authentication-methods-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create a rule that requests authentication for network traffic. Because fallback-to-clear behavior in Windows Vista and Windows Server 2008 has no delay when communicating with computers that cannot use IPsec, you can use the same any-to-any rule used in an isolated domain.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Create an Authentication Request Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/create-an-authentication-request-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Link the GPO to the domain level of the Active Directory organizational unit hierarchy.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Link the GPO to the Domain](../p_server_archive/link-the-gpo-to-the-domain.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Add your test computers to the NAG for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Test Computers to the Membership Group for a Zone](../p_server_archive/add-test-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,97 @@
|
||||
---
|
||||
title: Checklist Implementing a Basic Firewall Policy Design (Windows 10)
|
||||
description: Checklist Implementing a Basic Firewall Policy Design
|
||||
ms.assetid: 6caf0c1e-ac72-4f9d-a986-978b77fbbaa3
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Implementing a Basic Firewall Policy Design
|
||||
|
||||
|
||||
This parent checklist includes cross-reference links to important concepts about the basic firewall policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design.
|
||||
|
||||
**Note**
|
||||
Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist.
|
||||
|
||||
The procedures in this section use the Group Policy MMC snap-in interfaces to configure the GPOs, but you can also use Windows PowerShell. For more information, see [Windows Firewall with Advanced Security Administration with Windows PowerShell](http://technet.microsoft.com/library/hh831755.aspx) at http://technet.microsoft.com/library/hh831755.aspx.
|
||||
|
||||
|
||||
|
||||
 **Checklist: Implementing a basic firewall policy design**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Review important concepts and examples for the basic firewall policy design to determine if this design meets the needs of your organization.</p></td>
|
||||
<td><p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Identifying Your Windows Firewall with Advanced Security Deployment Goals](../p_server_archive/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Basic Firewall Policy Design](../p_server_archive/basic-firewall-policy-design.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Firewall Policy Design Example](../p_server_archive/firewall-policy-design-example.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Planning Settings for a Basic Firewall Policy](../p_server_archive/planning-settings-for-a-basic-firewall-policy.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the membership group and a GPO for each set of computers that require different firewall rules. Where GPOs will be similar, such as for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2, create one GPO, configure it by using the tasks in this checklist, and then make a copy of the GPO for the other version of Windows. For example, create and configure the GPO for Windows 8, make a copy of it for Windows Server 2012, and then follow the steps in this checklist to make the few required changes to the copy.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Creating Group Policy Objects](../p_server_archive/checklist-creating-group-policy-objects.md)</p>
|
||||
<p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Copy a GPO to Create a New GPO](../p_server_archive/copy-a-gpo-to-create-a-new-gpo.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>If you are working on a GPO that was copied from another, modify the group membership and WMI filters so that they are correct for the computers for which this GPO is intended.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Modify GPO Filters to Apply to a Different Zone or Version of Windows](../p_server_archive/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the GPO with firewall default settings appropriate for your design.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Configuring Basic Firewall Settings](../p_server_archive/checklist-configuring-basic-firewall-settings.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create one or more inbound firewall rules to allow unsolicited inbound network traffic.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Creating Inbound Firewall Rules](../p_server_archive/checklist-creating-inbound-firewall-rules.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create one or more outbound firewall rules to block unwanted outbound network traffic.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Creating Outbound Firewall Rules](../p_server_archive/checklist-creating-outbound-firewall-rules.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Link the GPO to the domain level of the Active Directory organizational unit hierarchy.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Link the GPO to the Domain](../p_server_archive/link-the-gpo-to-the-domain.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Add test computers to the membership group, and then confirm that the computers receive the firewall rules from the GPOs as expected.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Test Computers to the Membership Group for a Zone](../p_server_archive/add-test-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>According to the testing and roll-out schedule in your design plan, add computer accounts to the membership group to deploy the completed firewall policy settings to your computers.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Production Computers to the Membership Group for a Zone](../p_server_archive/add-production-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,76 @@
|
||||
---
|
||||
title: Checklist Implementing a Certificate-based Isolation Policy Design (Windows 10)
|
||||
description: Checklist Implementing a Certificate-based Isolation Policy Design
|
||||
ms.assetid: 1e34b5ea-2e77-4598-a765-550418d33894
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Implementing a Certificate-based Isolation Policy Design
|
||||
|
||||
|
||||
This parent checklist includes cross-reference links to important concepts about using certificates as an authentication option in either a domain isolation or server isolation design.
|
||||
|
||||
**Note**
|
||||
Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist
|
||||
|
||||
The procedures in this section use the Group Policy MMC snap-in interfaces to configure the GPOs, but you can also use Windows PowerShell. For more information, see [Windows Firewall with Advanced Security Administration with Windows PowerShell](http://technet.microsoft.com/library/hh831755.aspx) at http://technet.microsoft.com/library/hh831755.aspx.
|
||||
|
||||
|
||||
|
||||
 **Checklist: Implementing certificate-based authentication**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Review important concepts and examples for certificate-based authentication to determine if this design meets your deployment goals and the needs of your organization.</p></td>
|
||||
<td><p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Identifying Your Windows Firewall with Advanced Security Deployment Goals](../p_server_archive/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Certificate-based Isolation Policy Design](../p_server_archive/certificate-based-isolation-policy-design.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Certificate-based Isolation Policy Design Example](../p_server_archive/certificate-based-isolation-policy-design-example.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Planning Certificate-based Authentication](../p_server_archive/planning-certificate-based-authentication.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Install the Active Directory Certificate Services (AD CS) role as an enterprise root issuing certification authority (CA). This step is required only if you have not already deployed a CA on your network.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Install Active Directory Certificate Services](../p_server_archive/install-active-directory-certificate-services.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure the certificate template for workstation authentication certificates.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure the Workstation Authentication Certificate Template](../p_server_archive/configure-the-workstation-authentication-certificate-templatewfas-dep.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Configure Group Policy to automatically deploy certificates based on your template to workstation computers.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Configure Group Policy to Autoenroll and Deploy Certificates](../p_server_archive/configure-group-policy-to-autoenroll-and-deploy-certificates.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>On a test computer, refresh Group Policy and confirm that the certificate is installed.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Confirm That Certificates Are Deployed Correctly](../p_server_archive/confirm-that-certificates-are-deployed-correctly.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,88 @@
|
||||
---
|
||||
title: Checklist Implementing a Domain Isolation Policy Design (Windows 10)
|
||||
description: Checklist Implementing a Domain Isolation Policy Design
|
||||
ms.assetid: 76586eb3-c13c-4d71-812f-76bff200fc20
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Implementing a Domain Isolation Policy Design
|
||||
|
||||
|
||||
This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design.
|
||||
|
||||
**Note**
|
||||
Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist.
|
||||
|
||||
The procedures in this section use the Group Policy MMC snap-ins to configure the GPOs, but you can also use Windows PowerShell to configure GPOs. For more information, see [Windows Firewall with Advanced Security Administration with Windows PowerShell](http://technet.microsoft.com/library/hh831755.aspx) at http://technet.microsoft.com/library/hh831755.aspx.
|
||||
|
||||
For more information about the security algorithms and authentication methods available in each version of Windows, see [IPsec Algorithms and Methods Supported in Windows](http://technet.microsoft.com/library/dd125380.aspx) at http://technet.microsoft.com/library/dd125380.aspx.
|
||||
|
||||
|
||||
|
||||
 **Checklist: Implementing a domain isolation policy design**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Review important concepts and examples for the domain isolation policy design, determine your Windows Firewall with Advanced Security deployment goals, and customize this design to meet the needs of your organization.</p></td>
|
||||
<td><p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Identifying Your Windows Firewall with Advanced Security Deployment Goals](../p_server_archive/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Domain Isolation Policy Design](../p_server_archive/domain-isolation-policy-design.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Domain Isolation Policy Design Example](../p_server_archive/domain-isolation-policy-design-example.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Planning Domain Isolation Zones](../p_server_archive/planning-domain-isolation-zones.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the GPOs and connection security rules for the isolated domain.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Configuring Rules for the Isolated Domain](../p_server_archive/checklist-configuring-rules-for-the-isolated-domain.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the GPOs and connection security rules for the boundary zone.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Configuring Rules for the Boundary Zone](../p_server_archive/checklist-configuring-rules-for-the-boundary-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the GPOs and connection security rules for the encryption zone.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Configuring Rules for the Encryption Zone](../p_server_archive/checklist-configuring-rules-for-the-encryption-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the GPOs and connection security rules for the isolated server zone.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Configuring Rules for an Isolated Server Zone](../p_server_archive/checklist-configuring-rules-for-an-isolated-server-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>According to the testing and roll-out schedule in your design plan, add computer accounts to the membership group to deploy rules and settings to your computers.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Production Computers to the Membership Group for a Zone](../p_server_archive/add-production-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>After you confirm that network traffic is authenticated by IPsec, you can change authentication rules for the isolated domain and encryption zone from request to require mode.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Change Rules from Request to Require Mode](../p_server_archive/change-rules-from-request-to-require-mode.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,83 @@
|
||||
---
|
||||
title: Checklist Implementing a Standalone Server Isolation Policy Design (Windows 10)
|
||||
description: Checklist Implementing a Standalone Server Isolation Policy Design
|
||||
ms.assetid: 50a997d8-f079-408c-8ac6-ecd02078ade3
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Checklist: Implementing a Standalone Server Isolation Policy Design
|
||||
|
||||
|
||||
This checklist contains procedures for creating a server isolation policy design that is not part of an isolated domain. For the steps required to create an isolated server zone within an isolated domain, see [Checklist: Configuring Rules for an Isolated Server Zone](../p_server_archive/checklist-configuring-rules-for-an-isolated-server-zone.md).
|
||||
|
||||
This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design.
|
||||
|
||||
**Note**
|
||||
Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist.
|
||||
|
||||
The procedures in this section use the Group Policy MMC snap-in interfaces to configure the GPOs, but you can also use Windows PowerShell. For more information, see [Windows Firewall with Advanced Security Administration with Windows PowerShell](http://technet.microsoft.com/library/hh831755.aspx) at http://technet.microsoft.com/library/hh831755.aspx.
|
||||
|
||||
|
||||
|
||||
 **Checklist: Implementing a standalone server isolation policy design**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th></th>
|
||||
<th>Task</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Review important concepts and examples for the server isolation policy design to determine if this design meets your deployment goals and the needs of your organization.</p></td>
|
||||
<td><p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Identifying Your Windows Firewall with Advanced Security Deployment Goals](../p_server_archive/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Server Isolation Policy Design](../p_server_archive/server-isolation-policy-design.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Server Isolation Policy Design Example](../p_server_archive/server-isolation-policy-design-example.md)</p>
|
||||
<p><img src="images/faa393df-4856-4431-9eda-4f4e5be72a90.gif" alt="Conceptual topic" />[Planning Server Isolation Zones](../p_server_archive/planning-server-isolation-zones.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the GPOs and connection security rules for isolated servers.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](../p_server_archive/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Create the GPOs and connection security rules for the client computers that must connect to the isolated servers.</p></td>
|
||||
<td><p><img src="images/bc6cea1a-1c6c-4124-8c8f-1df5adfe8c88.gif" alt="Checklist topic" />[Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](../p_server_archive/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>Verify that the connection security rules are protecting network traffic on your test computers.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Verify That Network Traffic Is Authenticated](../p_server_archive/verify-that-network-traffic-is-authenticated.md)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>After you confirm that network traffic is authenticated by IPsec as expected, you can change authentication rules for the isolated server zone to require authentication instead of requesting it.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Change Rules from Request to Require Mode](../p_server_archive/change-rules-from-request-to-require-mode.md)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><img src="images/wfas-icon-checkbox.gif" alt="_" /></p></td>
|
||||
<td><p>According to the testing and roll-out schedule in your design plan, add computer accounts for the client computers to the membership group so that you can deploy the settings.</p></td>
|
||||
<td><p><img src="images/15dd35b6-6cc6-421f-93f8-7109920e7144.gif" alt="Procedure topic" />[Add Production Computers to the Membership Group for a Zone](../p_server_archive/add-production-computers-to-the-membership-group-for-a-zone.md)</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,84 @@
|
||||
---
|
||||
title: Configure Authentication Methods on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 (Windows 10)
|
||||
description: Configure Authentication Methods on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
ms.assetid: 5fcdc523-617f-4233-9213-15fe19f4cd02
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Configure Authentication Methods on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
|
||||
|
||||
This procedure shows you how to configure the authentication methods that can be used by computers in an isolated domain or standalone isolated server zone.
|
||||
|
||||
**Note**
|
||||
If you follow the steps in the procedure in this topic, you alter the system-wide default settings. Any connection security rule can use these settings by specifying **Default** on the **Authentication** tab.
|
||||
|
||||
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To configure authentication methods**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the details pane on the main Windows Firewall with Advanced Security page, click **Windows Firewall Properties**.
|
||||
|
||||
3. On the **IPsec Settings** tab, click **Customize**.
|
||||
|
||||
4. In the **Authentication Method** section, select the type of authentication that you want to use from among the following:
|
||||
|
||||
1. **Default**. Selecting this option tells the computer to use the authentication method currently defined by the local administrator in Windows Firewall with Advanced Security or by Group Policy as the default.
|
||||
|
||||
2. **Computer and User (using Kerberos V5)**. Selecting this option tells the computer to use and require authentication of both the computer and the currently logged-on user by using their domain credentials. This authentication method works only with other computers that can use Authenticated IP (AuthIP), including Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. User-based authentication using Kerberos V5 is not supported by IKE v1.
|
||||
|
||||
3. **Computer (using Kerberos V5)**. Selecting this option tells the computer to use and require authentication of the computer by using its domain credentials. This option works with other computers that can use IKE v1, including earlier versions of Windows.
|
||||
|
||||
4. **User (using Kerberos V5)**. Selecting this option tells the computer to use and require authentication of the currently logged-on user by using his or her domain credentials. This authentication method works only with other computers that can use AuthIP, including Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. User-based authentication using Kerberos V5 is not supported by IKE v1.
|
||||
|
||||
5. **Computer certificate from this certification authority**. Selecting this option and entering the identification of a certification authority (CA) tells the computer to use and require authentication by using a certificate that is issued by the selected CA. If you also select **Accept only health certificates**, then only certificates that include the system health authentication enhanced key usage (EKU) typically provided in a Network Access Protection (NAP) infrastructure can be used for this rule.
|
||||
|
||||
6. **Advanced**. Click **Customize** to specify a custom combination of authentication methods required for your scenario. You can specify both a **First authentication method** and a **Second authentication method**.
|
||||
|
||||
The first authentication method can be one of the following:
|
||||
|
||||
- **Computer (Kerberos V5)**. Selecting this option tells the computer to use and require authentication of the computer by using its domain credentials. This option works with other computers that can use IKE v1, including earlier versions of Windows.
|
||||
|
||||
- **Computer (NTLMv2)**. Selecting this option tells the computer to use and require authentication of the computer by using its domain credentials. This option works only with other computers that can use AuthIP, including Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. User-based authentication using Kerberos V5 is not supported by IKE v1.
|
||||
|
||||
- **Computer certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require authentication by using a certificate that is issued by that CA. If you also select **Accept only health certificates**, then only certificates issued by a NAP server can be used.
|
||||
|
||||
- **Preshared key (not recommended)**. Selecting this method and entering a preshared key tells the computer to authenticate by exchanging the preshared keys. If they match, then the authentication succeeds. This method is not recommended, and is included only for backward compatibility and testing purposes.
|
||||
|
||||
If you select **First authentication is optional**, then the connection can succeed even if the authentication attempt specified in this column fails.
|
||||
|
||||
The second authentication method can be one of the following:
|
||||
|
||||
- **User (Kerberos V5)**. Selecting this option tells the computer to use and require authentication of the currently logged-on user by using his or her domain credentials. This authentication method works only with other computers that can use AuthIP, including Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. User-based authentication using Kerberos V5 is not supported by IKE v1.
|
||||
|
||||
- **User (NTLMv2)**. Selecting this option tells the computer to use and require authentication of the currently logged-on user by using his or her domain credentials, and uses the NTLMv2 protocol instead of Kerberos V5. This authentication method works only with other computers that can use AuthIP, including Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. User-based authentication using Kerberos V5 is not supported by IKE v1.
|
||||
|
||||
- **User health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require user-based authentication by using a certificate that is issued by the specified CA. If you also select **Enable certificate to account mapping**, then the certificate can be associated with a user in Active Directory for purposes of granting or denying access to specified users or user groups.
|
||||
|
||||
- **Computer health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require authentication by using a certificate that is issued by the specified CA. If you also select **Accept only health certificates**, then only certificates that include the system health authentication EKU typically provided in a NAP infrastructure can be used for this rule.
|
||||
|
||||
If you select **Second authentication is optional**, then the connection can succeed even if the authentication attempt specified in this column fails.
|
||||
|
||||
**Important**
|
||||
Make sure that you do not select the check boxes to make both first and second authentication optional. Doing so allows plaintext connections whenever authentication fails.
|
||||
|
||||
|
||||
|
||||
5. Click **OK** on each dialog box to save your changes and return to the Group Policy Management Editor.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,66 @@
|
||||
---
|
||||
title: Configure Data Protection (Quick Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 (Windows 10)
|
||||
description: Configure Data Protection (Quick Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
ms.assetid: fdcb1b36-e267-4be7-b842-5df9a067c9e0
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Configure Data Protection (Quick Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
|
||||
|
||||
This procedure shows you how to configure the data protection (quick mode) settings for connection security rules in an isolated domain or a standalone isolated server zone.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To configure quick mode settings**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the details pane on the main Windows Firewall with Advanced Security page, click **Windows Firewall Properties**.
|
||||
|
||||
3. On the **IPsec Settings** tab, click **Customize**.
|
||||
|
||||
4. In the **Data protection (Quick Mode)** section, click **Advanced**, and then click **Customize**.
|
||||
|
||||
5. If you require encryption for all network traffic in the specified zone, then check **Require encryption for all connection security rules that use these settings**. Selecting this option disables the **Data integrity** section, and forces you to select only integrity algorithms that are combined with an encryption algorithm. If you do not select this option, then you can use only data integrity algorithms. Before selecting this option, consider the performance impact and the increase in network traffic that will result. We recommend that you use this setting only on network traffic that truly requires it, such as to and from computers in the encryption zone.
|
||||
|
||||
6. If you did not select **Require encryption**, then select the data integrity algorithms that you want to use to help protect the data sessions between the two computers. If the data integrity algorithms displayed in the list are not what you want, then do the following:
|
||||
|
||||
1. From the left column, remove any of the data integrity algorithms that you do not want by selecting the algorithm and then clicking **Remove**.
|
||||
|
||||
2. Add any required data integrity algorithms by clicking **Add**, selecting the appropriate protocol (ESP or AH) and algorithm (SHA1 or MD5), selecting the key lifetime in minutes or sessions, and then clicking **OK**. We recommend that you do not include MD5 in any combination. It is included for backward compatibility only. We also recommend that you use ESP instead of AH if you have any devices on your network that use network address translation (NAT).
|
||||
|
||||
3. In **Key lifetime (in sessions)**, type the number of times that the quick mode session can be rekeyed. After this number is reached, the quick mode SA must be renegotiated. Be careful to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance because of the more frequent renegotiating of the quick mode SA. We recommend that you use the default value unless your risk analysis indicates the need for a different value.
|
||||
|
||||
4. Click **OK** to save your algorithm combination settings.
|
||||
|
||||
5. After the list contains only the combinations you want, use the up and down arrows to the right of the list to rearrange them in the correct order for your design. The algorithm combination that is first in the list is tried first, and so on.
|
||||
|
||||
7. Select the data integrity and encryption algorithms that you want to use to help protect the data sessions between the two computers. If the algorithm combinations displayed in the list are not what you want, then do the following:
|
||||
|
||||
1. From the second column, remove any of the data integrity and encryption algorithms that you do not want by selecting the algorithm combination and then clicking **Remove**.
|
||||
|
||||
2. Add any required integrity and encryption algorithm combinations by clicking **Add**, and then doing the following:
|
||||
|
||||
3. Select the appropriate protocol (ESP or AH). We recommend that you use ESP instead of AH if you have any devices on your network that use NAT.
|
||||
|
||||
4. Select the appropriate encryption algorithm. The choices include, in order of decreasing security: AES-256, AES-192, AES-128, 3DES, and DES. We recommend that you do not include DES in any combination. It is included for backward compatibility only.
|
||||
|
||||
5. Select the appropriate integrity algorithm (SHA1 or MD5). We recommend that you do not include MD5 in any combination. It is included for backward compatibility only.
|
||||
|
||||
6. In **Key lifetime (in minutes)**, type the number of minutes. When the specified number of minutes has elapsed, any IPsec operations between the two computers that negotiated this key will require a new key. Be careful to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance because of the more frequent rekeying. We recommend that you use the default value unless your risk analysis indicates the need for a different value.
|
||||
|
||||
8. Click **OK** three times to save your settings.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,42 @@
|
||||
---
|
||||
title: Configure Group Policy to Autoenroll and Deploy Certificates (Windows 10)
|
||||
description: Configure Group Policy to Autoenroll and Deploy Certificates
|
||||
ms.assetid: faeb62b5-2cc3-42f7-bee5-53ba45d05c09
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Configure Group Policy to Autoenroll and Deploy Certificates
|
||||
|
||||
|
||||
You can use this procedure to configure Group Policy to automatically enroll client computer certificates and deploy them to the workstations on your network. Follow this procedure for each GPO that contains IPsec connection security rules that require this certificate.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of both the Domain Admins group in the root domain of your forest and a member of the Enterprise Admins group.
|
||||
|
||||
**To configure Group Policy to autoenroll certificates**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click **Start**, click **Administrative Tools**, and then click **Group Policy Management**.
|
||||
|
||||
2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, expand **Group Policy Objects**, right-click the GPO you want to modify, and then click **Edit**.
|
||||
|
||||
3. In the navigation pane, expand the following path: **Computer Configuration**, **Policies**, **Windows Settings**, **Security Settings**, **Public Key Policies**.
|
||||
|
||||
4. Double-click **Certificate Services Client - Auto-Enrollment**.
|
||||
|
||||
5. In the **Properties** dialog box, change **Configuration Model** to **Enabled**.
|
||||
|
||||
6. Select both **Renew expired certificates, update pending certificates, and remove revoked certificates** and **Update certificates that use certificate templates**.
|
||||
|
||||
7. Click **OK** to save your changes. Computers apply the GPO and download the certificate the next time Group Policy is refreshed.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,79 @@
|
||||
---
|
||||
title: Configure Key Exchange (Main Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 (Windows 10)
|
||||
description: Configure Key Exchange (Main Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
ms.assetid: 5c593b6b-2cd9-43de-9b4e-95943fe82f52
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Configure Key Exchange (Main Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
|
||||
|
||||
This procedure shows you how to configure the main mode key exchange settings used to secure the IPsec authentication traffic.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To configure key exchange settings**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the details pane on the main Windows Firewall with Advanced Security page, click **Windows Firewall Properties**.
|
||||
|
||||
3. On the **IPsec Settings** tab, click **Customize**.
|
||||
|
||||
4. In the **Key exchange (Main Mode)** section, click **Advanced**, and then click **Customize**.
|
||||
|
||||
5. Select the security methods to be used to help protect the main mode negotiations between the two computers. If the security methods displayed in the list are not what you want, then do the following:
|
||||
|
||||
**Important**
|
||||
In Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2, you can specify only one key exchange algorithm. This means that if you want to communicate by using IPsec with another computer running Windows 8 or Windows Server 2012, then you must select the same key exchange algorithm on both computers.
|
||||
|
||||
Also, if you create a connection security rule that specifies an option that requires AuthIP instead of IKE, then only the one combination of the top integrity and encryption security method are used in the negotiation. Make sure that all of your computers that run Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2 have the same methods at the top of the list and the same key exchange algorithm selected.
|
||||
|
||||
|
||||
|
||||
**Note**
|
||||
When AuthIP is used, no Diffie-Hellman key exchange protocol is used. Instead, when Kerberos V5 authentication is requested, the Kerberos V5 service ticket secret is used in place of a Diffie-Hellman value. When either certificate authentication or NTLM authentication is requested, a transport level security (TLS) session is established, and its secret is used in place of the Diffie-Hellman value. This happens no matter which Diffie-Hellman key exchange protocol you select.
|
||||
|
||||
|
||||
|
||||
1. Remove any of the security methods that you do not want by selecting the method and then clicking **Remove**.
|
||||
|
||||
2. Add any required security method combinations by clicking **Add**, selecting the appropriate encryption algorithm and integrity algorithm from the lists, and then clicking **OK**.
|
||||
|
||||
**Caution**
|
||||
We recommend that you do not include MD5 or DES in any combination. They are included for backward compatibility only.
|
||||
|
||||
|
||||
|
||||
3. After the list contains only the combinations you want, use the up and down arrows to the right of the list to arrange them in the order of preference. The combination that appears first in the list is tried first, and so on.
|
||||
|
||||
6. From the list on the right, select the key exchange algorithm that you want to use.
|
||||
|
||||
**Caution**
|
||||
We recommend that you do not use Diffie-Hellman Group 1. It is included for backward compatibility only.
|
||||
|
||||
|
||||
|
||||
7. In **Key lifetime (in minutes)**, type the number of minutes. When the specified number of minutes has elapsed, any IPsec operation between the two computers requires a new key.
|
||||
|
||||
**Note**
|
||||
You need to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance.
|
||||
|
||||
|
||||
|
||||
8. In **Key lifetime (in sessions)**, type the number of sessions. After the specified number of quick mode sessions have been created within the security association protected by this key, IPsec requires a new key.
|
||||
|
||||
9. Click **OK** three times to save your settings.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,61 @@
|
||||
---
|
||||
title: Configure the Rules to Require Encryption on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 (Windows 10)
|
||||
description: Configure the Rules to Require Encryption on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
ms.assetid: 07b7760f-3225-4b4b-b418-51787b0972a0
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Configure the Rules to Require Encryption on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
|
||||
|
||||
If you are creating a zone that requires encryption, you must configure the rules to add the encryption algorithms and delete the algorithm combinations that do not use encryption.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To modify an authentication request rule to also require encryption**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Connection Security Rules**.
|
||||
|
||||
3. In the details pane, double-click the connection security rule you want to modify.
|
||||
|
||||
4. On the **Name** page, rename the connection security rule, edit the description to reflect the new use for the rule, and then click **OK**.
|
||||
|
||||
5. In the navigation pane, right-click **Windows Firewall with Advanced Security – LDAP://CN={***guid***}**, and then click **Properties**.
|
||||
|
||||
6. Click the **IPsec Settings** tab.
|
||||
|
||||
7. Under **IPsec defaults**, click **Customize**.
|
||||
|
||||
8. Under **Data protection (Quick Mode)**, click **Advanced**, and then click **Customize**.
|
||||
|
||||
9. Click **Require encryption for all connection security rules that use these settings**.
|
||||
|
||||
This disables the data integrity rules section. Make sure the **Data integrity and encryption** list contains all of the combinations that your client computers will use to connect to members of the encryption zone. The client computers receive their rules through the GPO for the zone to which they reside. You must make sure that those rules contain at least one of the data integrity and encryption algorithms that are configured in this rule, or the client computers in that zone will not be able to connect to computers in this zone.
|
||||
|
||||
10. If you need to add an algorithm combination, click **Add**, and then select the combination of encryption and integrity algorithms. The options are described in [Configure Data Protection (Quick Mode) Settings on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-data-protection--quick-mode--settings-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md).
|
||||
|
||||
**Note**
|
||||
Not all of the algorithms available in Windows 8 or Windows Server 2012 can be selected in the Windows Firewall with Advanced Security user interface. To select them, you can use Windows PowerShell.
|
||||
|
||||
Quick mode settings can also be configured on a per-rule basis, but not by using the Windows Firewall with Advanced Security user interface. Instead, you can create or modify the rules by using Windows PowerShell.
|
||||
|
||||
For more information, see [Windows Firewall with Advanced Security Administration with Windows PowerShell](../p_server_archive/windows-firewall-with-advanced-security-administration-with-windows-powershell.md)
|
||||
|
||||
|
||||
|
||||
11. During negotiation, algorithm combinations are proposed in the order shown in the list. Make sure that the more secure combinations are at the top of the list so that the negotiating computers select the most secure combination that they can jointly support.
|
||||
|
||||
12. Click **OK** three times to save your changes.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
60
windows/keep-secure/configure-the-windows-firewall-log.md
Normal file
60
windows/keep-secure/configure-the-windows-firewall-log.md
Normal file
@ -0,0 +1,60 @@
|
||||
---
|
||||
title: Configure the Windows Firewall Log (Windows 10)
|
||||
description: Configure the Windows Firewall Log
|
||||
ms.assetid: f037113d-506b-44d3-b9c0-0b79d03e7d18
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Configure the Windows Firewall Log
|
||||
|
||||
|
||||
To configure Windows Firewall to log dropped packets or successful connections, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
In this topic:
|
||||
|
||||
[To configure Windows Firewall logging for Windows Vista or Windows Server 2008](#bkmk-toenablewindowsfirewallandconfigurethedefaultbehavior)
|
||||
|
||||
## <a href="" id="bkmk-1"></a>
|
||||
|
||||
|
||||
**To configure Windows Firewall logging for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the details pane, in the **Overview** section, click **Windows Firewall Properties**.
|
||||
|
||||
3. For each network location type (Domain, Private, Public), perform the following steps.
|
||||
|
||||
1. Click the tab that corresponds to the network location type.
|
||||
|
||||
2. Under **Logging**, click **Customize**.
|
||||
|
||||
3. The default path for the log is **%windir%\\system32\\logfiles\\firewall\\pfirewall.log**. If you want to change this, clear the **Not configured** check box and type the path to the new location, or click **Browse** to select a file location.
|
||||
|
||||
**Important**
|
||||
The location you specify must have permissions assigned that permit the Windows Firewall service to write to the log file.
|
||||
|
||||
|
||||
|
||||
4. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a size. The file will not grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones.
|
||||
|
||||
5. No logging occurs until you set one of following two options:
|
||||
|
||||
- To create a log entry when Windows Firewall drops an incoming network packet, change **Log dropped packets** to **Yes**.
|
||||
|
||||
- To create a log entry when Windows Firewall allows an inbound connection, change **Log successful connections** to **Yes**.
|
||||
|
||||
6. Click **OK** twice.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,53 @@
|
||||
---
|
||||
title: Configure the Workstation Authentication Certificate Template (Windows 10)
|
||||
description: Configure the Workstation Authentication Certificate Template
|
||||
ms.assetid: c3ac9960-6efc-47c1-bd69-d9d4bf84f7a6
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Configure the Workstation Authentication Certificate Template
|
||||
|
||||
|
||||
This procedure describes how to configure a certificate template that Active Directory Certification Services (AD CS) uses as the starting point for computer certificates that are automatically enrolled and deployed to workstations in the domain. It shows how to create a copy of a template, and then configure the template according to your design requirements.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of both the Domain Admins group in the root domain of your forest, and a member of the Enterprise Admins group.
|
||||
|
||||
**To configure the workstation authentication certificate template and autoenrollment**
|
||||
|
||||
1. On the computer where AD CS is installed, click the **Start** charm, and then click **Certification Authority**.
|
||||
|
||||
2. In the navigation pane, right-click **Certificate Templates**, and then click **Manage**.
|
||||
|
||||
3. In the details pane, click the **Workstation Authentication** template.
|
||||
|
||||
4. On the **Action** menu, click **Duplicate Template**. In the **Duplicate Template** dialog box, select the template version that is appropriate for your deployment, and then click **OK**. For the resulting certificates to have maximum compatibility with the available versions of Windows, we recommended that you select **Windows Server 2003**.
|
||||
|
||||
5. On the **General** tab, in **Template display name**, type a new name for the certificate template, such as **Domain Isolation Workstation Authentication Template**.
|
||||
|
||||
6. Click the **Subject Name** tab. Make sure that **Build from this Active Directory information** is selected. In **Subject name format**, select **Fully distinguished name**.
|
||||
|
||||
7. Click the **Request Handling** tab. You must determine the best minimum key size for your environment. Large key sizes provide better security, but they can affect server performance. We recommended that you use the default setting of 2048.
|
||||
|
||||
8. Click the **Security** tab. In **Group or user names**, click **Domain Computers**, under **Allow**, select **Enroll** and **Autoenroll**, and then click **OK**.
|
||||
|
||||
**Note**
|
||||
If you want do not want to deploy the certificate to every computer in the domain, then specify a different group or groups that contain the computer accounts that you want to receive the certificate.
|
||||
|
||||
|
||||
|
||||
9. Close the Certificate Templates Console.
|
||||
|
||||
10. In the Certification Authority MMC snap-in, in the left pane, right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**.
|
||||
|
||||
11. In the **Enable Certificate Templates** dialog box, click the name of the certificate template you just configured, and then click **OK**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,58 @@
|
||||
---
|
||||
title: Configure Windows Firewall to Suppress Notifications When a Program Is Blocked (Windows 10)
|
||||
description: Configure Windows Firewall to Suppress Notifications When a Program Is Blocked
|
||||
ms.assetid: b7665d1d-f4d2-4b5a-befc-8b6bd940f69b
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Configure Windows Firewall to Suppress Notifications When a Program Is Blocked
|
||||
|
||||
|
||||
To configure Windows Firewall to suppress the display of a notification when it blocks a program that tries to listen for network traffic and to prohibit locally defined rules, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in.
|
||||
|
||||
**Caution**
|
||||
If you choose to disable alerts and prohibit locally defined rules, then you must create firewall rules that allow your users’ programs to send and receive the required network traffic. If a firewall rule is missing, then the user does not receive any kind of warning, the network traffic is silently blocked, and the program might fail.
|
||||
|
||||
We recommend that you do not enable these settings until you have created and tested the required rules.
|
||||
|
||||
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
In this topic:
|
||||
|
||||
[To configure Windows Firewall to suppress the display of a notification for a blocked program and to ignore locally defined rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2](#bkmk-1)
|
||||
|
||||
## <a href="" id="bkmk-1"></a>
|
||||
|
||||
|
||||
**To configure Windows Firewall to suppress the display of a notification for a blocked program and to ignore locally defined rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the details pane, in the **Overview** section, click **Windows Firewall Properties**.
|
||||
|
||||
3. For each network location type (Domain, Private, Public), perform the following steps.
|
||||
|
||||
1. Click the tab that corresponds to the network location type.
|
||||
|
||||
2. Under **Settings**, click **Customize**.
|
||||
|
||||
3. Under **Firewall settings**, change **Display a notification** to **No**.
|
||||
|
||||
4. Under **Rule merging**, change **Apply local firewall rules** to **No**.
|
||||
|
||||
5. Although a connection security rule is not a firewall setting, you can also use this tab to prohibit locally defined connection security rules if you are planning to deploy IPsec rules as part of a server or domain isolation environment. Under **Rule merging**, change **Apply local connection security rules** to **No**.
|
||||
|
||||
6. Click **OK** twice.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,56 @@
|
||||
---
|
||||
title: Confirm That Certificates Are Deployed Correctly (Windows 10)
|
||||
description: Confirm That Certificates Are Deployed Correctly
|
||||
ms.assetid: de0c8dfe-16b0-4d3b-8e8f-9282f6a65eee
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Confirm That Certificates Are Deployed Correctly
|
||||
|
||||
|
||||
After configuring your certificates and autoenrollment in Group Policy, you can confirm that the policy is being applied as expected, and that the certificates are being properly installed on the workstation computers.
|
||||
|
||||
In these procedures, you refresh Group Policy on a client computer, and then confirm that the certificate is deployed correctly.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
In this topic:
|
||||
|
||||
- [Refresh Group Policy on a computer](#bkmk-torefreshgrouppolicyonacomputer)
|
||||
|
||||
- [Verify that a certificate is installed](#bkmk-toverifythatacertificateisinstalled)
|
||||
|
||||
## <a href="" id="bkmk-torefreshgrouppolicyonacomputer"></a>
|
||||
|
||||
|
||||
**To refresh Group Policy on a computer**
|
||||
|
||||
- On a computer running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2, [Start a Command Prompt as an Administrator](../p_server_archive/start-a-command-prompt-as-an-administrator.md), and then type the following command:
|
||||
|
||||
``` syntax
|
||||
gpupdate /target:computer /force
|
||||
```
|
||||
|
||||
After Group Policy is refreshed, you can see which GPOs are currently applied to the computer.
|
||||
|
||||
## <a href="" id="bkmk-toverifythatacertificateisinstalled"></a>
|
||||
|
||||
|
||||
**To verify that a certificate is installed**
|
||||
|
||||
1. Click the **Start** charm, type **certmgr.msc**, and then press ENTER.
|
||||
|
||||
2. In the navigation pane, expand **Trusted Root Certification Authorities**, and then click **Certificates**.
|
||||
|
||||
The CA that you created appears in the list.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
54
windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md
Normal file
54
windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md
Normal file
@ -0,0 +1,54 @@
|
||||
---
|
||||
title: Copy a GPO to Create a New GPO (Windows 10)
|
||||
description: Copy a GPO to Create a New GPO
|
||||
ms.assetid: 7f6a23e5-4b3f-40d6-bf6d-7895558b1406
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Copy a GPO to Create a New GPO
|
||||
|
||||
|
||||
To create the GPO for the boundary zone computers, make a copy of the main domain isolation GPO, and then change the settings to request, instead of require, authentication. To make a copy of a GPO, use the Active Directory Users and Computers MMC snap-in.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to create new GPOs.
|
||||
|
||||
**To make a copy of a GPO**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click the **Start** charm, and then click **Group Policy Management** tile.
|
||||
|
||||
2. In the navigation pane, expand **Forest:***YourForestName*, expand **Domains**, expand *YourDomainName*, and then click **Group Policy Objects**.
|
||||
|
||||
3. In the details pane, right-click the GPO you want to copy, and then click **Copy**.
|
||||
|
||||
4. In the navigation pane, right-click **Group Policy Objects** again, and then click **Paste**.
|
||||
|
||||
5. In the **Copy GPO** dialog box, click **Preserve the existing permissions**, and then click **OK**. Selecting this option preserves any exception groups to which you denied Read and Apply GPO permissions, making the change simpler.
|
||||
|
||||
6. After the copy is complete, click **OK**. The new GPO is named **Copy of** *original GPO name*.
|
||||
|
||||
7. To rename it, right-click the GPO, and then click **Rename**.
|
||||
|
||||
8. Type the new name, and then press ENTER.
|
||||
|
||||
9. You must change the security filters to apply the policy to the correct group of computers. To do this, click the **Scope** tab, and in the **Security Filtering** section, select the group that grants permissions to all members of the isolated domain, for example **CG\_DOMISO\_IsolatedDomain**, and then click **Remove**.
|
||||
|
||||
10. In the confirmation dialog box, click **OK**.
|
||||
|
||||
11. Click **Add**.
|
||||
|
||||
12. Type the name of the group that contains members of the boundary zone, for example **CG\_DOMISO\_Boundary**, and then click **OK**.
|
||||
|
||||
13. If required, change the WMI filter to one appropriate for the new GPO. For example, if the original GPO is for client computers running Windows 8, and the new boundary zone GPO is for computers running Windows Server 2012, then select a WMI filter that allows only those computers to read and apply the GPO.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,47 @@
|
||||
---
|
||||
title: Create a Group Account in Active Directory (Windows 10)
|
||||
description: Create a Group Account in Active Directory
|
||||
ms.assetid: c3700413-e02d-4d56-96b8-7991f97ae432
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create a Group Account in Active Directory
|
||||
|
||||
|
||||
To create a security group to contain the computer accounts for the computers that are to receive a set of Group Policy settings, use the Active Directory Users and Computers MMC snap-in.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to create new group accounts.
|
||||
|
||||
**To add a new membership group in Active Directory**
|
||||
|
||||
1. On a computer that has Active Directory management tools installed, click the **Start** charm, and then click the **Active Directory Users and Computers** tile.
|
||||
|
||||
2. In the navigation pane, select the container in which you want to store your group. This is typically the **Users** container under the domain.
|
||||
|
||||
3. Click **Action**, click **New**, and then click **Group**.
|
||||
|
||||
4. In the **Group name** text box, type the name for your new group.
|
||||
|
||||
**Note**
|
||||
Be sure to use a name that clearly indicates its purpose. Check to see if your organization has a naming convention for groups.
|
||||
|
||||
|
||||
|
||||
5. In the **Description** text box, enter a description of the purpose of this group.
|
||||
|
||||
6. In the **Group scope** section, select either **Global** or **Universal**, depending on your Active Directory forest structure. If your group must include computers from multiple domains, then select **Universal**. If all of the members are from the same domain, then select **Global**.
|
||||
|
||||
7. In the **Group type** section, click **Security**.
|
||||
|
||||
8. Click **OK** to save your group.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
51
windows/keep-secure/create-a-group-policy-object.md
Normal file
51
windows/keep-secure/create-a-group-policy-object.md
Normal file
@ -0,0 +1,51 @@
|
||||
---
|
||||
title: Create a Group Policy Object (Windows 10)
|
||||
description: Create a Group Policy Object
|
||||
ms.assetid: 72a50dd7-5033-4d97-a5eb-0aff8a35cced
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create a Group Policy Object
|
||||
|
||||
|
||||
To create a new GPO, use the Active Directory Users and Computers MMC snap-in.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to create new GPOs.
|
||||
|
||||
**To create a new GPO**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click the **Start** charm, and then click the **Group Policy Management** tile.
|
||||
|
||||
2. In the navigation pane, expand **Forest:***YourForestName*, expand **Domains**, expand *YourDomainName*, and then click **Group Policy Objects**.
|
||||
|
||||
3. Click **Action**, and then click **New**.
|
||||
|
||||
4. In the **Name** text box, type the name for your new GPO.
|
||||
|
||||
**Note**
|
||||
Be sure to use a name that clearly indicates the purpose of the GPO. Check to see if your organization has a naming convention for GPOs.
|
||||
|
||||
|
||||
|
||||
5. Leave **Source Starter GPO** set to **(none)**, and then click **OK**.
|
||||
|
||||
6. If your GPO will not contain any user settings, then you can improve performance by disabling the **User Configuration** section of the GPO. To do this, perform these steps:
|
||||
|
||||
1. In the navigation pane, click the new GPO.
|
||||
|
||||
2. In the details pane, click the **Details** tab.
|
||||
|
||||
3. Change the **GPO Status** to **User configuration settings disabled**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,73 @@
|
||||
---
|
||||
title: Create an Authentication Exemption List Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 (Windows 10)
|
||||
description: Create an Authentication Exemption List Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
ms.assetid: 8f6493f3-8527-462a-82c0-fd91a6cb5dd8
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create an Authentication Exemption List Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
|
||||
|
||||
In almost any isolated server or isolated domain scenario, there are some computers or devices that cannot communicate by using IPsec. This procedure shows you how to create rules that exempt those computers from the authentication requirements of your isolation policies.
|
||||
|
||||
**Important**
|
||||
Adding computers to the exemption list for a zone reduces security because it permits computers in the zone to send network traffic that is unprotected by IPsec to the computers on the list. As discussed in the Windows Firewall with Advanced Security Design Guide, you must add only managed and trusted computers to the exemption list.
|
||||
|
||||
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To create a rule that exempts specified hosts from authentication**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Connection Security Rules**.
|
||||
|
||||
3. Click **Action**, and then click **New Rule**.
|
||||
|
||||
4. On the **Rule Type** page of the New Connection Security Rule Wizard, click **Authentication exemption**, and then click **Next**.
|
||||
|
||||
5. On the **Exempt Computers** page, to create a new exemption, click **Add**. To modify an existing exemption, click it, and then click **Edit**.
|
||||
|
||||
6. In the **IP Address** dialog box, do one of the following:
|
||||
|
||||
- To add a single IP address, click **This IP address or subnet**, type the IP address of the host in the text box, and then click **OK**.
|
||||
|
||||
- To add an entire subnet by address, click **This IP address or subnet**, and then type the IP address of the subnet, followed by a forward slash (/) and the number of bits in the corresponding subnet mask. For example, **10.50.0.0/16** represents the class B subnet that begins with address 10.50.0.1, and ends with address **10.50.255.254**. Click **OK** when you are finished.
|
||||
|
||||
- To add the local computer’s subnet, click **Predefined set of computers**, select **Local subnet** from the list, and then click **OK**.
|
||||
|
||||
**Note**
|
||||
If you select the local subnet from the list rather than typing the subnet address in manually, the computer automatically adjusts the active local subnet to match the computer’s current IP address.
|
||||
|
||||
|
||||
|
||||
- To add a discrete range of addresses that do not correspond to a subnet, click **This IP address range**, type the beginning and ending IP addresses in the **From** and **To** text boxes, and then click **OK**.
|
||||
|
||||
- To exempt all of the remote hosts that the local computer uses for a specified network service, click **Predefined set of computers**, select the network service from the list, and then click **OK**.
|
||||
|
||||
7. Repeat steps 5 and 6 for each exemption that you need to create.
|
||||
|
||||
8. Click **Next** when you have created all of the exemptions.
|
||||
|
||||
9. On the **Profile** page, check the profile for each network location type to which this set of exemptions applies, and then click **Next**.
|
||||
|
||||
**Caution**
|
||||
If all of the exemptions are on the organization’s network and that network is managed by an Active Directory domain, then consider restricting the rule to the Domain profile only. Selecting the wrong profile can reduce the protection for your computer because any computer with an IP address that matches an exemption rule will not be required to authenticate.
|
||||
|
||||
|
||||
|
||||
10. On the **Name** page, type the name of the exemption rule, type a description, and then click **Finish**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,94 @@
|
||||
---
|
||||
title: Create an Authentication Request Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 (Windows 10)
|
||||
description: Create an Authentication Request Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
ms.assetid: 1296e048-039f-4d1a-aaf2-8472ad05e359
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create an Authentication Request Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
|
||||
|
||||
After you have configured IPsec algorithms and authentication methods, you can create the rule that requires the computers on the network to use those protocols and methods before they can communicate.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To create the authentication request rule**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, right-click **Connection Security Rules**, and then click **New Rule**.
|
||||
|
||||
3. On the **Rule Type** page, select **Isolation**, and then click **Next**.
|
||||
|
||||
4. On the **Requirements** page, select **Request authentication for inbound and outbound connections**.
|
||||
|
||||
**Caution**
|
||||
Do not configure the rule to require inbound authentication until you have confirmed that all of your computers are receiving the correct GPOs, and are successfully negotiating IPsec and authenticating with each other. Allowing the computers to communicate even when authentication fails prevents any errors in the GPOs or their distribution from breaking communications on your network.
|
||||
|
||||
|
||||
|
||||
5. On the **Authentication Method** page, select the authentication option you want to use on your network. To select multiple methods that are tried in order until one succeeds, click **Advanced**, click **Customize**, and then click **Add** to add methods to the list. Second authentication methods require Authenticated IP (AuthIP), which is supported only on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2.
|
||||
|
||||
1. **Default**. Selecting this option tells the computer to request authentication by using the method currently defined as the default on the computer. This default might have been configured when the operating system was installed or it might have been configured by Group Policy. Selecting this option is appropriate when you have configured system-wide settings by using the [Configure Authentication Methods on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2](../p_server_archive/configure-authentication-methods-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-and-windows-server-2008-r2.md) procedure.
|
||||
|
||||
2. **Computer and User (Kerberos V5)**. Selecting this option tells the computer to request authentication of both the computer and the currently logged-on user by using their domain credentials. This authentication method works only with other computers that can use AuthIP, including Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. User-based authentication using Kerberos V5 is not supported by IKE v1.
|
||||
|
||||
3. **Computer (Kerberos V5)**. Selecting this option tells the computer to request authentication of the computer by using its domain credentials. This option works with other computers than can use IKE v1, including earlier versions of Windows.
|
||||
|
||||
4. **Advanced**. Click **Customize** to specify a custom combination of authentication methods required for your scenario. You can specify both a **First authentication method** and a **Second authentication method**.
|
||||
|
||||
The **First authentication method** can be one of the following:
|
||||
|
||||
- **Computer (Kerberos V5)**. Selecting this option tells the computer to request authentication of the computer by using its domain credentials. This option works with other computers than can use IKE v1, including earlier versions of Windows.
|
||||
|
||||
- **Computer (NTLMv2)**. Selecting this option tells the computer to use and require authentication of the computer by using its domain credentials. This option works only with other computers that can use AuthIP, including Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. User-based authentication using Kerberos V5 is not supported by IKE v1.
|
||||
|
||||
- **Computer certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to request authentication by using a certificate that is issued by the specified CA. If you also select **Accept only health certificates**, then only certificates issued by a NAP server can be used for this rule.
|
||||
|
||||
- **Preshared key (not recommended)**. Selecting this method and entering a pre-shared key tells the computer to authenticate by exchanging the pre-shared keys. If the keys match, then the authentication succeeds. This method is not recommended, and is included for backward compatibility and testing purposes only.
|
||||
|
||||
If you select **First authentication is optional**, then the connection can succeed even if the authentication attempt specified in this column fails.
|
||||
|
||||
The **Second authentication method** can be one of the following:
|
||||
|
||||
- **User (Kerberos V5)**. Selecting this option tells the computer to use and require authentication of the currently logged-on user by using his or her domain credentials. This authentication method works only with other computers that can use AuthIP, including Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. User-based authentication using Kerberos V5 is not supported by IKE v1.
|
||||
|
||||
- **User (NTLMv2)**. Selecting this option tells the computer to use and require authentication of the currently logged-on user by using his or her domain credentials, and uses the NTLMv2 protocol instead of Kerberos V5. This authentication method works only with other computers that can use AuthIP, including Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. User-based authentication using NTLMv2 is not supported by IKE v1.
|
||||
|
||||
- **User health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to request user-based authentication by using a certificate that is issued by the specified CA. If you also select **Enable certificate to account mapping**, then the certificate can be associated with a user in Active Directory for purposes of granting or denying access to certain users or user groups.
|
||||
|
||||
- **Computer health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require authentication by using a certificate that is issued by the specified CA. If you also select **Accept only health certificates**, then only certificates issued by a NAP server can be used for this rule.
|
||||
|
||||
If you check **Second authentication is optional**, the connection can succeed even if the authentication attempt specified in this column fails.
|
||||
|
||||
**Important**
|
||||
Make sure that you do not select the boxes to make both first and second authentication optional. Doing so allows plaintext connections whenever authentication fails.
|
||||
|
||||
|
||||
|
||||
6. After you have configured the authentication methods, click **OK** on each dialog box to save your changes and close it, until you return to the **Authentication Method** page in the wizard. Click **Next**.
|
||||
|
||||
7. On the **Profile** page, select the check boxes for the network location type profiles to which this rule applies.
|
||||
|
||||
- On portable computers, consider clearing the **Private** and **Public** boxes to enable the computer to communicate without authentication when it is away from the domain network.
|
||||
|
||||
- On computers that do not move from network to network, consider selecting all of the profiles. Doing so prevents an unexpected switch in the network location type from disabling the rule.
|
||||
|
||||
Click **Next**.
|
||||
|
||||
8. On the **Name** page, type a name for the connection security rule and a description, and then click **Finish**.
|
||||
|
||||
The new rule appears in the list of connection security rules.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,71 @@
|
||||
---
|
||||
title: Create an Inbound ICMP Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2 (Windows 10)
|
||||
description: Create an Inbound ICMP Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
ms.assetid: 267b940a-79d9-4322-b53b-81901e357344
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create an Inbound ICMP Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
|
||||
|
||||
To allow inbound Internet Control Message Protocol (ICMP) network traffic, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows ICMP requests and responses to be sent and received by computers on the network.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
This topic describes how to create a port rule that allows inbound ICMP network traffic. For other inbound port rule types, see:
|
||||
|
||||
- [Create an Inbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-port-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
|
||||
- [Create Inbound Rules to Support RPC on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-inbound-rules-to-support-rpc-on-windows-8-windows-7--windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
|
||||
**To create an inbound ICMP rule**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Inbound Rules**.
|
||||
|
||||
3. Click **Action**, and then click **New rule**.
|
||||
|
||||
4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**.
|
||||
|
||||
5. On the **Program** page, click **All programs**, and then click **Next**.
|
||||
|
||||
6. On the **Protocol and Ports** page, select **ICMPv4** or **ICMPv6** from the **Protocol type** list. If you use both IPv4 and IPv6 on your network, you must create a separate ICMP rule for each.
|
||||
|
||||
7. Click **Customize**.
|
||||
|
||||
8. In the **Customize ICMP Settings** dialog box, do one of the following:
|
||||
|
||||
- To allow all ICMP network traffic, click **All ICMP types**, and then click **OK**.
|
||||
|
||||
- To select one of the predefined ICMP types, click **Specific ICMP types**, and then select each type in the list that you want to allow. Click **OK**.
|
||||
|
||||
- To select an ICMP type that does not appear in the list, click **Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, click **Add**, and then select the newly created entry from the list. Click **OK**
|
||||
|
||||
9. Click **Next**.
|
||||
|
||||
10. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**.
|
||||
|
||||
11. On the **Action** page, select **Allow the connection**, and then click **Next**.
|
||||
|
||||
12. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
|
||||
|
||||
|
||||
|
||||
13. On the **Name** page, type a name and description for your rule, and then click **Finish**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,75 @@
|
||||
---
|
||||
title: Create an Inbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2 (Windows 10)
|
||||
description: Create an Inbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
ms.assetid: a7b6c6ca-32fa-46a9-a5df-a4e43147da9f
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create an Inbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
|
||||
|
||||
To allow inbound network traffic on only a specified TCP or UDP port number, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
This topic describes how to create a standard port rule for a specified protocol or TCP or UDP port number. For other inbound port rule types, see:
|
||||
|
||||
- [Create an Inbound ICMP Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-icmp-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
|
||||
- [Create Inbound Rules to Support RPC on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-inbound-rules-to-support-rpc-on-windows-8-windows-7--windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
|
||||
**To create an inbound port rule**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Inbound Rules**.
|
||||
|
||||
3. Click **Action**, and then click **New rule**.
|
||||
|
||||
4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules.
|
||||
|
||||
|
||||
|
||||
5. On the **Program** page, click **All programs**, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The specified program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. If you choose to do this, follow the steps in the [Create an Inbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-program-or-service-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md) procedure in addition to the steps in this procedure to create a single rule that filters network traffic using both program and port criteria.
|
||||
|
||||
|
||||
|
||||
6. On the **Protocol and Ports** page, select the protocol type that you want to allow. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an incoming rule, you typically configure only the local port number.
|
||||
|
||||
If you select another protocol, then only packets whose protocol field in the IP header match this rule are permitted through the firewall.
|
||||
|
||||
To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box.
|
||||
|
||||
When you have configured the protocols and ports, click **Next**.
|
||||
|
||||
7. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**.
|
||||
|
||||
8. On the **Action** page, select **Allow the connection**, and then click **Next**.
|
||||
|
||||
9. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
|
||||
|
||||
|
||||
|
||||
10. On the **Name** page, type a name and description for your rule, and then click **Finish**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,88 @@
|
||||
---
|
||||
title: Create an Inbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2 (Windows 10)
|
||||
description: Create an Inbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
ms.assetid: 00b7fa60-7c64-4ba5-ba95-c542052834cf
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create an Inbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
|
||||
|
||||
To allow inbound network traffic to a specified program or service, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows the program to listen and receive inbound network traffic on any port.
|
||||
|
||||
**Note**
|
||||
This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. To combine the program and port rule types into a single rule, follow the steps in the [Create an Inbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-port-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md) procedure in addition to the steps in this procedure.
|
||||
|
||||
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To create an inbound firewall rule for a program or service**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Inbound Rules**.
|
||||
|
||||
3. Click **Action**, and then click **New rule**.
|
||||
|
||||
4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules.
|
||||
|
||||
|
||||
|
||||
5. On the **Program** page, click **This program path**.
|
||||
|
||||
6. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly.
|
||||
|
||||
7. Do one of the following:
|
||||
|
||||
- If the executable file contains a single program, click **Next**.
|
||||
|
||||
- If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next**.
|
||||
|
||||
- If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, click **Apply to service with this service short name**, and then type the short name for the service in the text box. Click **OK**, and then click **Next**.
|
||||
|
||||
**Important**
|
||||
To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command:
|
||||
|
||||
**sc** **qsidtype** *<ServiceName>*
|
||||
|
||||
If the result is **NONE**, then a firewall rule cannot be applied to that service.
|
||||
|
||||
To set a SID type on a service, run the following command:
|
||||
|
||||
**sc** **sidtype** *<Type> <ServiceName>*
|
||||
|
||||
In the preceding command, the value of *<Type>* can be **UNRESTRICTED** or **RESTRICTED**. Although the command also permits the value of **NONE**, that setting means the service cannot be used in a firewall rule as described here. By default, most services in Windows are configured as **UNRESTRICTED**. If you change the SID type to **RESTRICTED**, the service might fail to start. We recommend that you change the SID type only on services that you want to use in firewall rules, and that you change the SID type to **UNRESTRICTED**. For more information, see [Vista Services](http://go.microsoft.com/fwlink/?linkid=141454) (http://go.microsoft.com/fwlink/?linkid=141454) and the “Service Security Improvements” section of [Inside the Windows Vista Kernel](http://go.microsoft.com/fwlink/?linkid=141455) (http://go.microsoft.com/fwlink/?linkid=141455).
|
||||
|
||||
|
||||
|
||||
8. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-port-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md). After you have configured the protocol and port options, click **Next**.
|
||||
|
||||
9. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**.
|
||||
|
||||
10. On the **Action** page, select **Allow the connection**, and then click **Next**.
|
||||
|
||||
11. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
If this GPO is targeted at server computers running Windows Server 2008 that never move, consider applying the rule to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
|
||||
|
||||
|
||||
|
||||
12. On the **Name** page, type a name and description for your rule, and then click **Finish**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,64 @@
|
||||
---
|
||||
title: Create an Outbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2 (Windows 10)
|
||||
description: Create an Outbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2
|
||||
ms.assetid: 59062b91-756b-42ea-8f2a-832f05d77ddf
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create an Outbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2
|
||||
|
||||
|
||||
By default, Windows Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic on a specified TCP or UDP port number, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To create an outbound port rule**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Outbound Rules**.
|
||||
|
||||
3. Click **Action**, and then click **New rule**.
|
||||
|
||||
4. On the **Rule Type** page of the New Outbound Rule wizard, click **Custom**, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules.
|
||||
|
||||
|
||||
|
||||
5. On the **Program** page, click **All programs**, and then click **Next**.
|
||||
|
||||
6. On the **Protocol and Ports** page, select the protocol type that you want to block. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an outbound rule, you typically configure only the remote port number.
|
||||
|
||||
If you select another protocol, then only packets whose protocol field in the IP header match this rule are blocked by Windows Firewall. Network traffic for protocols is allowed as long as other rules that match do not block it.
|
||||
|
||||
To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box.
|
||||
|
||||
When you have configured the protocols and ports, click **Next**.
|
||||
|
||||
7. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**.
|
||||
|
||||
8. On the **Action** page, select **Block the connection**, and then click **Next**.
|
||||
|
||||
9. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
If this GPO is targeted at server computers running Windows Server 2008 that never move, consider applying the rules to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
|
||||
|
||||
|
||||
|
||||
10. On the **Name** page, type a name and description for your rule, and then click **Finish**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,68 @@
|
||||
---
|
||||
title: Create an Outbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2 (Windows 10)
|
||||
description: Create an Outbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2
|
||||
ms.assetid: f71db4fb-0228-4df2-a95d-b9c056aa9311
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create an Outbound Program or Service Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2
|
||||
|
||||
|
||||
By default, Windows Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic for a specified program or service, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule prevents the program from sending any outbound network traffic on any port.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To create an outbound firewall rule for a program or service**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Outbound Rules**.
|
||||
|
||||
3. Click **Action**, and then click **New rule**.
|
||||
|
||||
4. On the **Rule Type** page of the New Outbound Rule Wizard, click **Custom**, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
Although you can create many rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules.
|
||||
|
||||
|
||||
|
||||
5. On the **Program** page, click **This program path**.
|
||||
|
||||
6. Type the path to the program in the text box. Use environment variables as appropriate to ensure that programs installed in different locations on different computers work correctly.
|
||||
|
||||
7. Do one of the following:
|
||||
|
||||
- If the executable file contains a single program, click **Next**.
|
||||
|
||||
- If the executable file is a container for multiple services that must all be blocked from sending outbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next**.
|
||||
|
||||
- If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, then click **Apply to service with this service short name**, and type the short name for the service in the text box. Click **OK**, and then click **Next**.
|
||||
|
||||
8. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2](../p_server_archive/create-an-outbound-port-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md). When you have configured the protocol and port options, click **Next**.
|
||||
|
||||
9. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**.
|
||||
|
||||
10. On the **Action** page, select **Block the connection**, and then click **Next**.
|
||||
|
||||
11. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
|
||||
|
||||
|
||||
|
||||
12. On the **Name** page, type a name and description for your rule, and then click **Finish**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,108 @@
|
||||
---
|
||||
title: Create Inbound Rules to Support RPC on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2 (Windows 10)
|
||||
description: Create Inbound Rules to Support RPC on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
ms.assetid: 0b001c2c-12c1-4a30-bb99-0c034d7e6150
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create Inbound Rules to Support RPC on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
|
||||
|
||||
To allow inbound remote procedure call (RPC) network traffic, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create two firewall rules. The first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically-assigned port number that the client must use to communicate with the service. The second rule allows the network traffic that is sent to the dynamically-assigned port number. Using the two rules configured as described in this topic helps to protect your computer by allowing network traffic only from computers that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
This topic describes how to create rules that allow inbound RPC network traffic. For other inbound port rule types, see:
|
||||
|
||||
- [Create an Inbound Port Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-port-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
|
||||
- [Create an Inbound ICMP Rule on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2](../p_server_archive/create-an-inbound-icmp-rule-on-windows-8-windows-7-windows-vista-windows-server-2012-windows-server-2008-or-windows-server-2008-r2.md)
|
||||
|
||||
In this topic:
|
||||
|
||||
- [To create a rule to allow inbound network traffic to the RPC Endpoint Mapper service](#bkmk-proc1)
|
||||
|
||||
- [To create a rule to allow inbound network traffic to RPC-enabled network services](#bkmk-proc2)
|
||||
|
||||
## <a href="" id="bkmk-proc1"></a>
|
||||
|
||||
|
||||
**To create a rule to allow inbound network traffic to the RPC Endpoint Mapper service**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Inbound Rules**.
|
||||
|
||||
3. Click **Action**, and then click **New rule**.
|
||||
|
||||
4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**.
|
||||
|
||||
5. On the **Program** page, click **This Program Path**, and then type **%systemroot%\\system32\\svchost.exe**.
|
||||
|
||||
6. Click **Customize**.
|
||||
|
||||
7. In the **Customize Service Settings** dialog box, click **Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, click **OK**, and then click **Next**.
|
||||
|
||||
8. On the warning about Windows service-hardening rules, click **Yes**.
|
||||
|
||||
9. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**.
|
||||
|
||||
10. For **Local port**, select **RPC Endpoint Mapper**, and then click **Next**.
|
||||
|
||||
11. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**.
|
||||
|
||||
12. On the **Action** page, select **Allow the connection**, and then click **Next**.
|
||||
|
||||
13. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
If this GPO is targeted at server computers running Windows Server 2008 that never move, consider applying the rules to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
|
||||
|
||||
|
||||
|
||||
14. On the **Name** page, type a name and description for your rule, and then click **Finish**.
|
||||
|
||||
## <a href="" id="bkmk-proc2"></a>
|
||||
|
||||
|
||||
**To create a rule to allow inbound network traffic to RPC-enabled network services**
|
||||
|
||||
1. On the same GPO you edited in the preceding procedure, click **Action**, and then click **New rule**.
|
||||
|
||||
2. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**.
|
||||
|
||||
3. On the **Program** page, click **This Program Path**, and then type the path to the executable file that hosts the network service. Click **Customize**.
|
||||
|
||||
4. In the **Customize Service Settings** dialog box, click **Apply to this service**, and then select the service that you want to allow. If the service does not appear in the list, then click **Apply to service with this service short name**, and then type the short name of the service in the text box.
|
||||
|
||||
5. Click **OK**, and then click **Next**.
|
||||
|
||||
6. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**.
|
||||
|
||||
7. For **Local port**, select **RPC Dynamic Ports**, and then click **Next**.
|
||||
|
||||
8. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**.
|
||||
|
||||
9. On the **Action** page, select **Allow the connection**, and then click **Next**.
|
||||
|
||||
10. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**.
|
||||
|
||||
**Note**
|
||||
If this GPO is targeted at server computers running Windows Server 2008 that never move, consider applying the rules to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
|
||||
|
||||
|
||||
|
||||
11. On the **Name** page, type a name and description for your rule, and then click **Finish**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
105
windows/keep-secure/create-wmi-filters-for-the-gpo.md
Normal file
105
windows/keep-secure/create-wmi-filters-for-the-gpo.md
Normal file
@ -0,0 +1,105 @@
|
||||
---
|
||||
title: Create WMI Filters for the GPO (Windows 10)
|
||||
description: Create WMI Filters for the GPO
|
||||
ms.assetid: b1a6d93d-a3c8-4e61-a388-4a3323f0e74e
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Create WMI Filters for the GPO
|
||||
|
||||
|
||||
To make sure that each GPO associated with a group can only be applied to computers running the correct version of Windows, use the Group Policy Management MMC snap-in to create and assign WMI filters to the GPO. Although you can create a separate membership group for each GPO, you would then have to manage the memberships of the different groups. Instead, use only a single membership group, and let WMI filters automatically ensure the correct GPO is applied to each computer.
|
||||
|
||||
- [To create a WMI filter that queries for a specified version of Windows](#bkmk-1)
|
||||
|
||||
- [To link a WMI filter to a GPO](#bkmk-2)
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
First, create the WMI filter and configure it to look for a specified version (or versions) of the Windows operating system.
|
||||
|
||||
## <a href="" id="bkmk-1"></a>
|
||||
|
||||
|
||||
**To create a WMI filter that queries for a specified version of Windows**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click **Start**, click **Administrative Tools**, and then click **Group Policy Management**.
|
||||
|
||||
2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, and then click **WMI Filters**.
|
||||
|
||||
3. Click **Action**, and then click **New**.
|
||||
|
||||
4. In the **Name** text box, type the name of the WMI filter.
|
||||
|
||||
**Note**
|
||||
Be sure to use a name that clearly indicates the purpose of the filter. Check to see if your organization has a naming convention.
|
||||
|
||||
|
||||
|
||||
5. In the **Description** text box, type a description for the WMI filter. For example, if the filter excludes domain controllers, you might consider stating that in the description.
|
||||
|
||||
6. Click **Add**.
|
||||
|
||||
7. Leave the **Namespace** value set to **root\\CIMv2**.
|
||||
|
||||
8. In the **Query** text box, type:
|
||||
|
||||
``` syntax
|
||||
select * from Win32_OperatingSystem where Version like "6.%"
|
||||
```
|
||||
|
||||
This query will return **true** for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. To set a filter for just Windows 8 and Windows Server 2012, use `"6.2%"`. To specify multiple versions, combine them with `or`, as shown in the following:
|
||||
|
||||
``` syntax
|
||||
... where Version like "6.1%" or Version like "6.2%"
|
||||
```
|
||||
|
||||
To restrict the query to only clients or only servers, add a clause that includes the `ProductType` parameter. To filter for client operating systems only, such as Windows 8 or Windows 7, use only `ProductType="1"`. For server operating systems that are not domain controllers, use `ProductType="3"`. For domain controllers only, use `ProductType="2"`. This is a useful distinction, because you often want to prevent your GPOs from being applied to the domain controllers on your network.
|
||||
|
||||
The following clause returns **true** for all computers that are not domain controllers:
|
||||
|
||||
``` syntax
|
||||
... where ProductType="1" or ProductType="3"
|
||||
```
|
||||
|
||||
The following complete query returns **true** for all computers running Windows 8, and returns **false** for any server operating system or any other client operating system.
|
||||
|
||||
``` syntax
|
||||
select * from Win32_OperatingSystem where Version like "6.2%" and ProductType="1"
|
||||
```
|
||||
|
||||
The following query returns **true** for any computer running Windows Server 2012, except domain controllers:
|
||||
|
||||
``` syntax
|
||||
select * from Win32_OperatingSystem where Version like "6.2%" and ProductType="3"
|
||||
```
|
||||
|
||||
9. Click **OK** to save the query to the filter.
|
||||
|
||||
10. Click **Save** to save your completed filter.
|
||||
|
||||
## <a href="" id="bkmk-2"></a>
|
||||
|
||||
|
||||
After you have created a filter with the correct query, link the filter to the GPO. Filters can be reused with many GPOs simultaneously; you do not have to create a new one for each GPO if an existing one meets your needs.
|
||||
|
||||
**To link a WMI filter to a GPO**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click **Start**, click **Administrative Tools**, and then click **Group Policy Management**.
|
||||
|
||||
2. In the navigation pane, find and then click the GPO that you want to modify.
|
||||
|
||||
3. Under **WMI Filtering**, select the correct WMI filter from the list.
|
||||
|
||||
4. Click **Yes** to accept the filter.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,60 @@
|
||||
---
|
||||
title: Designing a Windows Firewall with Advanced Security Strategy (Windows 10)
|
||||
description: Designing a Windows Firewall with Advanced Security Strategy
|
||||
ms.assetid: 6d98b184-33d6-43a5-9418-4f24905cfd71
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Designing a Windows Firewall with Advanced Security Strategy
|
||||
|
||||
|
||||
To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment. You must have a good understanding of what tasks the computers on the network perform, and how they use the network to accomplish those tasks. You must understand the network traffic generated by the programs running on the computers.
|
||||
|
||||
- [Gathering the Information You Need](../p_server_archive/gathering-the-information-you-need.md)
|
||||
|
||||
- [Determining the Trusted State of Your Computers](../p_server_archive/determining-the-trusted-state-of-your-computers.md)
|
||||
|
||||
The information that you gather will help you answer the following questions. The answers will help you understand your security requirements and select the design that best matches those requirements. The information will also help you when it comes time to deploy your design, by helping you to build a deployment strategy that is cost effective and resource efficient. It will help you project and justify the expected costs associated with implementing the design.
|
||||
|
||||
- What traffic must always be allowed? What are characteristics of the network traffic generated and consumed by the business programs?
|
||||
|
||||
- What traffic must always be blocked? Does your organization have policies that prohibit the use of specific programs? If so, what are the characteristics of the network traffic generated and consumed by the prohibited programs?
|
||||
|
||||
- What traffic on the network cannot be protected by IPsec because the computers or devices sending or receiving the traffic do not support IPsec?
|
||||
|
||||
- For each type of network traffic, does the default configuration of the firewall (block all unsolicited inbound network traffic, allow all outbound traffic) allow or block the traffic as required?
|
||||
|
||||
- Do you have an Active Directory domain (or forest of trusted domains) to which all your computers are joined? If you do not, then you cannot use Group Policy for easy mass deployment of your firewall and connection security rules. You also cannot easily take advantage of Kerberos V5 authentication that all domain clients can use.
|
||||
|
||||
- Which computers must be able to accept unsolicited inbound connections from computers that are not part of the domain?
|
||||
|
||||
- Which computers contain data that must be encrypted when exchanged with another computer?
|
||||
|
||||
- Which computers contain sensitive data to which access must be restricted to specifically authorized users and computers?
|
||||
|
||||
- Does your organization have specific network troubleshooting devices or computers (such as protocol analyzers) that must be granted unlimited access to the computers on the network, essentially bypassing the firewall?
|
||||
|
||||
## If you already have firewall or IPsec rules deployed
|
||||
|
||||
|
||||
Windows Firewall with Advanced Security in Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 has many new capabilities that are not available in earlier versions of Windows.
|
||||
|
||||
If you already have a domain and/or server isolation deployment in your organization then you can continue to use your existing GPOs and apply them to computers running Windows 8 and Windows Server 2012.
|
||||
|
||||
**Note**
|
||||
Computers running Windows XP and Windows Server 2003 will not be able to participate in this domain and/or server isolation deployment plan.
|
||||
|
||||
|
||||
|
||||
This guide describes how to plan your groups and GPOs for an environment with a mix of operating systems, starting with Windows Vista and Windows Server 2008. Windows XP and Windows Server 2003 are not discussed in this guide. Details can be found in the section [Planning Group Policy Deployment for Your Isolation Zones](../p_server_archive/planning-group-policy-deployment-for-your-isolation-zones.md) later in this guide.
|
||||
|
||||
**Next: **[Gathering the Information You Need](../p_server_archive/gathering-the-information-you-need.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,184 @@
|
||||
---
|
||||
title: Determining the Trusted State of Your Computers (Windows 10)
|
||||
description: Determining the Trusted State of Your Computers
|
||||
ms.assetid: 3e77f0d0-43aa-47dd-8518-41ccdab2f2b2
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Determining the Trusted State of Your Computers
|
||||
|
||||
|
||||
After obtaining information about the computers that are currently part of the IT infrastructure, you must determine at what point a computer is considered trusted. The term *trusted* can mean different things to different people. Therefore, you must communicate a firm definition for it to all stakeholders in the project. Failure to do this can lead to problems with the security of the trusted environment, because the overall security cannot exceed the level of security set by the least secure client that achieves trusted status.
|
||||
|
||||
**Note**
|
||||
In this context, the term *trust* has nothing to do with an Active Directory trust relationship between domains. The trusted state of your computers just indicates the level of risk that you believe the computer brings to the network. Trusted computers bring little risk whereas untrusted computers can potentially bring great risk.
|
||||
|
||||
|
||||
|
||||
## Trust states
|
||||
|
||||
|
||||
To understand this concept, consider the four basic states that apply to computers in a typical IT infrastructure. These states are (in order of risk, lowest risk first):
|
||||
|
||||
- Trusted
|
||||
|
||||
- Trustworthy
|
||||
|
||||
- Known, untrusted
|
||||
|
||||
- Unknown, untrusted
|
||||
|
||||
The remainder of this section defines these states and how to determine which computers in your organization belong in each state.
|
||||
|
||||
### <a href="" id="bkmk-1"></a>Trusted state
|
||||
|
||||
Classifying a computer as trusted means that the computer's security risks are managed, but it does not imply that it is perfectly secure or invulnerable. The responsibility for this managed state falls to the IT and security administrators, in addition to the users who are responsible for the configuration of the computer. A trusted computer that is poorly managed will likely become a point of weakness for the network.
|
||||
|
||||
When a computer is considered trusted, other trusted computers can reasonably assume that the computer will not initiate a malicious act. For example, trusted computers can expect that other trusted computers will not run a virus that attacks them, because all trusted computers are required to use mechanisms (such as antivirus software) to mitigate the threat of viruses.
|
||||
|
||||
Spend some time defining the goals and technology requirements that your organization considers appropriate as the minimum configuration for a computer to obtain trusted status.
|
||||
|
||||
A possible list of technology requirements might include the following:
|
||||
|
||||
- **Operating system.** A trusted client computer should run Windows 8, Windows 7, or Windows Vista. A trusted server should run Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008.
|
||||
|
||||
- **Domain membership.** A trusted computer will belong to a managed Active Directory domain, which means that the IT department has security management rights and can configure member computers by using Group Policy.
|
||||
|
||||
- **Management client.** All trusted computers must run a specific network management client to allow for centralized management and control of security policies, configurations, and software. Microsoft System Center Configuration Manager is one such management system with an appropriate client. For more information, see [System Center Configuration Manager](http://technet.microsoft.com/systemcenter/bb507744.aspx) at http://technet.microsoft.com/systemcenter/bb507744.aspx.
|
||||
|
||||
- **Antivirus software.** All trusted computers will run antivirus software that is configured to check for and automatically update the latest virus signature files daily. Microsoft ForeFront Endpoint Protection is one such antivirus software program. For more information, see [ForeFront Endpoint Protection](http://technet.microsoft.com/forefront/ee822838.aspx) at http://technet.microsoft.com/forefront/ee822838.aspx.
|
||||
|
||||
- **File system.** All trusted computers will be configured to use the NTFS file system.
|
||||
|
||||
- **BIOS settings.** All trusted portable computers will be configured to use a BIOS-level password that is under the management of the IT support team.
|
||||
|
||||
- **Password requirements.** Trusted clients must use strong passwords.
|
||||
|
||||
It is important to understand that the trusted state is not constant; it is a transient state that is subject to changing security standards and compliance with those standards. New threats and new defenses emerge constantly. For this reason, the organization's management systems must continually check the trusted computers to ensure ongoing compliance. Additionally, the management systems must be able to issue updates or configuration changes if they are required to help maintain the trusted status.
|
||||
|
||||
A computer that continues to meet all these security requirements can be considered trusted. However it is possible that most computers that were identified in the discovery process discussed earlier do not meet these requirements. Therefore, you must identify which computers can be trusted and which ones cannot. To help with this process, you use the intermediate *trustworthy* state. The remainder of this section discusses the different states and their implications.
|
||||
|
||||
### <a href="" id="bkmk-2"></a>Trustworthy state
|
||||
|
||||
It is useful to identify as soon as possible those computers in your current infrastructure that can achieve a trusted state. A *trustworthy state* can be assigned to indicate that the current computer can physically achieve the trusted state with required software and configuration changes.
|
||||
|
||||
For each computer that is assigned a trustworthy status, make an accompanying configuration note that states what is required to enable the computer to achieve trusted status. This information is especially important to both the project design team (to estimate the costs of adding the computer to the solution) and the support staff (to enable them to apply the required configuration).
|
||||
|
||||
Generally, trustworthy computers fall into one of the following two groups:
|
||||
|
||||
- **Configuration required.** The current hardware, operating system, and software enable the computer to achieve a trustworthy state. However, additional configuration changes are required. For example, if the organization requires a secure file system before a computer can be considered trusted, a computer that uses a FAT32-formatted hard disk does not meet this requirement.
|
||||
|
||||
- **Upgrade required.** These computers require upgrades before they can be considered trusted. The following list provides some examples of the type of upgrade these computers might require:
|
||||
|
||||
- **Operating system upgrade required.** If the computer's current operating system cannot support the security needs of the organization, an upgrade would be required before the computer could achieve a trusted state.
|
||||
|
||||
- **Software required.** A computer that is missing a required security application, such as an antivirus scanner or a management client, cannot be considered trusted until these applications are installed and active.
|
||||
|
||||
- **Hardware upgrade required.** In some cases, a computer might require a specific hardware upgrade before it can achieve trusted status. This type of computer usually needs an operating system upgrade or additional software that forces the required hardware upgrade. For example, security software might require additional hard disk space on the computer.
|
||||
|
||||
- **Computer replacement required.** This category is reserved for computers that cannot support the security requirements of the solution because their hardware cannot support the minimum acceptable configuration. For example, a computer that cannot run a secure operating system because it has an old processor (such as a 100-megahertz \[MHz\] x86-based computer).
|
||||
|
||||
Use these groups to assign costs for implementing the solution on the computers that require upgrades.
|
||||
|
||||
### <a href="" id="bkmk-3"></a>Known, untrusted state
|
||||
|
||||
During the process of categorizing an organization's computers, you will identify some computers that cannot achieve trusted status for specific well-understood and well-defined reasons. These reasons might include the following types:
|
||||
|
||||
- **Financial.** The funding is not available to upgrade the hardware or software for this computer.
|
||||
|
||||
- **Political.** The computer must remain in an untrusted state because of a political or business situation that does not enable it to comply with the stated minimum security requirements of the organization. It is highly recommended that you contact the business owner or independent software vendor (ISV) for the computer to discuss the added value of server and domain isolation.
|
||||
|
||||
- **Functional.** The computer must run a nonsecure operating system or must operate in a nonsecure manner to perform its role. For example, the computer might be required to run an older operating system because a specific line of business application will only work on that operating system.
|
||||
|
||||
There can be multiple functional reasons for a computer to remain in the known untrusted state. The following list includes several examples of functional reasons that can lead to a classification of this state:
|
||||
|
||||
- **Computers that run unsupported versions of Windows.** This includes Windows XP, Windows Millennium Edition, Windows 98, Windows 95, or Windows NT. Computers that run these versions of the Windows operating system cannot be classified as trustworthy because these operating systems do not support the required security infrastructure. For example, although Windows NT does support a basic security infrastructure, it does not support “deny” ACLs on local resources, any way to ensure the confidentiality and integrity of network communications, smart cards for strong authentication, or centralized management of computer configurations (although limited central management of user configurations is supported).
|
||||
|
||||
- **Stand-alone computers.** Computers running any version of Windows that are configured as stand-alone computers or as members of a workgroup usually cannot achieve a trustworthy state. Although these computers fully support the minimum required basic security infrastructure, the required security management capabilities are unlikely to be available when the computer is not a part of a trusted domain.
|
||||
|
||||
- **Computers in an untrusted domain.** A computer that is a member of a domain that is not trusted by an organization's IT department cannot be classified as trusted. An untrusted domain is a domain that cannot provide the required security capabilities to its members. Although the operating systems of computers that are members of this untrusted domain might fully support the minimum required basic security infrastructure, the required security management capabilities cannot be fully guaranteed when computers are not in a trusted domain.
|
||||
|
||||
### <a href="" id="bkmk-4"></a>Unknown, untrusted state
|
||||
|
||||
The unknown, untrusted state should be considered the default state for all computers. Because computers in this state have a configuration that is unknown, you can assign no trust to them. All planning for computers in this state must assume that the computer is an unacceptable risk to the organization. Designers of the solution should strive to minimize the impact that the computers in this state can have on their organizations.
|
||||
|
||||
## Capturing upgrade costs for current computers
|
||||
|
||||
|
||||
The final step in this part of the process is to record the approximate cost of upgrading the computers to a point that they can participate in the server and domain isolation design. You must make several key decisions during the design phase of the project that require answers to the following questions:
|
||||
|
||||
- Does the computer meet the minimum hardware requirements necessary for isolation?
|
||||
|
||||
- Does the computer meet the minimum software requirements necessary for isolation?
|
||||
|
||||
- What configuration changes must be made to integrate this computer into the isolation solution?
|
||||
|
||||
- What is the projected cost or impact of making the proposed changes to enable the computer to achieve a trusted state?
|
||||
|
||||
By answering these questions, you can quickly determine the level of effort and approximate cost of bringing a particular computer or group of computers into the scope of the project. It is important to remember that the state of a computer is transitive, and that by performing the listed remedial actions you can change the state of a computer from untrusted to trusted. After you decide whether to place a computer in a trusted state, you are ready to begin planning and designing the isolation groups, which the next section [Planning Domain Isolation Zones](../p_server_archive/planning-domain-isolation-zones.md) discusses.
|
||||
|
||||
The following table is an example of a data sheet that you could use to help capture the current state of a computer and what would be required for the computer to achieve a trusted state.
|
||||
|
||||
<table style="width:100%;">
|
||||
<colgroup>
|
||||
<col width="16%" />
|
||||
<col width="16%" />
|
||||
<col width="16%" />
|
||||
<col width="16%" />
|
||||
<col width="16%" />
|
||||
<col width="16%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th><strong>Computer name</strong></th>
|
||||
<th><strong>Hardware reqs met</strong></th>
|
||||
<th><strong>Software reqs met</strong></th>
|
||||
<th><strong>Configuration required</strong></th>
|
||||
<th><strong>Details</strong></th>
|
||||
<th><strong>Projected cost</strong></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>CLIENT001</p></td>
|
||||
<td><p>No</p></td>
|
||||
<td><p>No</p></td>
|
||||
<td><p>Upgrade hardware and software.</p></td>
|
||||
<td><p>Current operating system is Windows XP. Old hardware is not compatible with Windows 8.</p></td>
|
||||
<td><p>$??</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>SERVER001</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>No</p></td>
|
||||
<td><p>Join trusted domain and upgrade from Windows Server 2003 to Windows Server 2012.</p></td>
|
||||
<td><p>No antivirus software present.</p></td>
|
||||
<td><p>$??</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
In the previous table, the computer CLIENT001 is currently "known, untrusted" because its hardware must be upgraded. However, it could be considered trustworthy if the required upgrades are possible. However, if many computers require the same upgrades, the overall cost of the solution would be much higher.
|
||||
|
||||
The computer SERVER001 is "trustworthy" because it meets the hardware requirements but its operating system must be upgraded. It also requires antivirus software. The projected cost is the amount of effort that is required to upgrade the operating system and install antivirus software, along with their purchase costs.
|
||||
|
||||
With the other information that you have gathered in this section, this information will be the foundation of the efforts performed later in the [Planning Domain Isolation Zones](../p_server_archive/planning-domain-isolation-zones.md) section.
|
||||
|
||||
The costs identified in this section only capture the projected cost of the computer upgrades. Many additional design, support, test, and training costs should be accounted for in the overall project plan.
|
||||
|
||||
For more information about how to configure firewalls to support IPsec, see "Configuring Firewalls" at <http://go.microsoft.com/fwlink/?linkid=69783>.
|
||||
|
||||
For more information about WMI, see "Windows Management Instrumentation" at <http://go.microsoft.com/fwlink/?linkid=110483>.
|
||||
|
||||
**Next: **[Planning Your Windows Firewall with Advanced Security Design](../p_server_archive/planning-your-windows-firewall-with-advanced-security-design.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
85
windows/keep-secure/documenting-the-zones.md
Normal file
85
windows/keep-secure/documenting-the-zones.md
Normal file
@ -0,0 +1,85 @@
|
||||
---
|
||||
title: Documenting the Zones (Windows 10)
|
||||
description: Documenting the Zones
|
||||
ms.assetid: ebd7a650-4d36-42d4-aac0-428617f5a32d
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Documenting the Zones
|
||||
|
||||
|
||||
Generally, the task of determining zone membership is not complex, but it can be time-consuming. Use the information generated during the [Designing a Windows Firewall with Advanced Security Strategy](../p_server_archive/designing-a-windows-firewall-with-advanced-security-strategy.md) section of this guide to determine the zone in which to put each host. You can document this zone placement by adding a Group column to the inventory table shown in the Designing a Windows Firewall with Advanced Security Strategy section. A sample is shown here:
|
||||
|
||||
<table style="width:100%;">
|
||||
<colgroup>
|
||||
<col width="14%" />
|
||||
<col width="14%" />
|
||||
<col width="14%" />
|
||||
<col width="14%" />
|
||||
<col width="14%" />
|
||||
<col width="14%" />
|
||||
<col width="14%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Host name</th>
|
||||
<th>Hardware reqs met</th>
|
||||
<th>Software reqs met</th>
|
||||
<th>Configuration required</th>
|
||||
<th>Details</th>
|
||||
<th>Projected cost</th>
|
||||
<th>Group</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>CLIENT001</p></td>
|
||||
<td><p>No</p></td>
|
||||
<td><p>No</p></td>
|
||||
<td><p>Upgrade hardware and software.</p></td>
|
||||
<td><p>Current operating system is Windows XP. Old hardware not compatible with Windows 8.</p></td>
|
||||
<td><p>$??</p></td>
|
||||
<td><p>Isolated domain</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>SERVER002</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>No</p></td>
|
||||
<td><p>Join trusted domain, upgrade from Windows Server 2008 to Windows Server 2012</p></td>
|
||||
<td><p>No antivirus software present.</p></td>
|
||||
<td><p>$??</p></td>
|
||||
<td><p>Encryption</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>SENSITIVE001</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Not required.</p></td>
|
||||
<td><p>Running Windows Server 2012. Ready for inclusion.</p></td>
|
||||
<td><p>$0</p></td>
|
||||
<td><p>Isolated server (in zone by itself)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>PRINTSVR1</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Not required.</p></td>
|
||||
<td><p>Running Windows Server 2008 R2. Ready for inclusion.</p></td>
|
||||
<td><p>$0</p></td>
|
||||
<td><p>Boundary</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
**Next: **[Planning Group Policy Deployment for Your Isolation Zones](../p_server_archive/planning-group-policy-deployment-for-your-isolation-zones.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,65 @@
|
||||
---
|
||||
title: Domain Isolation Policy Design Example (Windows 10)
|
||||
description: Domain Isolation Policy Design Example
|
||||
ms.assetid: 704dcf58-286f-41aa-80af-c81720aa7fc5
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Domain Isolation Policy Design Example
|
||||
|
||||
|
||||
This design example continues to use the fictitious company Woodgrove Bank, and builds on the example described in the [Firewall Policy Design Example](../p_server_archive/firewall-policy-design-example.md) section. See that example for an explanation of the basic corporate network infrastructure at Woodgrove Bank with diagrams.
|
||||
|
||||
## Design Requirements
|
||||
|
||||
|
||||
In addition to the basic protection provided by the firewall rules in the previous design example, the administrators of the network want to implement domain isolation to provide another layer of security to their networked computers. They want to create firewall and connection security rules that use authentication to reduce the risk of communicating with untrusted and potentially hostile computers.
|
||||
|
||||
The following illustration shows the traffic protection needed for this design example.
|
||||
|
||||
|
||||
|
||||
1. All computers on the Woodgrove Bank corporate network that are Active Directory domain members must authenticate inbound network traffic as coming from another computer that is a member of the domain. Unless otherwise specified in this section, Woodgrove Bank's computers reject all unsolicited inbound network traffic that is not authenticated. If the basic firewall design is also implemented, even authenticated inbound network traffic is dropped unless it matches an inbound firewall rule.
|
||||
|
||||
2. The servers hosting the WGPartner programs must be able to receive unsolicited inbound traffic from computers owned by its partners, which are not members of Woodgrove Bank's domain.
|
||||
|
||||
3. Client computers can initiate non-authenticated outbound communications with computers that are not members of the domain, such as browsing external Web sites. Unsolicited inbound traffic from non-domain members is blocked.
|
||||
|
||||
4. Computers in the encryption zone require that all network traffic inbound and outbound must be encrypted, in addition to the authentication already required by the isolated domain.
|
||||
|
||||
**Other traffic notes:**
|
||||
|
||||
- All of the design requirements described in the [Firewall Policy Design Example](../p_server_archive/firewall-policy-design-example.md) section are still enforced.
|
||||
|
||||
## Design Details
|
||||
|
||||
|
||||
Woodgrove Bank uses Active Directory groups and GPOs to deploy the domain isolation settings and rules to the computers on its network.
|
||||
|
||||
Setting up groups as described here ensures that you do not have to know what operating system a computer is running before assigning it to a group. As in the firewall policy design, a combination of WMI filters and security group filters are used to ensure that members of the group receive the GPO appropriate for the version of Windows running on that computer. For some groups, you might have four or even five GPOs.
|
||||
|
||||
The following groups were created by using the Active Directory Users and Computers MMC snap-in, all computers that run Windows were added to the correct groups, and then the appropriate GPO are applied to the group. To include a computer in the isolated domain or any one of its subordinate zones, simply add the computer's account in the appropriate group.
|
||||
|
||||
- **CG\_DOMISO\_ISOLATEDDOMAIN**. The members of this group participate in the isolated domain. After an initial pilot period, followed by a slowly increasing group membership, the membership of this group was eventually replaced with the entry **Domain Computers** to ensure that all computers in the domain participate by default. The WMI filters ensure that the GPO does not apply to domain controllers. GPOs with connection security rules to enforce domain isolation behavior are linked to the domain container and applied to the computers in this group. Filters ensure that each computer receives the correct GPO for its operating system type. The rules in the domain isolation GPO require Kerberos v5 authentication for inbound network connections, and request (but not require) it for all outbound connections.
|
||||
|
||||
- **CG\_DOMISO\_NO\_IPSEC**. This group is denied read or apply permissions on any of the domain isolation GPOs. Any computer that cannot participate in domain isolation, such as a DHCP server running UNIX, is added to this group.
|
||||
|
||||
- **CG\_DOMISO\_BOUNDARY**. This group contains the computer accounts for all the computers that are part of the boundary group able to receive unsolicited inbound traffic from untrusted computers. Members of the group receive a GPO that configures connection security rules to request (but not require) both inbound and outbound authentication.
|
||||
|
||||
- **CG\_DOMISO\_ENCRYPTION**. This group contains the computer accounts for all the computers that require all inbound and outbound traffic to be both authenticated and encrypted. Members of the group receive a GPO that configures connection security and firewall rules to require both authentication and encryption on all inbound and outbound traffic.
|
||||
|
||||
**Note**
|
||||
If you are designing GPOs for only Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2, you can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. However, computers that are running older versions of Windows can only support a single IPsec policy being active at a time. The policies for each GPO must be complete (and to a great extent redundant with each other), because you cannot layer them as you can in the newer versions of Windows. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any computers that are incorrectly assigned to more than one group.
|
||||
|
||||
|
||||
|
||||
**Next: **[Server Isolation Policy Design Example](../p_server_archive/server-isolation-policy-design-example.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
69
windows/keep-secure/domain-isolation-policy-design.md
Normal file
69
windows/keep-secure/domain-isolation-policy-design.md
Normal file
@ -0,0 +1,69 @@
|
||||
---
|
||||
title: Domain Isolation Policy Design (Windows 10)
|
||||
description: Domain Isolation Policy Design
|
||||
ms.assetid: 7475084e-f231-473a-9357-5e1d39861d66
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Domain Isolation Policy Design
|
||||
|
||||
|
||||
In the domain isolation policy design, you configure the computers on your network to accept only connections coming from computers that are authenticated as members of the same isolated domain.
|
||||
|
||||
This design typically begins with a network configured as described in the [Basic Firewall Policy Design](../p_server_archive/basic-firewall-policy-design.md) section. For this design, you then add connection security and IPsec rules to configure computers in the isolated domain to accept only network traffic from other computers that can authenticate as a member of the isolated domain. After implementing the new rules, your computers reject unsolicited network traffic from computers that are not members of the isolated domain.
|
||||
|
||||
The isolated domain might not be a single Active Directory domain. It can consist of all the domains in a forest, or domains in separate forests that have two-way trust relationships configured between them.
|
||||
|
||||
By using connection security rules based on IPsec, you provide a logical barrier between computers even if they are connected to the same physical network segment.
|
||||
|
||||
The design is shown in the following illustration, with the arrows that show the permitted communication paths.
|
||||
|
||||
|
||||
|
||||
Characteristics of this design, as shown in the diagram, include the following:
|
||||
|
||||
- Isolated domain (area A) - Computers in the isolated domain receive unsolicited inbound traffic only from other members of the isolated domain or from computers referenced in authentication exemption rules. Computers in the isolated domain can send traffic to any computer. This includes unauthenticated traffic to computers that are not in the isolated domain. Computers that cannot join an Active Directory domain, but that can use certificates for authentication, can be part of the isolated domain. For more information, see the [Certificate-based Isolation Policy Design](../p_server_archive/certificate-based-isolation-policy-design.md).
|
||||
|
||||
- Boundary zone (area B) - Computers in the boundary zone are part of the isolated domain but are allowed to accept inbound connections from untrusted computers, such as clients on the Internet.
|
||||
|
||||
Computers in the boundary zone request but do not require authentication to communicate. When a member of the isolated domain communicates with a boundary zone member the traffic is authenticated. When a computer that is not part of the isolated domain communicates with a boundary zone member the traffic is not authenticated.
|
||||
|
||||
Because boundary zone computers are exposed to network traffic from untrusted and potentially hostile computers, they must be carefully managed and secured. Put only the computers that must be accessed by external computers in this zone. Use firewall rules to ensure that network traffic is accepted only for services that you want exposed to non-domain member computers.
|
||||
|
||||
- Trusted non-domain members (area C) - Computers on the network that are not domain members or that cannot use IPsec authentication are allowed to communicate by configuring authentication exemption rules. These rules enable computers in the isolated domain to accept inbound connections from these trusted non-domain member computers.
|
||||
|
||||
- Untrusted non-domain members (area D) - Computers that are not managed by your organization and have an unknown security configuration must have access only to those computers required for your organization to correctly conduct its business. Domain isolation exists to put a logical barrier between these untrusted computers and your organization's computers.
|
||||
|
||||
After implementing this design, your administrative team will have centralized management of the firewall and connection security rules applied to the computers that are running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, and Windows Vista in your organization.
|
||||
|
||||
**Important**
|
||||
This design builds on the [Basic Firewall Policy Design](../p_server_archive/basic-firewall-policy-design.md), and in turn serves as the foundation for the [Server Isolation Policy Design](../p_server_archive/server-isolation-policy-design.md). If you plan to deploy all three, we recommend that you do the design work for all three together, and then deploy in the sequence presented.
|
||||
|
||||
|
||||
|
||||
This design can be applied to computers that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the connection security rules.
|
||||
|
||||
In order to expand the isolated domain to include computers that cannot be part of an Active Directory domain, see the [Certificate-based Isolation Policy Design](../p_server_archive/certificate-based-isolation-policy-design.md).
|
||||
|
||||
For more information about this design:
|
||||
|
||||
- This design coincides with the deployment goals to [Protect Computers from Unwanted Network Traffic](../p_server_archive/protect-computers-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Computers](../p_server_archive/restrict-access-to-only-trusted-computers.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](../p_server_archive/require-encryption-when-accessing-sensitive-network-resources.md).
|
||||
|
||||
- To learn more about this design, see the [Domain Isolation Policy Design Example](../p_server_archive/domain-isolation-policy-design-example.md).
|
||||
|
||||
- Before completing the design, gather the information described in [Designing a Windows Firewall with Advanced Security Strategy](../p_server_archive/designing-a-windows-firewall-with-advanced-security-strategy.md).
|
||||
|
||||
- To help you make the decisions required in this design, see [Planning Domain Isolation Zones](../p_server_archive/planning-domain-isolation-zones.md) and [Planning Group Policy Deployment for Your Isolation Zones](../p_server_archive/planning-group-policy-deployment-for-your-isolation-zones.md).
|
||||
|
||||
- For a list of tasks that you can use to deploy your domain isolation policy design, see "Checklist: Implementing a Domain Isolation Policy Design" in the [Windows Firewall with Advanced Security Deployment Guide](http://go.microsoft.com/fwlink/?linkid=xxxxx) at http://go.microsoft.com/fwlink/?linkid=xxxxx.
|
||||
|
||||
**Next:** [Server Isolation Policy Design](../p_server_archive/server-isolation-policy-design.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,47 @@
|
||||
---
|
||||
title: Enable Predefined Inbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2 (Windows 10)
|
||||
description: Enable Predefined Inbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
ms.assetid: a4fff086-ae81-4c09-b828-18c6c9a937a7
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Enable Predefined Inbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
|
||||
|
||||
Windows Firewall with Advanced Security includes many predefined rules for common networking roles and functions. When you install a new server role on a computer or enable a network feature on a client computer, the installer typically enables the rules required for that role instead of creating new ones. When deploying firewall rules to the computers on the network, you can take advantage of these predefined rules instead of creating new ones. Doing this helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To deploy predefined firewall rules that allow inbound network traffic for common network functions**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Inbound Rules**.
|
||||
|
||||
3. Click **Action**, and then click **New rule**.
|
||||
|
||||
4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Predefined**, select the rule category from the list, and then click **Next**.
|
||||
|
||||
5. On the **Predefined Rules** page, the list of rules defined in the group is displayed. By default, they are all selected. For rules that you do not want to deploy, clear the check boxes next to the rules, and then click **Next**.
|
||||
|
||||
6. On the **Action** page, select **Allow the connection**, and then click **Finish**.
|
||||
|
||||
The selected rules are added to the GPO and applied to the computers to which the GPO is assigned the next time Group Policy is refreshed.
|
||||
|
||||
**Note**
|
||||
If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
|
||||
|
||||
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,47 @@
|
||||
---
|
||||
title: Enable Predefined Outbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2 (Windows 10)
|
||||
description: Enable Predefined Outbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
ms.assetid: 71cc4157-a1ed-41d9-91e4-b3140c67c1be
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Enable Predefined Outbound Rules on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
|
||||
|
||||
|
||||
By default, Windows Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. Windows Firewall with Advanced Security includes many predefined outbound rules that can be used to block network traffic for common networking roles and functions. When you install a new server role on a computer or enable a network feature on a client computer, the installer can install, but typically does not enable, outbound block rules for that role. When deploying firewall rules to the computers on the network, you can take advantage of these predefined rules instead of creating new ones. Doing this helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To deploy predefined firewall rules that block outbound network traffic for common network functions**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. In the navigation pane, click **Outbound Rules**.
|
||||
|
||||
3. Click **Action**, and then click **New rule**.
|
||||
|
||||
4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Predefined**, select the rule category from the list, and then click **Next**.
|
||||
|
||||
5. On the **Predefined Rules** page, the list of rules defined in the group is displayed. They are all selected by default. For rules that you do not want to deploy, clear the check boxes next to the rules, and then click **Next**.
|
||||
|
||||
6. On the **Action** page, select **Block the connection**, and then click **Finish**.
|
||||
|
||||
The selected rules are added to the GPO.
|
||||
|
||||
**Note**
|
||||
If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
|
||||
|
||||
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
24
windows/keep-secure/encryption-zone-gpos.md
Normal file
24
windows/keep-secure/encryption-zone-gpos.md
Normal file
@ -0,0 +1,24 @@
|
||||
---
|
||||
title: Encryption Zone GPOs (Windows 10)
|
||||
description: Encryption Zone GPOs
|
||||
ms.assetid: eeb973dd-83a5-4381-9af9-65c43c98c29b
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Encryption Zone GPOs
|
||||
|
||||
|
||||
Handle encryption zones in a similar manner to the boundary zones. A computer is added to an encryption zone by adding the computer account to the encryption zone group. Woodgrove Bank has a single service that must be protected, and the computers that are running that service are added to the group CG\_DOMISO\_Encryption. This group is granted Read and Apply Group Policy permissions in on the GPO described in this section.
|
||||
|
||||
The GPO is only for server versions of Windows. Client computers are not expected to participate in the encryption zone. If the need for one occurs, either create a new GPO for that version of Windows, or expand the WMI filter attached to one of the existing encryption zone GPOs to make it apply to the client version of Windows.
|
||||
|
||||
- [GPO\_DOMISO\_Encryption\_WS2008](../p_server_archive/gpo-domiso-encryption-ws2008.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
67
windows/keep-secure/encryption-zone.md
Normal file
67
windows/keep-secure/encryption-zone.md
Normal file
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Encryption Zone (Windows 10)
|
||||
description: Encryption Zone
|
||||
ms.assetid: 55a025ce-357f-4d1b-b2ae-6ee32c9abe13
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Encryption Zone
|
||||
|
||||
|
||||
Some servers in the organization host data that is very sensitive, including medical, financial, or other personally identifying data. Government or industry regulations might require that this sensitive information must be encrypted when it is transferred between computers.
|
||||
|
||||
To support the additional security requirements of these servers, we recommend that you create an encryption zone to contain the computers and that requires that the sensitive inbound and outbound network traffic be encrypted.
|
||||
|
||||
You must create a group in Active Directory to contain members of the encryption zone. The settings and rules for the encryption zone are typically similar to those for the isolated domain, and you can save time and effort by copying those GPOs to serve as a starting point. You then modify the security methods list to include only algorithm combinations that include encryption protocols.
|
||||
|
||||
Creation of the group and how to link it to the GPOs that apply the rules to members of the group are discussed in the [Planning Group Policy Deployment for Your Isolation Zones](../p_server_archive/planning-group-policy-deployment-for-your-isolation-zones.md) section.
|
||||
|
||||
## GPO settings for encryption zone servers running Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2
|
||||
|
||||
|
||||
The GPO for computers that are running Windows Server 2012, Windows Server 2008 R2 or Windows Server 2008 should include the following:
|
||||
|
||||
- IPsec default settings that specify the following options:
|
||||
|
||||
1. Exempt all ICMP traffic from IPsec.
|
||||
|
||||
2. Key exchange (main mode) security methods and algorithm. We recommend that you use at least DH4, AES and SHA2 in your settings. Use the strongest algorithm combinations that are common to all your supported operating systems.
|
||||
|
||||
3. Data protection (quick mode) algorithm combinations. Check **Require encryption for all connection security rules that use these settings**, and then specify one or more integrity and encryption combinations. We recommend that you do not include DES or MD5 in any setting. They are included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems.
|
||||
|
||||
If any NAT devices are present on your networks, use ESP encapsulation..
|
||||
|
||||
4. Authentication methods. Include at least computer-based Kerberos V5 authentication. If you want to use user-based access to isolated servers then you must also include user-based Kerberos V5 authentication as an optional authentication method. Likewise, if any of your domain isolation members cannot use Kerberos V5 authentication, then you must include certificate-based authentication as an optional authentication method.
|
||||
|
||||
- The following connection security rules:
|
||||
|
||||
- A connection security rule that exempts all computers on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, if applicable in your environment.
|
||||
|
||||
- A connection security rule, from any IP address to any, that requires inbound and requests outbound authentication using the default authentication specified earlier in this policy.
|
||||
|
||||
**Important**
|
||||
Be sure to begin operations by using request in and request out behavior until you are sure that all the computers in your IPsec environment are communicating successfully by using IPsec. After confirming that IPsec is operating as expected, you can change the GPO to require in, request out.
|
||||
|
||||
|
||||
|
||||
- A registry policy that includes the following values:
|
||||
|
||||
- Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](../p_server_archive/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**.
|
||||
|
||||
**Note**
|
||||
For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](../p_server_archive/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md).
|
||||
|
||||
|
||||
|
||||
- If domain member computers must communicate with computers in the encryption zone, ensure that you include in the isolated domain GPOs quick mode combinations that are compatible with the requirements of the encryption zone GPOs.
|
||||
|
||||
**Next: **[Planning Server Isolation Zones](../p_server_archive/planning-server-isolation-zones.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,28 @@
|
||||
---
|
||||
title: Evaluating Windows Firewall with Advanced Security Design Examples (Windows 10)
|
||||
description: Evaluating Windows Firewall with Advanced Security Design Examples
|
||||
ms.assetid: a591389b-18fa-4a39-ba07-b6fb61961cbd
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Evaluating Windows Firewall with Advanced Security Design Examples
|
||||
|
||||
|
||||
The following Windows Firewall with Advanced Security design examples illustrate how you can use Windows Firewall with Advanced Security to improve the security of the computers connected to the network. You can use these topics to evaluate how the firewall and connection security rules work across all Windows Firewall with Advanced Security designs and to determine which design or combination of designs best suits the goals of your organization.
|
||||
|
||||
- [Firewall Policy Design Example](91fc4c4c-dca9-422e-be05-42a5e14f5e4a)
|
||||
|
||||
- [Domain Isolation Policy Design Example](d918816a-52be-4266-9027-7bc3c36f4916)
|
||||
|
||||
- [Server Isolation Policy Design Example](c275b916-56cf-4863-9900-e50193cd77ed)
|
||||
|
||||
- [Certificate-based Isolation Policy Design Example](85a83c33-358b-4b73-9b08-ef7589d01f91)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
---
|
||||
title: Exempt ICMP from Authentication on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 (Windows 10)
|
||||
description: Exempt ICMP from Authentication on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
ms.assetid: c086c715-8d0c-4eb5-9ea7-2f7635a55548
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Exempt ICMP from Authentication on Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2
|
||||
|
||||
|
||||
This procedure shows you how to add exemptions for any network traffic that uses the ICMP protocol.
|
||||
|
||||
**Important**
|
||||
Because of its usefulness in troubleshooting network connectivity problems, we recommend that you exempt all ICMP network traffic from authentication requirements unless your network risk analysis indicates a need to protect this traffic.
|
||||
|
||||
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To exempt ICMP network traffic from authentication**
|
||||
|
||||
1. [Open the Group Policy Management Console to Windows Firewall with Advanced Security](../p_server_archive/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md).
|
||||
|
||||
2. On the main Windows Firewall with Advanced Security page, click **Windows Firewall Properties**.
|
||||
|
||||
3. On the **IPsec settings** tab, change **Exempt ICMP from IPsec** to **Yes**, and then click **OK**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
54
windows/keep-secure/exemption-list.md
Normal file
54
windows/keep-secure/exemption-list.md
Normal file
@ -0,0 +1,54 @@
|
||||
---
|
||||
title: Exemption List (Windows 10)
|
||||
description: Exemption List
|
||||
ms.assetid: a05e65b4-b48d-44b1-a7f1-3a8ea9c19ed8
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Exemption List
|
||||
|
||||
|
||||
When you implement a server and domain isolation security model in your organization, you are likely to find some additional challenges. Key infrastructure servers such as DNS servers and DHCP servers typically must be available to all computers on the internal network, yet secured from network attacks. However, if they must remain available to all computers on the network, not just to isolated domain members, then these servers cannot require IPsec for inbound access, nor can they use IPsec transport mode for outbound traffic.
|
||||
|
||||
In addition to the infrastructure servers mentioned earlier, there might also be other servers on the network that trusted computers cannot use IPsec to access, which would be added to the exemption list.
|
||||
|
||||
Generally, the following conditions are reasons to consider adding a computer to the exemption list:
|
||||
|
||||
- If the computer must be accessed by trusted computers but it does not have a compatible IPsec implementation.
|
||||
|
||||
- If the computer must provide services to both trusted and untrusted computers, but does not meet the criteria for membership in the boundary zone.
|
||||
|
||||
- If the computer must be accessed by trusted computers from different isolated domains that do not have an Active Directory trust relationship established with each other.
|
||||
|
||||
- If the computer is a domain controller running version of Windows earlier than Windows Server 2008, or if any of its clients are running a version of Windows earlier than Windows Vista.
|
||||
|
||||
- If the computer must support trusted and untrusted computers, but cannot use IPsec to help secure communications to trusted computers.
|
||||
|
||||
For large organizations, the list of exemptions might grow very large if all the exemptions are implemented by one connection security rule for the whole domain or for all trusted forests. If you can require all computers in your isolated domain to run at least Windows Vista or Windows Server 2008, you can greatly reduce the size of this list. A large exemption list has several unwanted effects on every computer that receives the GPO, including the following:
|
||||
|
||||
- Reduces the overall effectiveness of isolation.
|
||||
|
||||
- Creates a larger management burden (because of frequent updates).
|
||||
|
||||
- Increases the size of the IPsec policy, which means that it consumes more memory and CPU resources, slows down network throughput, and increases the time required to download and apply the GPO containing the IPsec policy.
|
||||
|
||||
To keep the number of exemptions as small as possible, you have several options:
|
||||
|
||||
- Carefully consider the communications requirements of each isolation zone, especially server-only zones. They might not be required to communicate with every exemption in the domain-level policy for clients.
|
||||
|
||||
- Consolidate server functions. If several exempt services can be hosted at one IP address, the number of exemptions is reduced.
|
||||
|
||||
- Consolidate exempted hosts on the same subnet. Where network traffic volume allows, you might be able to locate the servers on a subnet that is exempted, instead of using exemptions for each IP address.
|
||||
|
||||
As with defining the boundary zone, create a formal process to approve hosts being added to the exemption list. For a model of processing requests for exemptions, see the decision flowchart in the [Boundary Zone](../p_server_archive/boundary-zone.md) section.
|
||||
|
||||
**Next: **[Isolated Domain](../p_server_archive/isolated-domain.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
24
windows/keep-secure/firewall-gpos.md
Normal file
24
windows/keep-secure/firewall-gpos.md
Normal file
@ -0,0 +1,24 @@
|
||||
---
|
||||
title: Firewall GPOs (Windows 10)
|
||||
description: Firewall GPOs
|
||||
ms.assetid: 720645fb-a01f-491e-8d05-c9c6d5e28033
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Firewall GPOs
|
||||
|
||||
|
||||
All the computers on Woodgrove Bank's network that run Windows are part of the isolated domain, except domain controllers. To configure firewall rules, the GPO described in this section is linked to the domain container in the Active Directory OU hierarchy, and then filtered by using security group filters and WMI filters.
|
||||
|
||||
The GPO created for the example Woodgrove Bank scenario include the following:
|
||||
|
||||
- [GPO\_DOMISO\_Firewall](../p_server_archive/gpo-domiso-firewall.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
108
windows/keep-secure/firewall-policy-design-example.md
Normal file
108
windows/keep-secure/firewall-policy-design-example.md
Normal file
@ -0,0 +1,108 @@
|
||||
---
|
||||
title: Firewall Policy Design Example (Windows 10)
|
||||
description: Firewall Policy Design Example
|
||||
ms.assetid: 0dc3bcfe-7a4d-4a15-93a9-64b13bd775a7
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Firewall Policy Design Example
|
||||
|
||||
|
||||
In this example, the fictitious company Woodgrove Bank is a financial services institution.
|
||||
|
||||
Woodgrove Bank has an Active Directory domain that provides Group Policy-based management for all their Windows-based computers. The Active Directory domain controllers also host Domain Name System (DNS) for host name resolution. Separate computers host Windows Internet Name Service (WINS) for network basic input/output system (NetBIOS) name resolution. A set of computers that are running UNIX provide the Dynamic Host Configuration Protocol (DHCP) services for automatic IP addressing.
|
||||
|
||||
Woodgrove Bank is in the process of migrating their computers from Windows Vista and Windows Server 2008 to Windows 8 and Windows Server 2012. A significant number of the computers at Woodgrove Bank continue to run Windows Vista and Windows Server 2008. Interoperability between the previous and newer operating systems must be maintained. Wherever possible, security features applied to the newer operating systems must also be applied to the previous operating systems.
|
||||
|
||||
A key line-of-business program called WGBank consists of a client program running on most of the desktop computers in the organization. This program accesses several front-end server computers that run the server-side part of WGBank. These front-end servers only do the processing — they do not store the data. The data is stored in several back-end database computers that are running Microsoft SQL Server.
|
||||
|
||||
## Design requirements
|
||||
|
||||
|
||||
The network administrators want to implement Windows Firewall with Advanced Security throughout their organization to provide an additional security layer to their overall security strategy. They want to create firewall rules that allow their business programs to operate, while blocking network traffic that is not wanted.
|
||||
|
||||
The following illustration shows the traffic protection needs for this design example.
|
||||
|
||||
|
||||
|
||||
1. The network infrastructure servers that are running services, such as Active Directory, DNS, DHCP, or WINS, can receive unsolicited inbound requests from network clients. The network clients can receive the responses from the infrastructure servers.
|
||||
|
||||
2. The WGBank front-end servers can receive unsolicited inbound traffic from the client computers and the WGBank partner servers. The WGBank client computers and partner servers can receive the response.
|
||||
|
||||
3. The WGBank front-end servers can send updated information to the client computers to support real-time display. The clients do not poll for this unsolicited traffic, but must be able to receive it.
|
||||
|
||||
4. The WGBank back-end servers can receive SQL query requests from the WGBank front-end servers. The WGBank front-end servers can receive the corresponding responses.
|
||||
|
||||
5. There is no direct communications between the client computers and the WGBank back-end computers.
|
||||
|
||||
6. There is no unsolicited traffic from the WGBank back-end computers to the WGBank front-end servers.
|
||||
|
||||
7. Company policy prohibits the use of peer-to-peer file transfer software. A recent review by the IT staff found that although the perimeter firewall does prevent most of the programs in this category from working, two programs are being used by staff members that do not require an outside server. Firewall rules must block the network traffic created by these programs.
|
||||
|
||||
8. The WGBank partner servers can receive inbound requests from partner computers through the Internet.
|
||||
|
||||
Other traffic notes:
|
||||
|
||||
- Computers are not to receive any unsolicited traffic from any computer other than specifically allowed above.
|
||||
|
||||
- Other outbound network traffic from the client computers not specifically identified in this example is permitted.
|
||||
|
||||
## Design details
|
||||
|
||||
|
||||
Woodgrove Bank uses Active Directory groups and Group Policy Objects to deploy the firewall settings and rules to the computers on their network. They know that they must deploy policies to the following collections of computers:
|
||||
|
||||
- Client computers that run Windows 8, Windows 7, or Windows Vista
|
||||
|
||||
- WGBank front-end servers that run Windows Server 2012 or Windows Server 2008 R2 (there are none in place yet, but their solution must support adding them)
|
||||
|
||||
- WGBank partner servers that run Windows Server 2008
|
||||
|
||||
- WGBank back-end SQL Server computers that run Windows Server 2008 (there are none in place yet, but their solution must support adding them)
|
||||
|
||||
- Infrastructure servers that run Windows Server 2008
|
||||
|
||||
- Active Directory domain controllers that run Windows Server 2008 R2 or Windows Server 2012
|
||||
|
||||
- DHCP servers that run the UNIX operating system
|
||||
|
||||
After evaluating these sets of computers, and comparing them to the Active Directory organizational unit (OU) structure, Woodgrove Bank network administrators determined that there was not a good one-to-one match between the OUs and the sets. Therefore the firewall GPOs will not be linked directly to OUs that hold the relevant computers. Instead, the GPOs are linked to the domain container in Active Directory, and then WMI and group filters are attached to the GPO to ensure that it is applied to the correct computers.
|
||||
|
||||
Setting up groups as described here ensures that you do not have to know what operating system a computer is running before assigning it to a group. A combination of WMI filters and security group filters are used to ensure that members of the group receive the GPO appropriate for the version of Windows running on that computer. For some groups, you might have four or even five GPOs.
|
||||
|
||||
The following groups were created by using the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in, and all computers that run Windows were added to the correct groups:
|
||||
|
||||
- **CG\_FIREWALL\_ALLCOMPUTERS**. Add the predefined and system managed **Domain computers** group as a member of this group. All members of the FIREWALL\_ALLCOMPUTERS group receive an operating system-specific GPO with the common firewall rules applied to all computers.
|
||||
|
||||
The two computer types (client and server) are distinguished by using a WMI filters to ensure that only the policy intended for computers that are running a client version of Windows can be applied to that computer. A similar WMI filter on the server GPO ensures that only computers that are running server versions of Windows can apply that GPO. Each of the GPOs also have security group filters to prevent members of the group FIREWALL\_NO\_DEFAULT from receiving either of these two GPOs.
|
||||
|
||||
- Client computers receive a GPO that configures Windows Firewall with Advanced Security to enforce the default Windows Firewall behavior (allow outbound, block unsolicited inbound). The client default GPO also includes the built-in firewall rule groups Core Networking and File and Printer Sharing. The Core Networking group is enabled for all profiles, whereas the File and Printer Sharing group is enabled for only the Domain and Private profiles. The GPO also includes inbound firewall rules to allow the WGBank front-end server dashboard update traffic, and rules to prevent company-prohibited programs from sending or receiving network traffic, both inbound and outbound.
|
||||
|
||||
- Server computers receive a GPO that includes similar firewall configuration to the client computer GPO. The primary difference is that the rules are enabled for all profiles (not just domain and private). Also, the rules for WGBank dashboard update are not included, because it is not needed on server computers.
|
||||
|
||||
All rules are scoped to allow network traffic only from computers on Woodgrove Bank's corporate network.
|
||||
|
||||
- **CG\_FIREWALL\_NO\_DEFAULT**. Members of this group do not receive the default firewall GPO. Computers are added to this group if there is a business requirement for it to be exempted from the default firewall behavior. The use of a group to represent the exceptions instead of the group members directly makes it easier to support the dynamic nature of the client computer population. A new computer joined to the domain is automatically given the appropriate default firewall GPO, unless it is a member of this group.
|
||||
|
||||
- **CG\_FIREWALL\_WGB\_FE**. This group contains the computer accounts for all the WGBank front-end server computers. Members of this group receive a GPO that configures Windows Firewall with Advanced Security with inbound firewall rules to allow unsolicited WGBank client traffic. Computers in this group also receive the default firewall GPO.
|
||||
|
||||
- **CG\_FIREWALL\_WGB\_SQL**. This group contains the computer accounts for all the WGBank back-end computers that run SQL Server. Members of this group receive a GPO that configures Windows Firewall with Advanced Security with inbound firewall rules to allow the SQL Server program to receive unsolicited queries only from the WGBank front-end servers. Computers in this group also receive the default firewall GPO.
|
||||
|
||||
- **CG\_FIREWALL\_BOUNDARY\_WGBANKFE**. This group contains the computer accounts for the servers that host Web services that can be accessed from the Internet. Members of this group receive a GPO that adds an inbound firewall rule to allow inbound HTTP and HTTPS network traffic from any address, including the Internet. Computers in this group also receive the default firewall GPO.
|
||||
|
||||
- **CG\_FIREWALL\_WINS**. This group contains the computer accounts for all the WINS server computers. Members of this group receive a GPO that configures Windows Firewall with Advanced Security with an inbound firewall rule to allow unsolicited inbound requests from WINS clients. Computers in this group also receive the default firewall GPO.
|
||||
|
||||
- **CG\_FIREWALL\_ADDC**. This group contains all the computer accounts for the Active Directory domain controller server computers. Members of this group receive a GPO that configures Windows Firewall with Advanced Security with inbound firewall rules to allow unsolicited Active Directory client and server-to-server traffic. Computers in this group also receive the default firewall GPO.
|
||||
|
||||
In your own design, create a group for each computer role in your organization that requires different or additional firewall rules. For example, file servers and print servers require additional rules to allow the incoming network traffic for those functions. If a function is ordinarily performed on most computers on the network, you might consider adding computers performing those roles to the common default firewall GPO set, unless there is a security reason not to include it there.
|
||||
|
||||
**Next: **[Domain Isolation Policy Design Example](../p_server_archive/domain-isolation-policy-design-example.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,34 @@
|
||||
---
|
||||
title: Gathering Information about Your Active Directory Deployment (Windows 10)
|
||||
description: Gathering Information about Your Active Directory Deployment
|
||||
ms.assetid: b591b85b-12ac-4329-a47e-bc1b03e66eb0
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Gathering Information about Your Active Directory Deployment
|
||||
|
||||
|
||||
Active Directory is another important item about which you must gather information. You must understand the forest structure. This includes domain layout, organizational unit (OU) architecture, and site topology. This information makes it possible to know where computers are currently placed, their configuration, and the impact of changes to Active Directory that result from implementing Windows Firewall with Advanced Security. Review the following list for information needed:
|
||||
|
||||
- **Names and number of forests**. The forest (not the domain) is the security boundary in an Active Directory implementation. You must understand the current Active Directory architecture to determine the most effective strategy for deploying your firewall and connection security rules using Group Policy. It also enables you to understand which computers can be isolated and how best to accomplish the required degree of isolation.
|
||||
|
||||
- **Names and number of domains**. Authentication in server and domain isolation uses the IKE negotiation process with the Kerberos V5 protocol. This protocol assumes that computers are domain members.
|
||||
|
||||
- **Number and types of trusts**. Trusts affect the logical boundaries of domain isolation and define whether IKE negotiation can occur between computers in different Active Directory domains.
|
||||
|
||||
- **Names and number of sites**. Site architecture is usually aligned with the network topology. Understanding how sites are defined in Active Directory will help provide insight into replication and other details. Site architecture can provide a better understanding of the current Active Directory deployment.
|
||||
|
||||
- **OU structure**. OUs are logical constructs and can therefore be molded to fit many different requirements and goals. The OU structure is an ideal place to examine how Group Policy is currently used and how the OUs are laid out. You do not have to redesign an already implemented OU structure in order to effectively deploy firewall and connection security policy, but an understanding of the structure helps you know what WMI or group filtering is required to apply each GPO to the correct computers.
|
||||
|
||||
- **Existing IPsec policy**. Because this project culminates in the implementation of IPsec policy, you must understand how the network currently uses IPsec (if at all). Windows Firewall with Advanced Security connection security rules for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 are not compatible with earlier versions of Windows. If you already have IPsec policies deployed to computers running Windows XP and Windows Server 2003 in your organization, you must ensure that the new IPsec policies you deploy enable computers using either the old or new IPsec policies to communicate with each other.
|
||||
|
||||
**Next: **[Gathering Information about Your Computers](../p_server_archive/gathering-information-about-your-computers.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,58 @@
|
||||
---
|
||||
title: Gathering Information about Your Computers (Windows 10)
|
||||
description: Gathering Information about Your Computers
|
||||
ms.assetid: 7f7cd3b9-de8e-4fbf-89c6-3d1a47bc2beb
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Gathering Information about Your Computers
|
||||
|
||||
|
||||
One of the most valuable benefits of conducting an asset discovery project is the large amount of data that is obtained about the client and server computers on the network. When you start designing and planning your isolation zones, you must make decisions that require accurate information about the state of all hosts to ensure that they can use IPsec as planned.
|
||||
|
||||
Capture the following information from each computer:
|
||||
|
||||
- **Computer name**. This name is the computer's NetBIOS or DNS name that identifies the computer on the network. Because a computer can have more than one media access control (MAC) or IP address, the computer's name is one of the criteria that can be used to determine uniqueness on the network. Because computer names can be duplicated under some circumstances, the uniqueness should not be considered absolute.
|
||||
|
||||
- **IP address for each network adapter**. The IP address is the address that is used with the subnet mask to identify a host on the network. An IP address is not an effective way to identify an asset because it is often subject to change.
|
||||
|
||||
- **Operating system, service pack, and hotfix versions**. The operating system version is a key factor in determining the ability of a host to communicate by using IPsec. It is also important to track the current state of service packs and updates that might be installed, because these are often used to determine that minimum security standards have been met.
|
||||
|
||||
- **Domain membership**. This information is used to determine whether a computer can obtain IPsec policy from Active Directory or whether it must use a local IPsec policy.
|
||||
|
||||
- **Physical location**. This information is just the location of the device in your organization. It can be used to determine whether a device can participate in a specific isolation group based on its location or the location of the devices that it communicates with regularly.
|
||||
|
||||
- **Hardware type or role**. Some tools that perform host discovery can provide this information by querying the hardware information and running applications to determine its type, such as server, workstation, or portable computer. You can use this information to determine the appropriate IPsec policy to assign, whether a specific computer can participate in isolation, and in which isolation group to include the computer.
|
||||
|
||||
After collecting all this information and consolidating it into a database, perform regular discovery efforts periodically to keep the information current. You need the most complete and up-to-date picture of the managed hosts on their networks to create a design that matches your organization's requirements.
|
||||
|
||||
You can use various methods to gather data from the hosts on the network. These methods range from high-end, fully automated systems to completely manual data collection. Generally, the use of automated methods to gather data is preferred over manual methods for reasons of speed and accuracy.
|
||||
|
||||
## Automated Discovery
|
||||
|
||||
|
||||
Using an automated auditing network management system such as Microsoft System Center Configuration Manager (formerly known as Systems Management Server) provides valuable information about the current state of the IT infrastructure.
|
||||
|
||||
For more information about how System Center Configuration Manager 2007 can help perform automated information gathering, see <http://go.microsoft.com/fwlink/?linkid=110412>.
|
||||
|
||||
## Manual Discovery
|
||||
|
||||
|
||||
The biggest difference between manual discovery methods and automated methods is time.
|
||||
|
||||
You can use the Windows Script Host (WSH), VBScript, and Windows Management Instrumentation (WMI) to create a script file that can collect the system configuration information. VBScript and WMI are built-in to Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2. Starting with Windows Server 2008, Windows PowerShell is included with the operating system. For more information, see “Scripting with Windows PowerShell” (<http://go.microsoft.com/fwlink/?linkid=110413>).
|
||||
|
||||
Whether you use an automatic, manual, or hybrid option to gather the information, one of the biggest issues that can cause problems to the design is capturing the changes between the original inventory scan and the point at which the implementation is ready to start. After the first scan has been completed, make support staff aware that all additional changes must be recorded and the updates noted in the inventory.
|
||||
|
||||
This inventory will be critical for planning and implementing your Windows Firewall with Advanced Security design.
|
||||
|
||||
**Next: **[Gathering Other Relevant Information](../p_server_archive/gathering-other-relevant-information.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,128 @@
|
||||
---
|
||||
title: Gathering Information about Your Current Network Infrastructure (Windows 10)
|
||||
description: Gathering Information about Your Current Network Infrastructure
|
||||
ms.assetid: f98d2b17-e71d-4ffc-b076-118b4d4782f9
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Gathering Information about Your Current Network Infrastructure
|
||||
|
||||
|
||||
Perhaps the most important aspect of planning for Windows Firewall with Advanced Security deployment is the network architecture, because IPsec is layered on the Internet Protocol itself. An incomplete or inaccurate understanding of the network can prevent any Windows Firewall with Advanced Security solution from being successful. Understanding subnet layout, IP addressing schemes, and traffic patterns are part of this effort, but accurately documenting the following components are important to completing the planning phase of this project:
|
||||
|
||||
- **Network segmentation**. This includes IP addressing maps, showing how your routers separate each network segment. It includes information about how the routers are configured, and what security filters they impose on network traffic flowing through them.
|
||||
|
||||
- Network address translation (NAT). NAT is a means of separating network segments by using a device that maps all of the IP addresses on one side of the device to a single IP address accessible on the other side.
|
||||
|
||||
- Network infrastructure devices. This includes the routers, switches, hubs, and other network equipment that makes communications between the computers on the network possible.
|
||||
|
||||
- **Current network traffic model.** This includes the quantity and the characteristics of the network traffic flowing through your network.
|
||||
|
||||
- Intrusion Detection System (IDS) devices. You will need to identify if you have any IDS devices on your network that might be negatively impacted by any encryption introduced in an Encryption Zone.
|
||||
|
||||
The goal is to have enough information to be able to identify an asset by its network location, in addition to its physical location.
|
||||
|
||||
Do not use a complex and poorly documented network as a starting point for the design, because it can leave too many unidentified areas that are likely to cause problems during implementation.
|
||||
|
||||
This guidance helps obtain the most relevant information for planning Windows Firewall with Advanced Security implementation, but it does not try to address other issues, such as TCP/IP addressing or virtual local area network (VLAN) segmentation.
|
||||
|
||||
## Network segmentation
|
||||
|
||||
|
||||
If your organization does not have its current network architecture documented and available for reference, such documentation should be obtained as soon as possible before you continue with the design and deployment. If the documented information is not current or has not been validated recently, you have two options:
|
||||
|
||||
- Accept that the lack of accurate information can cause risk to the project.
|
||||
|
||||
- Undertake a discovery project, either through manual processes or with network analysis tools that can provide the information you need to document the current network topology.
|
||||
|
||||
Although the required information can be presented in many different ways, a series of schematic diagrams is often the most effective method of illustrating and understanding the current network configuration. When creating network diagrams, do not include too much information. If necessary, use multiple diagrams that show different layers of detail. Use a top-level diagram that illustrates the major sites that make up your organization's network, and then break out each site into a more detailed diagram that captures a deeper level of detail. Continue until you reach the individual IP subnet level, and so have the means to identify the network location of every computer in your organization.
|
||||
|
||||
During this process, you might discover some network applications and services that are not compatible with IPsec. For example, IPsec breaks network-based prioritization and port/protocol-based traffic management. If traffic management or prioritization must be based on ports or protocol, the host itself must be able to perform any traffic management or prioritization.
|
||||
|
||||
Other examples of incompatibility include:
|
||||
|
||||
- Cisco NetFlow on routers cannot analyze packets between IPsec members based on protocol or port.
|
||||
|
||||
- Router-based Quality of Service (QoS) cannot use ports or protocols to prioritize traffic. However, using firewall rules that specify IP addresses to prioritize traffic are not affected by this limitation of QoS. For example, a rule that says "From anyone to anyone using port 80 prioritize" does not work, but a rule that says "From anyone to 10.0.1.10 prioritize" works.
|
||||
|
||||
- Weighted Fair Queuing and other flow-based router traffic priority methods might fail.
|
||||
|
||||
- Devices that do not support or allow IP protocol 50, the port that is used by Encapsulating Security Payload (ESP).
|
||||
|
||||
- Router access control lists (ACLs) cannot examine protocol and port fields in ESP-encrypted packets, and therefore the packets are dropped. ACLs based only on IP address are forwarded as usual. If the device cannot parse ESP, any ACLs that specify port or protocol rules will not be processed on the ESP packets. If the device has an ESP parser and uses encryption, ACLs that specify port or protocol rules will not be processed on the ESP packets.
|
||||
|
||||
- Network monitoring tools might be unable to parse ESP packets that are not encrypted (ESP-Null).
|
||||
|
||||
**Note**
|
||||
Network Monitor added an ESP parser starting in version 2.1 to aid troubleshooting of unencrypted IPsec packets. The latest version of Network Monitor is available as a free download from Microsoft (<http://go.microsoft.com/fwlink/?linkid=94770>).
|
||||
|
||||
|
||||
|
||||
## Network address translation (NAT)
|
||||
|
||||
|
||||
IPsec NAT traversal (NAT-T) enables IPsec peers that are behind NATs to detect the presence of NATs, negotiate IPsec security associations (SAs), and send ESP-protected data even though the addresses in the IPsec-protected IPv4 packets change. IPsec NAT-T does not support the use of AH across NAT devices.
|
||||
|
||||
IPsec NAT-T is supported by Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, Windows Server 2008 R2,
|
||||
|
||||
For detailed information about how IPsec NAT-T works, see "IPsec NAT Traversal Overview" in the August 2002 Cable Guy article at <http://go.microsoft.com/fwlink/?LinkId=45080>.
|
||||
|
||||
## Network infrastructure devices
|
||||
|
||||
|
||||
The devices that make up the network infrastructure (routers, switches, load balancers, and firewalls) must be able communicate using IPsec after the solution is implemented. For this reason, you have to examine the following characteristics of these network devices to ensure that they can handle the technical and physical requirements of the design:
|
||||
|
||||
- **Make/model**. You can use this information to determine the features that the device supports. In addition, check the BIOS version or software running on the device to ensure that IPsec is supported.
|
||||
|
||||
- **Amount of RAM**. This information is useful when you are analyzing capacity or the impact of IPsec on the device.
|
||||
|
||||
- **Traffic analysis**. Information, such as peak usage and daily orweekly trends, is helpful to have. The information helps provide a baseline snapshot of the device and how it is used over time. If problems occur after IPsec is implemented, the information can help determine whether the root cause is related to greater usage of the device.
|
||||
|
||||
- **Router ACLs that affect IPsec directly**. ACLs directly affect the ability of specific protocols to function. For example, blocking the Kerberos V5 protocol (UDP and TCP port 88) or IP protocol 50 or 51 prevents IPsec from working. Devices must also be configured to allow IKE traffic (UDP port 500) if using NAT-T (UDP port 4500).
|
||||
|
||||
- **Networks/subnets connected to device interfaces**. This information provides the best picture of what the internal network looks like. Defining the boundary of subnets based on an address range is straightforward and helps identify whether other addresses are either unmanaged or foreign to the internal network (such as IP addresses on the Internet).
|
||||
|
||||
- **VLAN segmentation**. Determining how VLANs are implemented on the network can help you understand traffic patterns and security requirements, and then help to determine how IPsec might augment or interfere with these requirements.
|
||||
|
||||
- **The maximum transmission unit (MTU) size on device interface(s)**. The MTU defines the largest datagram that can be transmitted on a particular interface without being divided into smaller pieces for transmission (a process also known as *fragmentation*). In IPsec communications, the MTU is necessary to anticipate when fragmentation occurs. Packet fragmentation must be tracked for Internet Security Association and Key Management Protocol (ISAKMP) by the router. IPsec configures the MTU size on the session to the minimum-discovered MTU size along the communication path being used, and then set the Don't Fragment bit (DF bit) to 1.
|
||||
|
||||
**Note**
|
||||
If Path MTU (PMTU) discovery is enabled and functioning correctly, you do not have to gather the MTU size on device interfaces. Although sources, such as the Windows Server 2003 Hardening Guide, recommend disabling PMTU discovery, it must be enabled for IPsec to function correctly.
|
||||
|
||||
|
||||
|
||||
- **Intrusion detection system (IDS) in use**. Your IDS must have an IPsec-compatible parser to detect ESP packets. If the IDS does not have such a parser, it cannot determine if data in those packets is encrypted.
|
||||
|
||||
After you obtain this information, you can quickly determine whether you must upgrade the devices to support the requirements of the project, change the ACLs, or take other measures to ensure that the devices can handle the loads needed.
|
||||
|
||||
## Current network traffic model
|
||||
|
||||
|
||||
After gathering the addressing and network infrastructure information, the next step is to examine the communications flow. For example, if a department such as Human Resources (HR) spans several buildings, and you want to use server isolation with encryption to help protect information in that department, you must know how those buildings are connected to determine the level of "trust" to place in the connection. A highly secured building that is connected by an unprotected cable to another building that is not secured can be compromised by an eavesdropping or information replay attack. If such an attack is considered a threat, IPsec can help by providing strong mutual authentication and traffic encryption for trusted hosts. IPsec allows you to more securely communicate across untrusted links such as the Internet.
|
||||
|
||||
When you examine traffic flow, look closely at how all managed and unmanaged devices interact. This includes non-Windows-based computers running Linux, UNIX, and Macintosh. Ask yourself such questions as:
|
||||
|
||||
- Do specific communications occur at the port and protocol level, or are there many sessions between the same hosts across many protocols?
|
||||
|
||||
- How do servers and clients communicate with each other?
|
||||
|
||||
- Are there security devices or projects currently implemented or planned that could affect an isolation deployment? For example, if you use Windows Firewall on your computers to "lock down" specific ports, such as UDP 500, IKE negotiations fail.
|
||||
|
||||
Some of the more common applications and protocols are as follows:
|
||||
|
||||
- **NetBIOS over TCP/IP (NetBT) and server message block (SMB)**. On a LAN, it is common to have ports 137, 138, and 139 enabled for NetBT and port 445 enabled for SMB. These ports provide NetBIOS name resolution services and other features. Unfortunately, they also allow the creation of *null sessions*. A null session is a session that is established on a host that does not use the security context of a known user or entity. Frequently, these sessions are anonymous.
|
||||
|
||||
- **Remote procedure call (RPC)**. RPC operates by listening on a port known as the *endpoint mapper*, TCP port 135. The response to a query on this port is an instruction to begin communication on another port in the ephemeral range (ports numbered over 1024). In a network that is segmented by firewalls, RPC communication presents a configuration challenge because it means opening the RPC listener port and all ports greater than 1024. Opening so many ports increases the attack surface of the whole network and reduces the effectiveness of the firewalls. Computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 reduce this risk by introducing stateful inspection of RPC traffic. Because many applications depend on RPC for basic functionality, any firewall and connection security policy must take RPC requirements into account.
|
||||
|
||||
- **Other traffic**. Windows Firewall with Advanced Security can help secure transmissions between computers by providing authentication of the packets in addition to encrypting the data that they contain. The important thing to do is to identify what must be protected, and the threats that must be mitigated. Examine and model other traffic or traffic types that must be secured.
|
||||
|
||||
**Next: **[Gathering Information about Your Active Directory Deployment](../p_server_archive/gathering-information-about-your-active-directory-deployment.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
91
windows/keep-secure/gathering-other-relevant-information.md
Normal file
91
windows/keep-secure/gathering-other-relevant-information.md
Normal file
@ -0,0 +1,91 @@
|
||||
---
|
||||
title: Gathering Other Relevant Information (Windows 10)
|
||||
description: Gathering Other Relevant Information
|
||||
ms.assetid: 87ccca07-4346-496b-876d-cdde57d0ce17
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Gathering Other Relevant Information
|
||||
|
||||
|
||||
This topic discusses several other things that you should examine to see whether they will cause any complications in your ability to deploy Windows Firewall with Advanced Security policies in your organization.
|
||||
|
||||
## Capacity considerations
|
||||
|
||||
|
||||
Because IPsec uses mathematically intensive cryptographic techniques, it can consume significant overhead on a computer. Areas to watch:
|
||||
|
||||
- **Encryption.** You might use 256-bit Advanced Encryption Standard (AES-256) and 384-bit Secure Hash Algorithm (SHA-384) to check integrity in situations that require the strongest available encryption and key exchange protection. If you have NICs that support IPsec Task Offload, you can reduce the effect that encryption has on network throughput. For more information, see [IPsec Task Offload](http://technet.microsoft.com/network/dd277647.aspx) at http://technet.microsoft.com/network/dd277647.aspx
|
||||
|
||||
- **Security association (SA) negotiation.** You can use a shorter lifetime for the main mode SA, such as three hours, but then you might need to make tradeoffs. Because each main mode SA occupies approximately 5 KB of RAM, situations in which a server brokers tens of thousands of concurrent connections can lead to overutilization.
|
||||
|
||||
- **NAT devices.** As discussed earlier, NAT does not allow Authentication Header (AH) conversations between hosts. If NAT devices exist on the internal network, ESP must be selected instead of AH.
|
||||
|
||||
- **Switches and routers.** Proper capacity planning for the implementation of IPsec is more about thorough testing and expected traffic loads than exact calculations. You might have to upgrade or reconfigure switches or routers that currently exceed 75 percent usage to allow for increased traffic on the device and still provide some extra usage for bursts of traffic.
|
||||
|
||||
- **Other factors.** These include CPU usage on network infrastructure servers, increased overhead on servers and workstations running IPsec (especially servers, because they usually contain more main mode SAs than clients), and increased network latency because of IPsec negotiation.
|
||||
|
||||
**Note**
|
||||
When Microsoft deployed its own domain isolation solution, it found a one to three percent increase in usage on the network as a direct result of IPsec.
|
||||
|
||||
|
||||
|
||||
## Group Policy deployment groups and WMI filters
|
||||
|
||||
|
||||
You do not have to rearrange the organization unit (OU) hierarchy of your Active Directory domains to effectively deploy Windows Firewall with Advanced Security GPOs. Instead, you can link your GPOs at the domain level (or another high level container), and then use security group filtering or WMI filtering to ensure that only the appropriate computers or users can apply the GPO settings. Because the firewall and connection security rules have evolved significantly from Windows 2000 Server to Windows XP and Windows Server 2003, and now with Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2, we recommend that you use WMI filtering to dynamically ensure that GPOs apply only to computers that are running the correct operating system. It is not necessary to use this technique if your network consists of computers running Windows Vista or later.
|
||||
|
||||
## Different Active Directory trust environments
|
||||
|
||||
|
||||
When you design a domain isolation policy, consider any logical boundaries that might affect IPsec-secured communications. For example, the trust relationships between your domains and forests are critical in determining an appropriate IKE authentication method.
|
||||
|
||||
Kerberos V5 authentication is recommended for use in a two-way (mutual) domain and forest trust environment. You can use Kerberos V5 for IKE authentication across domains that have two-way trusts established, if the domains are in the same forest or different forests. If the two domains are in different forests, you must configure two external trusts, one for each direction, between the domains. The external trusts must use the fully qualified domain name (FQDN) of the domains, and IPsec policy must allow an IKE initiator in one domain to communicate with any domain controller in the forest domain hierarchy, so that the initiator can obtain a Kerberos V5 ticket from a domain controller in the responder’s domain. If firewalls separate the domains then you must configure the firewall to allow Kerberos V5 traffic over UDP destination port 88, TCP destination port 88, and UDP destination port 389.
|
||||
|
||||
For more information, see "Active Directory in Networks Segmented by Firewalls" at <http://go.microsoft.com/fwlink/?LinkId=45087>.
|
||||
|
||||
If the use of Kerberos V5 authentication is not possible because two-way trusts across forests cannot be established as in some large enterprise environments, you can use a public key infrastructure (PKI) and digital certificates to establish IPsec-trusted communication. For an example of how Microsoft deployed their PKI, see "Deploying PKI Inside Microsoft" at <http://go.microsoft.com/fwlink/?LinkId=45088>.
|
||||
|
||||
## Creating firewall rules to permit IKE, AH, and ESP traffic
|
||||
|
||||
|
||||
In some cases, IPsec-secured traffic might have to pass through a router, perimeter firewall, or other filtering device. In the case of a router, unless the router filters TCP and UDP traffic or other upper-level protocol headers, no special configuration is required to allow the IPsec traffic to be forwarded.
|
||||
|
||||
In the case of a filtering router or a firewall, you must configure these devices to allow IPsec traffic to be forwarded. Configure the firewall to allow IPsec traffic on UDP source and destination port 500 (IKE), UDP source and destination port 4500 (IPsec NAT-T), and IP Protocol 50 (ESP). You might also have to configure the firewall to allow IPsec traffic on IP protocol 51 (AH) to allow troubleshooting by IPsec administrators and to allow the IPsec traffic to be inspected.
|
||||
|
||||
For more information, see "How to Enable IPsec Traffic Through a Firewall" at <http://go.microsoft.com/fwlink/?LinkId=45085>.
|
||||
|
||||
## Network load balancing and server clusters
|
||||
|
||||
|
||||
There are challenges implementing connection security for network traffic going to and from network load balancing (NLB) clusters and server clusters. NLB enables multiple servers to be clustered together to provide high availability for a service by providing automatic failover to other nodes in the cluster. Because IPsec matches a security association to a specific computer, it prevents different computers from handling the same client connection. If a different node in the cluster responds to an IPsec connection that was originally established by another node, the traffic will be dropped by the client computer as untrusted.
|
||||
|
||||
This means that NLB in "no affinity" mode is not supported by IPsec at all. If you must use "no affinity" mode in the cluster then consider including the servers that make up the cluster in your IPsec exemption group, and allowing clients to communicate with the servers without IPsec.
|
||||
|
||||
**IPsec improvements for clusters running Windows Server 2008**
|
||||
|
||||
Starting with Windows Server 2008 and Windows Vista, IPsec is much more tightly integrated into TCP/IP than in earlier versions of Windows. When a TCP connection is dropped because of a cluster node failover, IPsec on a computer that is running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 detects the TCP connection failure and removes the IPsec SAs for that connection. When the new TCP connection is established to another node, IPsec can negotiate new SAs immediately without having to wait for the obsolete SAs to time out.
|
||||
|
||||
## Network inspection technologies
|
||||
|
||||
|
||||
Within a TCP/IP packet, IPsec without encryption changes the offsets for the destination ports and protocols. These changes can adversely affect applications that are running on network devices such as routers that monitor and manage traffic on the network. While some network applications have been updated to support IPsec, some are not yet compatible. Check with the vendor of your device to see whether the changes in the protocol and port fields caused by IPsec are compatible with the device.
|
||||
|
||||
Any device designed to view network traffic, such as hardware protocol analyzers or Microsoft Network Monitor, cannot parse ESP-encrypted traffic. Only the destination computer, with which the originating computer negotiated the connection, can decrypt the traffic.
|
||||
|
||||
In general, IPsec defeats network-based prioritization and port- or protocol-based traffic management. For encrypted packets, there is no workaround; the host itself must handle any traffic management functions. For unencrypted, authenticated-only packets, the devices and applications must be aware of how IPsec changes packets to be able to do anything with them other than route them to the correct host. If you cannot upgrade monitoring or management devices to support IPsec, it is important that you record this information and figure it into your domain or server isolation design.
|
||||
|
||||
Network Monitor includes parsers for the ISAKMP (IKE), AH, and ESP protocols. Network Monitor parsers for ESP can parse inside the ESP packet only if ESP null-encryption is being used. Network Monitor cannot parse the encrypted parts of IPsec ESP traffic when encryption is performed in software. However, if encryption is performed by an IPsec hardware offload network adapter, the ESP packets can be decrypted when Network Monitor captures them on either the source or the destination and, therefore, they can be parsed. To diagnose ESP software-encrypted communication, you must disable ESP encryption and use ESP-null encryption by changing the IPsec policy or connection security rule on both computers.
|
||||
|
||||
Network Monitor is available as a free download from Microsoft at <http://go.microsoft.com/fwlink/?linkid=94770>.
|
||||
|
||||
**Next: **[Determining the Trusted State of Your Computers](../p_server_archive/determining-the-trusted-state-of-your-computers.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
30
windows/keep-secure/gathering-the-information-you-need.md
Normal file
30
windows/keep-secure/gathering-the-information-you-need.md
Normal file
@ -0,0 +1,30 @@
|
||||
---
|
||||
title: Gathering the Information You Need (Windows 10)
|
||||
description: Gathering the Information You Need
|
||||
ms.assetid: 545fef02-5725-4b1e-b67a-a32d94c27d15
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Gathering the Information You Need
|
||||
|
||||
|
||||
Before starting the planning process for a Windows Firewall with Advanced Security deployment, you must collect and analyze up-to-date information about the network, the directory services, and the computers that are already deployed in the organization. This information enables you to create a design that accounts for all possible elements of the existing infrastructure. If the gathered information is not accurate, problems can occur when devices and computers that were not considered during the planning phase are encountered during implementation.
|
||||
|
||||
Review each of the following topics for guidance about the kinds of information that you must gather:
|
||||
|
||||
- [Gathering Information about Your Current Network Infrastructure](../p_server_archive/gathering-information-about-your-current-network-infrastructure.md)
|
||||
|
||||
- [Gathering Information about Your Active Directory Deployment](../p_server_archive/gathering-information-about-your-active-directory-deployment.md)
|
||||
|
||||
- [Gathering Information about Your Computers](../p_server_archive/gathering-information-about-your-computers.md)
|
||||
|
||||
- [Gathering Other Relevant Information](../p_server_archive/gathering-other-relevant-information.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
46
windows/keep-secure/gpo-domiso-boundary-ws2008.md
Normal file
46
windows/keep-secure/gpo-domiso-boundary-ws2008.md
Normal file
@ -0,0 +1,46 @@
|
||||
---
|
||||
title: GPO\_DOMISO\_Boundary\_WS2008 (Windows 10)
|
||||
description: GPO\_DOMISO\_Boundary\_WS2008
|
||||
ms.assetid: ead3a510-c329-4c2a-9ad2-46a3b4975cfd
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# GPO\_DOMISO\_Boundary\_WS2008
|
||||
|
||||
|
||||
This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. Woodgrove Bank began by copying and pasting the GPO for the Windows Server 2008 version of the isolated domain GPO, and then renamed the copy to reflect its new purpose.
|
||||
|
||||
This GPO supports the ability for computers that are not part of the isolated domain to access specific servers that must be available to those untrusted computers. It is intended to only apply to server computers that are running Windows Server 2012, Windows Server 2008 R2 or Windows Server 2008.
|
||||
|
||||
## IPsec settings
|
||||
|
||||
|
||||
The copied GPO includes and continues to use the IPsec settings that configure key exchange, main mode, and quick mode algorithms for the isolated domain when authentication can be used.
|
||||
|
||||
## Connection security rules
|
||||
|
||||
|
||||
Rename the **Isolated Domain Rule** to **Boundary Zone Rule**. Change the authentication mode to **Request inbound and request outbound**. In this mode, the computer uses authentication when it can, such as during communication with a member of the isolated domain. It also supports the "fall back to clear" ability of request mode when an untrusted computer that is not part of the isolated domain connects.
|
||||
|
||||
## Registry settings
|
||||
|
||||
|
||||
The boundary zone uses the same registry settings as the isolated domain to optimize IPsec operation. For more information, see the description of the registry settings in [Isolated Domain](../p_server_archive/isolated-domain.md).
|
||||
|
||||
## Firewall rules
|
||||
|
||||
|
||||
Copy the firewall rules for the boundary zone from the GPO that contains the firewall rules for the isolated domain. Customize this copy, removing rules for services not needed on servers in this zone, and adding inbound rules to allow the network traffic for the services that are to be accessed by other computers. For example, Woodgrove Bank added a firewall rule to allow inbound network traffic to TCP port 80 for Web client requests.
|
||||
|
||||
Make sure that the GPO that contains firewall rules for the isolated domain does not also apply to the boundary zone to prevent overlapping, and possibly conflicting rules.
|
||||
|
||||
**Next: **[Encryption Zone GPOs](../p_server_archive/encryption-zone-gpos.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
50
windows/keep-secure/gpo-domiso-encryption-ws2008.md
Normal file
50
windows/keep-secure/gpo-domiso-encryption-ws2008.md
Normal file
@ -0,0 +1,50 @@
|
||||
---
|
||||
title: GPO\_DOMISO\_Encryption\_WS2008 (Windows 10)
|
||||
description: GPO\_DOMISO\_Encryption\_WS2008
|
||||
ms.assetid: 84375480-af6a-4c79-aafe-0a37115a7446
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# GPO\_DOMISO\_Encryption\_WS2008
|
||||
|
||||
|
||||
This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. Woodgrove Bank began by copying and pasting the GPO for the Windows Server 2008 version of the isolated domain GPO, and then renamed the copy to reflect its new purpose.
|
||||
|
||||
This GPO supports the ability for servers that contain sensitive data to require encryption for all connection requests. It is intended to only apply to server computers that are running Windows Server 2012, Windows Server 2008 R2 or Windows Server 2008.
|
||||
|
||||
## IPsec settings
|
||||
|
||||
|
||||
The copied GPO includes and continues to use the IPsec settings that configure key exchange, main mode, and quick mode algorithms for the isolated domain The following changes are made to encryption zone copy of the GPO:
|
||||
|
||||
The encryption zone servers require all connections to be encrypted. To do this, change the IPsec default settings for the GPO to enable the setting **Require encryption for all connection security rules that use these settings**. This disables all integrity-only algorithm combinations.
|
||||
|
||||
## Connection security rules
|
||||
|
||||
|
||||
Rename the **Isolated Domain Rule** to **Encryption Zone Rule**. Leave the authentication mode setting on **Require inbound and request outbound**. In this mode, the computer forces authentication for all inbound network traffic, and uses it when it can on outbound traffic.
|
||||
|
||||
## Registry settings
|
||||
|
||||
|
||||
The encryption zone uses the same registry settings as the isolated domain to optimize IPsec operation. For more information, see the description of the registry settings in [Isolated Domain](../p_server_archive/isolated-domain.md).
|
||||
|
||||
## Firewall rules
|
||||
|
||||
|
||||
Copy the firewall rules for the encryption zone from the GPO that contains the firewall rules for the isolated domain. Customize this copy, removing rules for services not needed on servers in this zone, and adding inbound rules to allow the network traffic for the services that are to be accessed by other computers. For example, Woodgrove Bank added a firewall rule to allow inbound network traffic to TCP port 1433 for SQL Server client requests.
|
||||
|
||||
Change the action for every inbound firewall rule from **Allow the connection** to **Allow only secure connections**, and then select **Require the connections to be encrypted**.
|
||||
|
||||
Make sure that the GPO that contains firewall rules for the isolated domain does not also apply to the boundary zone to prevent overlapping, and possibly conflicting rules.
|
||||
|
||||
**Next: **[Server Isolation GPOs](../p_server_archive/server-isolation-gpos.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
71
windows/keep-secure/gpo-domiso-firewall.md
Normal file
71
windows/keep-secure/gpo-domiso-firewall.md
Normal file
@ -0,0 +1,71 @@
|
||||
---
|
||||
title: GPO\_DOMISO\_Firewall (Windows 10)
|
||||
description: GPO\_DOMISO\_Firewall
|
||||
ms.assetid: 318467d2-5698-4c5d-8000-7f56f5314c42
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# GPO\_DOMISO\_Firewall
|
||||
|
||||
|
||||
This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to computers that are running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2.
|
||||
|
||||
## Firewall settings
|
||||
|
||||
|
||||
This GPO provides the following settings:
|
||||
|
||||
- Unless otherwise stated, the firewall rules and settings described here are applied to all profiles.
|
||||
|
||||
- The firewall is enabled, with inbound, unsolicited connections blocked and outbound connections allowed.
|
||||
|
||||
- Under the domain profile, the settings **Display notifications to the user**, **Apply local firewall rules**, and **Apply local connection security rules** are all set to **No**. These settings are applied only to the domain profile because the computers can only receive an exception rule for a required program from a GPO if they are connected to the domain. Under the public and private profiles, those settings are all set to **Yes**.
|
||||
|
||||
**Note**
|
||||
Enforcing these settings requires that you define any firewall exceptions for programs, because the user cannot manually permit a new program. You must deploy the exception rules by adding them to this GPO. We recommend that you do not enable these settings until you have tested all your applications and have tested the resulting rules in a test lab and then on pilot computers.
|
||||
|
||||
|
||||
|
||||
## Firewall rules
|
||||
|
||||
|
||||
This GPO provides the following rules:
|
||||
|
||||
- Built-in firewall rule groups are configured to support typically required network operation. The following rule groups are set to **Allow the connection**:
|
||||
|
||||
- Core Networking
|
||||
|
||||
- File and Printer Sharing
|
||||
|
||||
- Network Discovery
|
||||
|
||||
- Remote Administration
|
||||
|
||||
- Remote Desktop
|
||||
|
||||
- Remote Event Log Management
|
||||
|
||||
- Remote Scheduled Tasks Management
|
||||
|
||||
- Remote Service Management
|
||||
|
||||
- Remote Volume Management
|
||||
|
||||
- Windows Firewall Remote Management
|
||||
|
||||
- Windows Management Instrumentation (WMI)
|
||||
|
||||
- Windows Remote Management
|
||||
|
||||
- A firewall exception rule to allow required network traffic for the WGBank dashboard program. This inbound rule allows network traffic for the program Dashboard.exe in the %ProgramFiles%\\WGBank folder. The rule is also filtered to only allow traffic on port 1551. This rule is applied only to the domain profile.
|
||||
|
||||
**Next: **[Isolated Domain GPOs](../p_server_archive/isolated-domain-gpos.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
181
windows/keep-secure/gpo-domiso-isolateddomain-clients.md
Normal file
181
windows/keep-secure/gpo-domiso-isolateddomain-clients.md
Normal file
@ -0,0 +1,181 @@
|
||||
---
|
||||
title: GPO\_DOMISO\_IsolatedDomain\_Clients (Windows 10)
|
||||
description: GPO\_DOMISO\_IsolatedDomain\_Clients
|
||||
ms.assetid: 73cd9e25-f2f1-4ef6-b0d1-d36209518cd9
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# GPO\_DOMISO\_IsolatedDomain\_Clients
|
||||
|
||||
|
||||
This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to client computers that are running Windows 8, Windows 7, or Windows Vista.
|
||||
|
||||
Because client computers can sometimes be portable, the settings and rules for this GPO are applied to only the domain profile.
|
||||
|
||||
## General settings
|
||||
|
||||
|
||||
This GPO provides the following settings:
|
||||
|
||||
- No firewall settings are included in this GPO. Woodgrove Bank created separate GPOs for firewall settings (see the [Firewall GPOs](../p_server_archive/firewall-gpos.md) section) in order to share them with all clients in all isolation zones with minimum redundancy.
|
||||
|
||||
- The ICMP protocol is exempted from authentication requirements to support easier network troubleshooting.
|
||||
|
||||
- Diffie-Hellman Group 2 is specified as the key exchange algorithm. This is the strongest algorithm available that is supported by all the operating systems that are being used at Woodgrove Bank. After Woodgrove Bank has completed the upgrade to versions of Windows that support stronger algorithms, such as Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2, they can remove the weaker key exchange algorithms, and use only the stronger ones.
|
||||
|
||||
- The registry settings shown in the following table. For more information, see the description of the registry settings in [Isolated Domain](../p_server_archive/isolated-domain.md).
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Setting</th>
|
||||
<th>Value</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Enable PMTU Discovery</p></td>
|
||||
<td><p>1</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>IPsec Exemptions</p></td>
|
||||
<td><p>3</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
- The main mode security method combinations in the order shown in the following table.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Integrity</th>
|
||||
<th>Encryption</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Secure Hash Algorithm (SHA-1)</p></td>
|
||||
<td><p>Advanced Encryption Standard (AES-128)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>SHA-1</p></td>
|
||||
<td><p>3DES</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
- The following quick mode security data integrity algorithms combinations in the order shown in the following table.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Protocol</th>
|
||||
<th>Integrity</th>
|
||||
<th>Key Lifetime (minutes/KB)</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>ESP</p></td>
|
||||
<td><p>SHA-1</p></td>
|
||||
<td><p>60/100,000</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
- The quick mode security data integrity and encryption algorithm combinations in the order shown in the following table.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Protocol</th>
|
||||
<th>Integrity</th>
|
||||
<th>Encryption</th>
|
||||
<th>Key Lifetime (minutes/KB)</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>ESP</p></td>
|
||||
<td><p>SHA-1</p></td>
|
||||
<td><p>AES-128</p></td>
|
||||
<td><p>60/100,000</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>ESP</p></td>
|
||||
<td><p>SHA-1</p></td>
|
||||
<td><p>3DES</p></td>
|
||||
<td><p>60/100,000</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
**Note**
|
||||
Do not use the MD5 and DES algorithms in your GPOs. They are included only for compatibility with previous versions of Windows.
|
||||
|
||||
|
||||
|
||||
## Connection Security Rules
|
||||
|
||||
|
||||
This GPO provides the following rules:
|
||||
|
||||
- A connection security rule named **Isolated Domain Rule** with the following settings:
|
||||
|
||||
- From **Any IP address** to **Any IP address**.
|
||||
|
||||
- **Require inbound and request outbound** authentication requirements.
|
||||
|
||||
**Important**
|
||||
On this, and all other GPOs that require authentication, Woodgrove Bank first chose to only request authentication. After confirming that the computers were successfully communicating by using IPsec, they switched the GPOs to require authentication.
|
||||
|
||||
|
||||
|
||||
- For **First authentication methods**, select **Computer Kerberos v5** as the primary method. Add certificate-based authentication from **DC=com,DC=woodgrovebank,CN=CorporateCertServer** for computers that cannot run Windows or cannot join the domain, but must still participate in the isolated domain.
|
||||
|
||||
- For **Second authentication**, select **User Kerberos v5**, and then select the **Second authentication is optional** check box.
|
||||
|
||||
- A connection security rule to exempt computers that are in the exemption list from the requirement to authenticate:
|
||||
|
||||
- The IP addresses of all computers on the exemption list must be added individually under **Endpoint 2**.
|
||||
|
||||
- Authentication mode is set to **Do not authenticate**.
|
||||
|
||||
**Next: **[GPO\_DOMISO\_IsolatedDomain\_Servers](../p_server_archive/gpo-domiso-isolateddomain-servers.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
31
windows/keep-secure/gpo-domiso-isolateddomain-servers.md
Normal file
31
windows/keep-secure/gpo-domiso-isolateddomain-servers.md
Normal file
@ -0,0 +1,31 @@
|
||||
---
|
||||
title: GPO\_DOMISO\_IsolatedDomain\_Servers (Windows 10)
|
||||
description: GPO\_DOMISO\_IsolatedDomain\_Servers
|
||||
ms.assetid: 33aed8f3-fdc3-4f96-985c-e9d2720015d3
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# GPO\_DOMISO\_IsolatedDomain\_Servers
|
||||
|
||||
|
||||
This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to server computers that are running Windows Server 2012, Windows Server 2008 or Windows Server 2008 R2.
|
||||
|
||||
Because so many of the settings and rules for this GPO are common to those in the GPO for Windows 8, Windows 7 and Windows Vista, you can save time by exporting the Windows Firewall with Advanced Security piece of the GPO for Windows 8, Windows 7 and Windows Vista, and importing it to the GPO for Windows Server 2012, Windows Server 2008 and Windows Server 2008 R2. After the import, change only the items specified here:
|
||||
|
||||
- This GPO applies all its settings to all profiles: Domain, Private, and Public. Because a server is not expected to be mobile and changing networks, configuring the GPO in this way prevents a network failure or the addition of a new network adapter from unintentionally switching the computer to the Public profile with a different set of rules (in the case of a server running Windows Server 2008).
|
||||
|
||||
**Important**
|
||||
Windows Vista and Windows Server 2008 support only one network location profile at a time. The profile for the least secure network type is applied to the computer. If you attach a network adapter to a computer that is not physically connected to a network, the public network location type is associated with the network adapter and applied to the computer.
|
||||
|
||||
|
||||
|
||||
**Next: **[Boundary Zone GPOs](../p_server_archive/boundary-zone-gpos.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,64 @@
|
||||
---
|
||||
title: Identifying Your Windows Firewall with Advanced Security Deployment Goals (Windows 10)
|
||||
description: Identifying Your Windows Firewall with Advanced Security Deployment Goals
|
||||
ms.assetid: 598cf45e-2e1c-4947-970f-361dfa264bba
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Identifying Your Windows Firewall with Advanced Security Deployment Goals
|
||||
|
||||
|
||||
Correctly identifying your Windows Firewall with Advanced Security deployment goals is essential for the success of your Windows Firewall with Advanced Security design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your deployment goals. Prioritize and, if possible, combine your deployment goals so that you can design and deploy Windows Firewall with Advanced Security by using an iterative approach. You can take advantage of the predefined Windows Firewall with Advanced Security deployment goals presented in this guide that are relevant to your scenarios.
|
||||
|
||||
The following table lists the three main tasks for articulating, refining, and subsequently documenting your Windows Firewall with Advanced Security deployment goals.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Deployment goal tasks</th>
|
||||
<th>Reference links</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Evaluate predefined Windows Firewall with Advanced Security deployment goals that are provided in this section of the guide, and combine one or more goals to reach your organizational objectives.</p></td>
|
||||
<td><p>Predefined deployment goals:</p>
|
||||
<ul>
|
||||
<li><p>[Protect Computers from Unwanted Network Traffic](fe94e9b8-c456-4343-af5f-5511b8047d29)</p></li>
|
||||
<li><p>[Restrict Access to Only Trusted Computers](29805c5c-a8e4-4600-86b9-7abb9a068919)</p></li>
|
||||
<li><p>[Require Encryption When Accessing Sensitive Network Resources](261bd90d-5a8a-4de1-98c7-6d07e5d81267)</p></li>
|
||||
<li><p>[Restrict Access to Sensitive Resources to Only Specified Users or Computers](09cd6d03-c1ce-45ed-a894-d7f7aaa9b6f0)</p></li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Map one goal or a combination of the predefined deployment goals to an existing Windows Firewall with Advanced Security design.</p></td>
|
||||
<td><ul>
|
||||
<li><p>[Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design](39bb8fa5-4601-45ae-83c5-121d42f7f82c)</p></li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Based on the status of your current infrastructure, document your deployment goals for your Windows Firewall with Advanced Security design into a deployment plan.</p></td>
|
||||
<td><ul>
|
||||
<li><p>[Designing A Windows Firewall with Advanced Security Strategy](36230ca4-ee8d-4b2c-ab4f-5492b4400340)</p></li>
|
||||
<li><p>[Planning Your Windows Firewall with Advanced Security Design](6622d31d-a62c-4506-8cea-275bf42e755f)</p></li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
**Next:**[Protect Computers from Unwanted Network Traffic](fe94e9b8-c456-4343-af5f-5511b8047d29)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 345 B |
Binary file not shown.
|
After Width: | Height: | Size: 519 B |
Binary file not shown.
|
After Width: | Height: | Size: 615 B |
BIN
windows/keep-secure/images/corpnet.gif
Normal file
BIN
windows/keep-secure/images/corpnet.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 7.0 KiB |
BIN
windows/keep-secure/images/createipsecrule.gif
Normal file
BIN
windows/keep-secure/images/createipsecrule.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 6.9 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 595 B |
BIN
windows/keep-secure/images/powershelllogosmall.gif
Normal file
BIN
windows/keep-secure/images/powershelllogosmall.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.4 KiB |
BIN
windows/keep-secure/images/qmcryptoset.gif
Normal file
BIN
windows/keep-secure/images/qmcryptoset.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 6.1 KiB |
BIN
windows/keep-secure/images/wfas-design2example1.gif
Normal file
BIN
windows/keep-secure/images/wfas-design2example1.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
BIN
windows/keep-secure/images/wfas-design3example1.gif
Normal file
BIN
windows/keep-secure/images/wfas-design3example1.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
BIN
windows/keep-secure/images/wfas-designexample1.gif
Normal file
BIN
windows/keep-secure/images/wfas-designexample1.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
BIN
windows/keep-secure/images/wfas-designflowchart1.gif
Normal file
BIN
windows/keep-secure/images/wfas-designflowchart1.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 17 KiB |
BIN
windows/keep-secure/images/wfas-domainiso.gif
Normal file
BIN
windows/keep-secure/images/wfas-domainiso.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 18 KiB |
BIN
windows/keep-secure/images/wfas-domainisoencrypt.gif
Normal file
BIN
windows/keep-secure/images/wfas-domainisoencrypt.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
BIN
windows/keep-secure/images/wfas-domainisohighsec.gif
Normal file
BIN
windows/keep-secure/images/wfas-domainisohighsec.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 21 KiB |
BIN
windows/keep-secure/images/wfas-domainnag.gif
Normal file
BIN
windows/keep-secure/images/wfas-domainnag.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 18 KiB |
BIN
windows/keep-secure/images/wfas-icon-checkbox.gif
Normal file
BIN
windows/keep-secure/images/wfas-icon-checkbox.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 70 B |
BIN
windows/keep-secure/images/wfas-implement.gif
Normal file
BIN
windows/keep-secure/images/wfas-implement.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
BIN
windows/keep-secure/images/wfasdomainisoboundary.gif
Normal file
BIN
windows/keep-secure/images/wfasdomainisoboundary.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
@ -0,0 +1,49 @@
|
||||
---
|
||||
title: Implementing Your Windows Firewall with Advanced Security Design Plan (Windows 10)
|
||||
description: Implementing Your Windows Firewall with Advanced Security Design Plan
|
||||
ms.assetid: 15f609d5-5e4e-4a71-9eff-493a2e3e40f9
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Implementing Your Windows Firewall with Advanced Security Design Plan
|
||||
|
||||
|
||||
The following are important factors in the implementation of your Windows Firewall with Advanced Security design plan:
|
||||
|
||||
- **Group Policy**. The Windows Firewall with Advanced Security designs make extensive use of Group Policy deployed by Active Directory Domain Services (AD DS). A sound Group Policy infrastructure is required to successfully deploy the firewall and IPsec settings and rules to the computers on your network. [Group Policy Analysis and Troubleshooting Overview](http://technet.microsoft.com/library/jj134223.aspx) (http://technet.microsoft.com/library/jj134223.aspx) can help you review and change, if necessary, your Group Policy infrastructure.
|
||||
|
||||
- **Perimeter firewall**. Most organizations use a perimeter firewall to help protect the computers on the network from potentially malicious network traffic from outside of the organization's network boundaries. If you plan a deployment that includes a boundary zone to enable external computers to connect to computers in that zone, then you must allow that traffic through the perimeter firewall to the computers in the boundary zone.
|
||||
|
||||
- **Computers running operating systems other than Windows**. If your network includes computers that are not running the Windows operating system, then you must make sure that required communication with those computers is not blocked by the restrictions put in place by your design. You must do one of the following:
|
||||
|
||||
- Include those computers in the isolated domain or zone by adding certificate-based authentication to your design. Many other operating systems can participate in an isolated domain or isolated server scenario, as long as certificate-based authentication is used.
|
||||
|
||||
- Include the computer in the authentication exemption list included in your design. You can choose this option if for any reason the computer cannot participate in the isolated domain design.
|
||||
|
||||
## How to implement your Windows Firewall with Advanced Security design using this guide
|
||||
|
||||
|
||||
The next step in implementing your design is to determine in what order each of the deployment steps must be performed. This guide uses checklists to help you accomplish the various deployment tasks that are required to implement your design plan. As the following diagram shows, checklists and subchecklists are used as necessary to provide the end-to-end procedure for deploying a design.
|
||||
|
||||
|
||||
|
||||
Use the following parent checklists in this section of the guide to become familiar with the deployment tasks for implementing your organization's Windows Firewall with Advanced Security design.
|
||||
|
||||
- [Checklist: Implementing a Basic Firewall Policy Design](../p_server_archive/checklist-implementing-a-basic-firewall-policy-design.md)
|
||||
|
||||
- [Checklist: Implementing a Domain Isolation Policy Design](../p_server_archive/checklist-implementing-a-domain-isolation-policy-design.md)
|
||||
|
||||
- [Checklist: Implementing a Domain Isolation Policy Design](../p_server_archive/checklist-implementing-a-domain-isolation-policy-design.md)
|
||||
|
||||
- [Checklist: Implementing a Certificate-based Isolation Policy Design](../p_server_archive/checklist-implementing-a-certificate-based-isolation-policy-design.md)
|
||||
|
||||
The procedures in these checklists use the Group Policy MMC snap-in interfaces to configure firewall and connection security rules in GPOs, but you can also use Windows PowerShell. For more information, see [Windows Firewall with Advanced Security Administration with Windows PowerShell](../p_server_archive/windows-firewall-with-advanced-security-administration-with-windows-powershell.md). This guide recommends using GPOs in a specific way to deploy the rules and settings for your design. For information about deploying your GPOs, see [Planning Group Policy Deployment for Your Isolation Zones](../p_server_archive/planning-group-policy-deployment-for-your-isolation-zones.md) and the checklist [Checklist: Creating Group Policy Objects](../p_server_archive/checklist-creating-group-policy-objects.md).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,77 @@
|
||||
---
|
||||
title: Install Active Directory Certificate Services (Windows 10)
|
||||
description: Install Active Directory Certificate Services
|
||||
ms.assetid: 6f2ed8ac-b8a6-4819-9c21-be91dedfd619
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Install Active Directory Certificate Services
|
||||
|
||||
|
||||
To use certificates in a server isolation or domain isolation design, you must first set up the infrastructure to deploy the certificates. This is called a public key infrastructure (PKI). The services required for a PKI are available in Windows Server 2012 in the form of the Active Directory Certificate Services (AD CS) role.
|
||||
|
||||
**Caution**
|
||||
Creation of a full PKI for an enterprise environment with all of the appropriate security considerations included in the design is beyond the scope of this guide. The following procedure shows you only the basics of installing an issuing certificate server; it is appropriate for a test lab environment only. For more information about deploying AD CS in a production environment, see [Active Directory Certificate Services Overview](e37b2335-0796-449f-aaf4-0520e508f47d) in the Windows Server 2012 Technical Library (http://technet.microsoft.com/library/hh831740.aspx).
|
||||
|
||||
|
||||
|
||||
To perform this procedure, the computer on which you are installing AD CS must be joined to an Active Directory domain.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete this procedure, you must be a member of both the Domain Admins group in the root domain of your forest, and a member of the Enterprise Admins group.
|
||||
|
||||
**To install AD CS**
|
||||
|
||||
1. Log on as a member of both the Enterprise Admins group and the root domain's Domain Admins group.
|
||||
|
||||
2. Click **Server Manager** in the taskbar. The Server Manager console opens. Click **Add roles and features**.
|
||||
|
||||
3. On the **Before you begin** page, click **Next**.
|
||||
|
||||
4. On the **Select installation type** page, ensure **Role-based or feature-based installation** is selected and click **Next**.
|
||||
|
||||
5. On the **Select destination server** page, ensure your server is selected and click **Next**.
|
||||
|
||||
6. On the **Select Server Roles** page, select **Active Directory Certificate Services**, and then click **Add Features** and then click **Next**.
|
||||
|
||||
7. On the **Select features** page, click **Next**.
|
||||
|
||||
8. On the **Active Directory Certificate Services** page, click **Next**.
|
||||
|
||||
9. On the **Select role services** page, ensure **Certification Authority** is selected and click **Next**.
|
||||
|
||||
10. On the **Confirm installation selections** page, click **Install**.
|
||||
|
||||
After installation completes, click close.
|
||||
|
||||
11. On the Server Manager Dashboard, click the Notifications flag icon and then click **Configure Active Directory Certificate Services on the destination server**.
|
||||
|
||||
12. On the **Credentials** page, ensure the default user account is a member of both the local Administrators group and the Enterprise Admins group and then click **Next**.
|
||||
|
||||
13. On the **Role Services** page, click **Certification Authority**, and click **Next**.
|
||||
|
||||
14. On the **Setup Type** page, ensure **Enterprise CA** is selected, and click **Next**.
|
||||
|
||||
15. On the **CA Type** page, ensure **Root CA** is selected, and then click **Next**.
|
||||
|
||||
16. On the **Private Key** page, ensure **Create a new private key** is selected, and then click **Next**.
|
||||
|
||||
17. On the **Cryptography for CA** page, keep the default settings for CSP (**RSA\#Microsoft Software Key Storage Provider**) and hash algorithm (**sha1**), and determine the best key character length for your deployment. Large key character lengths provide optimal security, but they can affect server performance. It is recommended that you keep the default setting of 2048 or, if appropriate for your deployment, reduce key character length to 1024. Click **Next**.
|
||||
|
||||
18. On the **CA Name** page, keep the suggested common name for the CA or change the name according to your requirements, and then click **Next**.
|
||||
|
||||
19. On the **Validity Period** page, in **Specify the validity period**, type the number and select a time value (Years, Months, Weeks, or Days). The default setting of five years is recommended. Click **Next**.
|
||||
|
||||
20. On the **CA Database** page, in **Certificate database location** and **Certificate database log location**, specify the folder location for these items. If you specify locations other than the default locations, make sure that the folders are secured with access control lists (ACLs) that prevent unauthorized users or computers from accessing the CA database and log files.
|
||||
|
||||
21. Click **Next**, click **Configure**, and then click **Close**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
28
windows/keep-secure/isolated-domain-gpos.md
Normal file
28
windows/keep-secure/isolated-domain-gpos.md
Normal file
@ -0,0 +1,28 @@
|
||||
---
|
||||
title: Isolated Domain GPOs (Windows 10)
|
||||
description: Isolated Domain GPOs
|
||||
ms.assetid: e254ce4a-18c6-4868-8179-4078d9de215f
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Isolated Domain GPOs
|
||||
|
||||
|
||||
All of the computers in the isolated domain are added to the group CG\_DOMISO\_IsolatedDomain. You must create multiple GPOs to align with this group, one for each Windows operating system that must have different rules or settings to implement the basic isolated domain functionality that you have in your isolated domain. This group is granted Read and Apply Group Policy permissions on all the GPOs described in this section.
|
||||
|
||||
Each GPO has a security group filter that prevents the GPO from applying to members of the group GP\_DOMISO\_No\_IPsec. A WMI filter is attached to each GPO to ensure that the GPO is applied to only the specified version of Windows. For more information, see the [Planning GPO Deployment](../p_server_archive/planning-gpo-deployment.md) section.
|
||||
|
||||
The GPOs created for the Woodgrove Bank isolated domain include the following:
|
||||
|
||||
- [GPO\_DOMISO\_IsolatedDomain\_Clients](../p_server_archive/gpo-domiso-isolateddomain-clients.md)
|
||||
|
||||
- [GPO\_DOMISO\_IsolatedDomain\_Servers](../p_server_archive/gpo-domiso-isolateddomain-servers.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
67
windows/keep-secure/isolated-domain.md
Normal file
67
windows/keep-secure/isolated-domain.md
Normal file
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Isolated Domain (Windows 10)
|
||||
description: Isolated Domain
|
||||
ms.assetid: d6fa8d67-0078-49f6-9bcc-db1f24816c5e
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Isolated Domain
|
||||
|
||||
|
||||
The isolated domain is the primary zone for trusted computers. The computers in this zone use connection security and firewall rules to control the communications that can be sent between computers in the zone.
|
||||
|
||||
The term *domain* in this context means a boundary of communications trust instead of an Active Directory domain. In this solution the two constructs are very similar because Active Directory domain authentication (Kerberos V5) is required for accepting inbound connections from trusted computers. However, many Active Directory domains (or forests) can be linked with trust relationships to provide a single, logical, isolated domain. In addition, computers that authenticate by using certificates can also be included in an isolated domain without joining the Active Directory domain.
|
||||
|
||||
For most implementations, an isolated domain will contain the largest number of computers. Other isolation zones can be created for the solution if their communication requirements differ from those of the isolated domain. Examples of these differences are what result in the boundary and encryption zones described in this guide. Conceptually, the isolated domain is just the largest isolation zone, and a superset to the other zones.
|
||||
|
||||
You must create a group in Active Directory to contain members of the isolated domain. You then apply one of several GPOs that contain connection security and firewall rules to the group so that authentication on all inbound network connections is enforced. Creation of the group and how to link the GPOs that apply the rules to its members are discussed in the [Planning Group Policy Deployment for Your Isolation Zones](cdbe81c3-6dbf-41c2-b003-3ac4fd4e67dd) section.
|
||||
|
||||
The GPOs for the isolated domain should contain the following connection security rules and settings.
|
||||
|
||||
## GPO settings for isolated domain members running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008
|
||||
|
||||
|
||||
GPOs for computers running Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008 should include the following:
|
||||
|
||||
- IPsec default settings that specify the following options:
|
||||
|
||||
1. Exempt all ICMP traffic from IPsec.
|
||||
|
||||
2. Key exchange (main mode) security methods and algorithm. We recommend that you use at least DH4, AES and SHA2 in your settings. Use the strongest algorithm combinations that are common to all your supported operating systems.
|
||||
|
||||
3. Data protection (quick mode) algorithm combinations. We recommend that you do not include DES, or MD5 in any setting. They are included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems.
|
||||
|
||||
If any NAT devices are present on your networks, use ESP encapsulation. If isolated domain members must communicate with hosts in the encryption zone, ensure that you include algorithms that are compatible with the requirements of the encryption mode policies.
|
||||
|
||||
4. Authentication methods. Include at least computer-based Kerberos V5 authentication. If you want to use user-based access to isolated servers, then also include user-based Kerberos V5 as an optional authentication method. Likewise, if any of your isolated domain members cannot use Kerberos V5 authentication, then include certificate-based authentication as an optional authentication method.
|
||||
|
||||
- The following connection security rules:
|
||||
|
||||
- A connection security rule that exempts all computers on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, where possible, instead of discrete addresses, if applicable in your environment.
|
||||
|
||||
- A connection security rule, from any IP address to any, that requires inbound and requests outbound authentication by using Kerberos V5 authentication.
|
||||
|
||||
**Important**
|
||||
Be sure to begin operations by using request in and request out behavior until you are sure that all the computers in your IPsec environment are communicating successfully by using IPsec. After confirming that IPsec is operating as expected, you can change the policy to require in, request out.
|
||||
|
||||
|
||||
|
||||
- A registry policy that includes the following values:
|
||||
|
||||
- Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](../p_server_archive/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**.
|
||||
|
||||
**Note**
|
||||
For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](../p_server_archive/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md).
|
||||
|
||||
|
||||
|
||||
**Next: **[Boundary Zone](../p_server_archive/boundary-zone.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,343 @@
|
||||
---
|
||||
title: Isolating Windows Store Apps on Your Network (Windows 10)
|
||||
description: Isolating Windows Store Apps on Your Network
|
||||
ms.assetid: fee4cf1b-6dee-4911-a426-f678a70f4c6f
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Isolating Windows Store Apps on Your Network
|
||||
|
||||
|
||||
When you add new computers and devices that are running Windows 8 to your network, you may want to customize your Windows Firewall configuration to isolate the network access of the new Windows Store apps that run on them. Developers who build Windows Store apps can declare certain app capabilities that enable different classes of network access. A developer can decide what kind of network access the app requires and configure this capability for the app. When the app is installed on a computer running Windows 8, appropriate firewall rules are automatically created to enable access. Administrators can then customize the firewall configuration to further fine-tune this access if they desire more control over the network access for the app.
|
||||
|
||||
For example, a developer can decide that their app should only connect to trusted local networks (such as at home or work), and not to the Internet. In this way, developers can define the scope of network access for their app. This network isolation prevents an app from accessing a network and a connection type (inbound or outbound) if the connection has not been configured for the app. Then the network administrator can customize the firewall to further restrict the resources that the app can access.
|
||||
|
||||
The ability to set and enforce these network boundaries ensures that apps that get compromised can only access networks where they have been explicitly granted access. This significantly reduces the scope of their impact on other apps, the computer, and the network. In addition, apps can be isolated and protected from malicious access from the network.
|
||||
|
||||
When creating new Windows Store apps, a developer can define the following network capabilities for their app:
|
||||
|
||||
- **Home\\Work Networking**
|
||||
|
||||
Provides inbound and outbound access to intranet networks that the user has designated as a home or a work network, or if the network has an authenticated domain controller.
|
||||
|
||||
- **Internet (Client)**
|
||||
|
||||
Provides outbound access to the Internet and untrusted networks, such as airports and coffee shops (for example, intranet networks where the user has designated the network as Public). Most apps that require Internet access should use this capability.
|
||||
|
||||
- **Internet (Client and Server)**
|
||||
|
||||
Provides inbound and outbound access to the Internet and untrusted networks, such as airports and coffee shops. This capability is a superset of the **Internet (Client)** capability, and **Internet (Client)** does not need to be enabled if this capability is enabled.
|
||||
|
||||
- **Proximity**
|
||||
|
||||
Provides near-field communication (NFC) with devices that are in close proximity to the computer. Proximity may be used to send files or connect with an application on a proximate device.
|
||||
|
||||
**In this document**
|
||||
|
||||
To isolate Windows Store apps on your network, you need to use Group Policy to define your network isolation settings and create custom Windows Store app firewall rules.
|
||||
|
||||
- [Prerequisites](#bkmk-prereq)
|
||||
|
||||
- [Step 1: Define your network](#bkmk-step1)
|
||||
|
||||
- [Step 2: Create custom firewall rules](#bkmk-step2)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
- A domain controller is installed on your network, and your computers are joined to the Windows domain.
|
||||
|
||||
- Your Windows Store app is installed on your client computer.
|
||||
|
||||
- The Remote Server Administration Tools (RSAT) are installed on your client computer. When you perform the following steps from your client computer, you can select your Windows Store app when you create Windows Firewall rules.
|
||||
|
||||
**Note**
|
||||
You can install the RSAT on your computer running Windows 8 from the [Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkID=238560).
|
||||
|
||||
|
||||
|
||||
## <a href="" id="bkmk-step1"></a>Step 1: Define your network
|
||||
|
||||
|
||||
The **Home\\Work Networking** capability enables access to intranet resources. Administrators can use Group Policy settings to define the scope of the intranet. This ensures that Windows Store apps can access intranet resources appropriately.
|
||||
|
||||
The Windows Store Internet Explorer app that is included with Windows 8 uses the network capabilities to detect which zone it should use. The browser uses the network capabilities to ensure that it operates in the correct security zone.
|
||||
|
||||
A network endpoint is considered part of the **Home\\Work Network** if:
|
||||
|
||||
- It is part of the local subnet of a trusted network.
|
||||
|
||||
For example, home users generally flag their network as Trusted. Local computers will be designated as such.
|
||||
|
||||
- A computer is on a network, and it is authenticated to a domain controller.
|
||||
|
||||
- Endpoints within the intranet address space are considered private.
|
||||
|
||||
- Endpoints within the local subnet are considered private.
|
||||
|
||||
- The computer is configured for DirectAccess, and the endpoint is part of the intranet address space.
|
||||
|
||||
The intranet address space is composed of configured Active Directory sites and subnets, and it is configured for Windows network isolation specifically by using Group Policy. You can disable the usage of Active Directory sites and subnets by using Group Policy by declaring that your subnet definitions are authoritative.
|
||||
|
||||
Any proxies that you configure or that are automatically configured with proxy autoconfiguration (by using Web Proxy Auto-Discovery (WPAD) protocol) are exempt from the intranet zone. You can add proxy addresses by using Group Policy.
|
||||
|
||||
All other endpoints that do not meet the previously stated criteria are considered endpoints on the Internet.
|
||||
|
||||
**To configure a GPO that defines your intranet address space**
|
||||
|
||||
1. Open the Group Policy Management snap-in (gpmc.msc) and edit the Default Domain Policy.
|
||||
|
||||
2. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Administrative Templates**, expand **Network**, and click **Network Isolation**.
|
||||
|
||||
3. In the right pane, double-click **Private network ranges for apps**.
|
||||
|
||||
4. In the **Private network ranges for apps** dialog box, click **Enabled**. In the **Private subnets** text box, type the private subnets for your intranet, separated by commas if necessary.
|
||||
|
||||
For example, if the Contoso intranet is defined as 10.0.0.0 with a subnet mask of 255.255.255.0, you would type 10.0.0.0/24 in the **Private subnets** text box.
|
||||
|
||||
5. Double-click **Subnet definitions are authoritative**.
|
||||
|
||||
If you want the subnet definitions that you previously created to be the single source for your subnet definition, click **Enabled**. Otherwise, leave the **Not Configured** default so that you can add additional subnets by using local settings or network isolation heuristics.
|
||||
|
||||
**To configure the proxy addresses for the intranet and Internet**
|
||||
|
||||
1. Double-click **Internet proxy servers for apps**. Click **Enabled**, and then in the **Domain Proxies** text box, type the IP addresses of your Internet proxy servers, separated by semicolons.
|
||||
|
||||
2. Double-click **Intranet proxy servers for apps**. Click **Enabled**, and then in the IP address text box, type the IP addresses of your intranet proxy servers, separated by semicolons.
|
||||
|
||||
3. Double-click **Proxy definitions are authoritative**.
|
||||
|
||||
If you want the proxy definitions that you previously created to be the single source for your proxy definition, click **Enabled**. Otherwise, leave the **Not Configured** default so that you can add additional proxies by using local settings or network isolation heuristics.
|
||||
|
||||
## <a href="" id="bkmk-step2"></a>Step 2: Create custom firewall rules
|
||||
|
||||
|
||||
Windows Store apps can declare many capabilities in addition to the network capabilities discussed previously. For example, apps can declare capabilities to access user identity, the local file system, and certain hardware devices.
|
||||
|
||||
The following table provides a complete list of the possible app capabilities.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Capability</th>
|
||||
<th>Name</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Internet (Client)</strong></p></td>
|
||||
<td><p>internetClient</p></td>
|
||||
<td><p>Your outgoing Internet connection.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Internet (Client & Server)</strong></p></td>
|
||||
<td><p>internetClientServer</p></td>
|
||||
<td><p>Your Internet connection, including incoming unsolicited connections from the Internet The app can send information to or from your computer through a firewall. You do not need to declare <strong>internetClient</strong> if this capability is declared.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Home\Work Networking</strong></p></td>
|
||||
<td><p>privateNetworkClientServer</p></td>
|
||||
<td><p>A home or work network. The app can send information to or from your computer and other computers on the same network.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Document Library Access</strong></p></td>
|
||||
<td><p>documentsLibrary</p></td>
|
||||
<td><p>Your Documents library, including the capability to add, change, or delete files. The package can only access file types that are declared in the manifest. The app cannot access document libraries on HomeGroup computers.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Picture Library Access</strong></p></td>
|
||||
<td><p>picturesLibrary</p></td>
|
||||
<td><p>Your Pictures library, including the capability to add, change, or delete files. This capability also includes Picture libraries on HomeGroup computers and picture file types on locally connected media servers.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Video Library Access</strong></p></td>
|
||||
<td><p>videosLibrary</p></td>
|
||||
<td><p>Your Videos library, including the capability to add, change, or delete files. This capability also includes Video libraries on HomeGroup computers and video file types on locally connected media servers.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Music Library Access</strong></p></td>
|
||||
<td><p>musicLibrary</p></td>
|
||||
<td><p>Your Music library, including the capability to add, change, or delete files. This capability also includes Music libraries on HomeGroup computers and music file types on locally connected media servers.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Default Windows Credentials</strong></p></td>
|
||||
<td><p>defaultWindowsCredentials</p></td>
|
||||
<td><p>Your Windows credentials for access to a corporate intranet. This application can impersonate you on the network.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Removable Storage</strong></p></td>
|
||||
<td><p>removableStorage</p></td>
|
||||
<td><p>A removable storage device, such as an external hard disk, USB flash drive, or MTP portable device, including the capability to add, change, or delete specific files. This package can only access file types that are declared in the manifest.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Shared User Certificates</strong></p></td>
|
||||
<td><p>sharedUserCertificates</p></td>
|
||||
<td><p>Software and hardware certificates or a smart card, which the app uses to identify you. This capability can be used by an employer, a bank, or government services to identify you.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Location</strong></p></td>
|
||||
<td><p>location</p></td>
|
||||
<td><p>Provides access to the user's current location.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Microphone</strong></p></td>
|
||||
<td><p>microphone</p></td>
|
||||
<td><p>Provides access to the microphone's audio feed.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Near-field Proximity</strong></p></td>
|
||||
<td><p>proximity</p></td>
|
||||
<td><p>Required for near-field communication (NFC) between devices in close proximity. NFC can be used to send files or connect with an app on a proximate device.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Text Messaging</strong></p></td>
|
||||
<td><p>sms</p></td>
|
||||
<td><p>Provides access to computer text messaging functionality.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Webcam</strong></p></td>
|
||||
<td><p>webcam</p></td>
|
||||
<td><p>Provides access to the webcam's video feed.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Other devices (represented by GUIDs)</strong></p></td>
|
||||
<td><p><GUID></p></td>
|
||||
<td><p>Includes specialized devices and Windows Portable Devices.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
In Windows Server 2012, it is possible to create a Windows Firewall policy that is scoped to a set of apps that use a specified capability or scoped to a specific Windows Store app.
|
||||
|
||||
For example, you could create a Windows Firewall policy to block Internet access for any apps on your network that have the Documents Library capability.
|
||||
|
||||
**To block Internet access for any apps on your network that have the Documents Library capability**
|
||||
|
||||
1. Open the Group Policy Management snap-in (gpmc.msc).
|
||||
|
||||
2. In the left pane, right-click your domain name and click **Create a GPO in this domain, and link it here**.
|
||||
|
||||
3. Type a name for the GPO in the **Name** text box, and then click **OK**.
|
||||
|
||||
4. Right-click the new GPO, and then click **Edit**.
|
||||
|
||||
5. In the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Firewall with Advanced Security**, and click **Windows Firewall with Advanced Security – LDAP://…**
|
||||
|
||||
6. Right-click **Outbound Rules**, and then click **New Rule**.
|
||||
|
||||
7. Click **Custom**, and then click **Next**.
|
||||
|
||||
8. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page.
|
||||
|
||||
9. On the **Action** page, ensure that **Block the Connection** is selected, and then click **Next**.
|
||||
|
||||
10. On the **Profile** page, click **Next**.
|
||||
|
||||
11. On the **Name** page, type a name for your rule, and then click **Finish**.
|
||||
|
||||
12. In the right pane, right-click your new rule and click **Properties**.
|
||||
|
||||
13. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**.
|
||||
|
||||
14. Click **Application Package Properties**, and then click **OK**.
|
||||
|
||||
15. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\Your documents library**, and then click **OK**.
|
||||
|
||||
16. Click the **Scope** tab under **Remote IP addresses**, and then click **Add**.
|
||||
|
||||
17. Click **Predefined set of computers**, select **Internet**, and click **OK**.
|
||||
|
||||
This scopes the rule to block traffic to Internet computers.
|
||||
|
||||
18. Click the **Programs and Services** tab, and in the **Application Packages** area, click **Settings**.
|
||||
|
||||
19. Click **Apply to application packages only**, and then click **OK**.
|
||||
|
||||
**Important**
|
||||
You must do this to ensure that the rule applies only to Windows Store apps and not to other applications and programs. Non-Windows Store applications and programs declare all capabilities by default, and this rule would apply to them if you do not configure it this way.
|
||||
|
||||
|
||||
|
||||
20. Click **OK** to close the **Properties** dialog box.
|
||||
|
||||
21. Close the Group Policy Management Editor.
|
||||
|
||||
22. In the Group Policy Management snap-in, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**. Click **Remove**, and then click **OK**.
|
||||
|
||||
23. Under **Security Filtering**, click **Add**.
|
||||
|
||||
24. Type **domain computers** in the text box, and then click **OK**.
|
||||
|
||||
25. Close the Group Policy Management snap-in.
|
||||
|
||||
Use the following procedure if you want to block intranet access for a specific media sharing app on your network.
|
||||
|
||||
**To block intranet access for a specific media sharing app on your network**
|
||||
|
||||
1. Open the Group Policy Management snap-in (gpmc.msc).
|
||||
|
||||
2. In the left pane, right-click your domain name, and then click **Create a GPO in this domain, and link it here**.
|
||||
|
||||
3. Type a name for your GPO in the **Name** text box, and then click **OK**.
|
||||
|
||||
4. Right-click your new GPO, and then click **Edit**.
|
||||
|
||||
5. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Firewall with Advanced Security**, and then click **Windows Firewall with Advanced Security – LDAP://**…
|
||||
|
||||
6. Right-click **Outbound Rules**, and then click **New Rule**.
|
||||
|
||||
7. Click **Custom**, and then click **Next**.
|
||||
|
||||
8. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page.
|
||||
|
||||
9. On the **Action** page, ensure **Block the Connection** is selected, and then click **Next**.
|
||||
|
||||
10. On the **Profile** page, click **Next**.
|
||||
|
||||
11. On the **Name** page, type a name for your rule, and then click **Finish**.
|
||||
|
||||
12. In the right pane, right-click your new rule, and then click **Properties**.
|
||||
|
||||
13. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**.
|
||||
|
||||
14. Click **Application Package Properties**, and then click **OK**.
|
||||
|
||||
15. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\A home or work network**, and then click **OK**.
|
||||
|
||||
16. Click the **Programs and Services** tab under **Application Packages**, and then click **Settings**.
|
||||
|
||||
17. Click **Apply to this application package**, select the app in the text box, and then click **OK**.
|
||||
|
||||
18. Click **OK** to close the **Properties** dialog box.
|
||||
|
||||
19. Close the Group Policy Management Editor.
|
||||
|
||||
20. In Group Policy Management, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**, click **Remove**, and then click **OK**.
|
||||
|
||||
21. Under **Security Filtering**, click **Add**.
|
||||
|
||||
22. Type **domain computers** in the text box and click **OK**.
|
||||
|
||||
23. Close Group Policy Management.
|
||||
|
||||
## <a href="" id="bkmk-links"></a>See also
|
||||
|
||||
|
||||
- [Windows Firewall with Advanced Security Overview](../p_server_archive/windows-firewall-with-advanced-security-overview-win8.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
40
windows/keep-secure/link-the-gpo-to-the-domain.md
Normal file
40
windows/keep-secure/link-the-gpo-to-the-domain.md
Normal file
@ -0,0 +1,40 @@
|
||||
---
|
||||
title: Link the GPO to the Domain (Windows 10)
|
||||
description: Link the GPO to the Domain
|
||||
ms.assetid: 746d4553-b1a6-4954-9770-a948926b1165
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Link the GPO to the Domain
|
||||
|
||||
|
||||
After you create the GPO and configure it with security group filters and WMI filters, you must link the GPO to the container in Active Directory that contains all of the target computers.
|
||||
|
||||
If the filters comprehensively control the application of the GPO to only the correct computers, then you can link the GPO to the domain container. Alternatively, you can link the GPO to a site container or organizational unit if you want to limit application of the GPO to that subset of computers.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete this procedure, you must be a member of the Domain Admins group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
**To link the GPO to the domain container in Active Directory**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click the **Start** charm, and then click the **Group Policy Management** tile.
|
||||
|
||||
2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, and then expand *YourDomainName*.
|
||||
|
||||
3. Right-click *YourDomainName*, and then click **Link an Existing GPO**.
|
||||
|
||||
4. In the **Select GPO** dialog box, select the GPO that you want to deploy, and then click **OK**.
|
||||
|
||||
5. The GPO appears in the **Linked Group Policy Objects** tab in the details pane and as a linked item under the domain container in the navigation pane.
|
||||
|
||||
6. You can adjust the order of the linked GPOs to ensure that the higher priority GPOs are processed last. Select a GPO and click the up or down arrows to move it. The GPOs are processed by the client computer from the highest link order number to the lowest.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,82 @@
|
||||
---
|
||||
title: Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design (Windows 10)
|
||||
description: Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design
|
||||
ms.assetid: 7e68c59e-ba40-49c4-8e47-5de5d6b5eb22
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design
|
||||
|
||||
|
||||
After you finish reviewing the existing Windows Firewall with Advanced Security deployment goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design.
|
||||
|
||||
**Important**
|
||||
The first three designs presented in this guide build on each other to progress from simpler to more complex. Therefore during deployment, consider implementing them in the order presented. Each deployed design also provides a stable position from which to evaluate your progress, and to make sure that your goals are being met before you continue to the next design.
|
||||
|
||||
|
||||
|
||||
Use the following table to determine which Windows Firewall with Advanced Security design maps to the appropriate combination of Windows Firewall with Advanced Security deployment goals for your organization. This table refers only to the Windows Firewall with Advanced Security designs as described in this guide. However, you can create a hybrid or custom Windows Firewall with Advanced Security design by using any combination of the Windows Firewall with Advanced Security deployment goals to meet the needs of your organization.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Deployment Goals</th>
|
||||
<th>[Basic Firewall Policy Design](../p_server_archive/basic-firewall-policy-design.md)</th>
|
||||
<th>[Domain Isolation Policy Design](../p_server_archive/domain-isolation-policy-design.md)</th>
|
||||
<th>[Server Isolation Policy Design](../p_server_archive/server-isolation-policy-design.md)</th>
|
||||
<th>[Certificate-based Isolation Policy Design](../p_server_archive/certificate-based-isolation-policy-design.md)</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>[Protect Computers from Unwanted Network Traffic](../p_server_archive/protect-computers-from-unwanted-network-traffic.md)</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>[Restrict Access to Only Trusted Computers](../p_server_archive/restrict-access-to-only-trusted-computers.md)</p></td>
|
||||
<td><p>-</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>[Restrict Access to Only Specified Users or Computers](../p_server_archive/restrict-access-to-only-specified-users-or-computers.md)</p></td>
|
||||
<td><p>-</p></td>
|
||||
<td><p>-</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>[Require Encryption When Accessing Sensitive Network Resources](../p_server_archive/require-encryption-when-accessing-sensitive-network-resources.md)</p></td>
|
||||
<td><p>-</p></td>
|
||||
<td><p>Optional</p></td>
|
||||
<td><p>Optional</p></td>
|
||||
<td><p>Optional</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
To examine details for a specific design, click the design title at the top of the column in the preceding table.
|
||||
|
||||
**Next: **[Basic Firewall Policy Design](../p_server_archive/basic-firewall-policy-design.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,91 @@
|
||||
---
|
||||
title: Modify GPO Filters to Apply to a Different Zone or Version of Windows (Windows 10)
|
||||
description: Modify GPO Filters to Apply to a Different Zone or Version of Windows
|
||||
ms.assetid: 24ede9ca-a501-4025-9020-1129e2cdde80
|
||||
author: brianlic-msft
|
||||
---
|
||||
|
||||
# Modify GPO Filters to Apply to a Different Zone or Version of Windows
|
||||
|
||||
|
||||
You must reconfigure your copied GPO so that it contains the correct security group and WMI filters for its new role. If you are creating the GPO for the isolated domain, use the [Block members of a group from applying a GPO](#bkmk-topreventmembersofgroupfromapplyingagpo) procedure to prevent members of the boundary and encryption zones from incorrectly applying the GPOs for the main isolated domain.
|
||||
|
||||
**Administrative credentials**
|
||||
|
||||
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
|
||||
|
||||
In this topic:
|
||||
|
||||
- [Change the security group filter for a GPO](#bkmk-toallowmembersofagrouptoapplyagpo)
|
||||
|
||||
- [Block members of a group from applying a GPO](#bkmk-topreventmembersofgroupfromapplyingagpo)
|
||||
|
||||
- [Remove a block for members of a group from applying a GPO](#bkmk-toremoveablockformembersofgroupfromapplyingagpo)
|
||||
|
||||
## <a href="" id="bkmk-toallowmembersofagrouptoapplyagpo"></a>
|
||||
|
||||
|
||||
Use the following procedure to change a group to the security filter on the GPO that allows group members to apply the GPO. You must remove the reference to the original group, and add the group appropriate for this GPO.
|
||||
|
||||
**To change the security group filter for a GPO**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click the **Start** charm, and then click the **Group Policy Management** tile.
|
||||
|
||||
2. In the navigation pane, find and then click the GPO that you want to modify.
|
||||
|
||||
3. In the details pane, under **Security Filtering**, click the currently assigned security group, and then click **Remove**.
|
||||
|
||||
4. Now you can add the appropriate security group to this GPO. Under **Security Filtering**, click **Add**.
|
||||
|
||||
5. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to apply the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain.
|
||||
|
||||
## <a href="" id="bkmk-topreventmembersofgroupfromapplyingagpo"></a>
|
||||
|
||||
|
||||
Use the following procedure if you need to add a group to the security filter on the GPO that blocks group members from applying the GPO. This can be used on the GPOs for the main isolated domain to prevent members of the boundary and encryption zones from incorrectly applying the GPOs for the main isolated domain.
|
||||
|
||||
**To block members of group from applying a GPO**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click the **Start** charm, and then click the **Group Policy Management** tile.
|
||||
|
||||
2. In the navigation pane, find and then click the GPO that you want to modify.
|
||||
|
||||
3. In the details pane, click the **Delegation** tab.
|
||||
|
||||
4. Click **Advanced**.
|
||||
|
||||
5. Under the **Group or user names** list, click **Add**.
|
||||
|
||||
6. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain.
|
||||
|
||||
7. Select the group in the **Group or user names** list, and then select the boxes in the **Deny** column for both **Read** and **Apply group policy**.
|
||||
|
||||
8. Click **OK**, and then in the **Windows Security** dialog box, click **Yes**.
|
||||
|
||||
9. The group appears in the list with custom permissions.
|
||||
|
||||
## <a href="" id="bkmk-toremoveablockformembersofgroupfromapplyingagpo"></a>
|
||||
|
||||
|
||||
**To remove a block for members of group from applying a GPO**
|
||||
|
||||
1. On a computer that has the Group Policy Management feature installed, click the **Start** charm, and then click the **Group Policy Management** tile.
|
||||
|
||||
2. In the navigation pane, find and then click the GPO that you want to modify.
|
||||
|
||||
3. In the details pane, click the **Delegation** tab.
|
||||
|
||||
4. In the **Groups and users** list, select the group that should no longer be blocked, and then click **Remove**.
|
||||
|
||||
5. In the message box, click **OK**.
|
||||
|
||||
If you arrived at this page by clicking a link in a checklist, use your browser’s **Back** button to return to the checklist.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user