Using NPS to restrict access to WLAN The Next CEO of Stack OverflowConfiguring Cisco Switch and ASA/VPN devices to authenticate with W2008R2 NPS RADIUSWhy would NPS suddenly stop authenticating users?Migrated NPS won't serve a RADIUS clientHow do I use a domain account to connect to a MSSQL server for NPS accounting?NPS server Active Directory registration & WIFI RADIUSNPS/RADIUS authentication across one-way trustNetwork Policy not evaluated for forwarded authenticationsWLAN profile GPO settings and saved user credentialsHow do I configure NPS to allow connections from domain-joined computers only?Use CHAP with NPS and a Domain Controller in Core
Is it ok to trim down a tube patch?
Is it okay to majorly distort historical facts while writing a fiction story?
Where do students learn to solve polynomial equations these days?
A question about free fall, velocity, and the height of an object.
Expressing the idea of having a very busy time
TikZ: How to fill area with a special pattern?
Aggressive Under-Indexing and no data for missing index
Lucky Feat: How can "more than one creature spend a luck point to influence the outcome of a roll"?
Do I need to write [sic] when including a quotation with a number less than 10 that isn't written out?
Is French Guiana a (hard) EU border?
What happened in Rome, when the western empire "fell"?
From jafe to El-Guest
Man transported from Alternate World into ours by a Neutrino Detector
Is it professional to write unrelated content in an almost-empty email?
Is there a reasonable and studied concept of reduction between regular languages?
How do I fit a non linear curve?
Purpose of level-shifter with same in and out voltages
Help/tips for a first time writer?
Is it ever safe to open a suspicious HTML file (e.g. email attachment)?
Graph of the history of databases
Can this note be analyzed as a non-chord tone?
Yu-Gi-Oh cards in Python 3
Is a distribution that is normal, but highly skewed, considered Gaussian?
Can I calculate next year's exemptions based on this year's refund/amount owed?
Using NPS to restrict access to WLAN
The Next CEO of Stack OverflowConfiguring Cisco Switch and ASA/VPN devices to authenticate with W2008R2 NPS RADIUSWhy would NPS suddenly stop authenticating users?Migrated NPS won't serve a RADIUS clientHow do I use a domain account to connect to a MSSQL server for NPS accounting?NPS server Active Directory registration & WIFI RADIUSNPS/RADIUS authentication across one-way trustNetwork Policy not evaluated for forwarded authenticationsWLAN profile GPO settings and saved user credentialsHow do I configure NPS to allow connections from domain-joined computers only?Use CHAP with NPS and a Domain Controller in Core
We currently have one WLAN that only domain users can connect to. We will be adding a guest WLAN and would like all non-domain machines to use this, even if a user has a domain account.
We have set up NPS and can log in against it, but we can not restrict the connection option to be a domain computer AND a domain account. As a network policy it states that it moves along through each policy until it finds one that it accepts or runs out.
For connection request policies Domain Computers is not an option. This is where I thought I may be able to stop it.
Has anyone been able to successfully restrict this without manually adding MACs to the WLAN Controller?
windows-server-2008-r2 radius wlan nps
asked Dec 17 '12 at 22:56
eric.seric.s
2941211
bumped to the homepage by Community♦ yesterday
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
We currently have one WLAN that only domain users can connect to. We will be adding a guest WLAN and would like all non-domain machines to use this, even if a user has a domain account.
We have set up NPS and can log in against it, but we can not restrict the connection option to be a domain computer AND a domain account. As a network policy it states that it moves along through each policy until it finds one that it accepts or runs out.
For connection request policies Domain Computers is not an option. This is where I thought I may be able to stop it.
Has anyone been able to successfully restrict this without manually adding MACs to the WLAN Controller?
windows-server-2008-r2 radius wlan nps
asked Dec 17 '12 at 22:56
eric.seric.s
2941211
bumped to the homepage by Community♦ yesterday
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
We currently have one WLAN that only domain users can connect to. We will be adding a guest WLAN and would like all non-domain machines to use this, even if a user has a domain account.
We have set up NPS and can log in against it, but we can not restrict the connection option to be a domain computer AND a domain account. As a network policy it states that it moves along through each policy until it finds one that it accepts or runs out.
For connection request policies Domain Computers is not an option. This is where I thought I may be able to stop it.
Has anyone been able to successfully restrict this without manually adding MACs to the WLAN Controller?
windows-server-2008-r2 radius wlan nps
asked Dec 17 '12 at 22:56
eric.seric.s
2941211
We currently have one WLAN that only domain users can connect to. We will be adding a guest WLAN and would like all non-domain machines to use this, even if a user has a domain account.
We have set up NPS and can log in against it, but we can not restrict the connection option to be a domain computer AND a domain account. As a network policy it states that it moves along through each policy until it finds one that it accepts or runs out.
For connection request policies Domain Computers is not an option. This is where I thought I may be able to stop it.
Has anyone been able to successfully restrict this without manually adding MACs to the WLAN Controller?
windows-server-2008-r2 radius wlan nps
windows-server-2008-r2 radius wlan nps
asked Dec 17 '12 at 22:56
eric.seric.s
2941211
asked Dec 17 '12 at 22:56
eric.seric.s
2941211
asked Dec 17 '12 at 22:56
eric.seric.s
2941211
asked Dec 17 '12 at 22:56
eric.seric.s
2941211
asked Dec 17 '12 at 22:56
eric.seric.s
2941211
2941211
bumped to the homepage by Community♦ yesterday
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ yesterday
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Create a policy where you deny access to all the computers you want. You won't need MAC for this.
answered Dec 18 '12 at 21:36
Letícia RosaLetícia Rosa
1
Any deny rule created denies to all, or still allows all. My logs are showing that no matter what, it's looking for user credentials and accepting/denying based on that. We want that to be secondary after connecting with a domain computer.
– eric.s
Dec 19 '12 at 15:17
Tried to put then in another ou or group?
– Letícia Rosa
Dec 19 '12 at 16:41
Yes. Again, it's only checking users and we need it to check machines, then users.
– eric.s
Dec 19 '12 at 16:44
Try creating a policy that search for machine groups.
– Letícia Rosa
Dec 19 '12 at 16:57
add a comment |
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f458868%2fusing-nps-to-restrict-access-to-wlan%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Create a policy where you deny access to all the computers you want. You won't need MAC for this.
answered Dec 18 '12 at 21:36
Letícia RosaLetícia Rosa
1
Any deny rule created denies to all, or still allows all. My logs are showing that no matter what, it's looking for user credentials and accepting/denying based on that. We want that to be secondary after connecting with a domain computer.
– eric.s
Dec 19 '12 at 15:17
Tried to put then in another ou or group?
– Letícia Rosa
Dec 19 '12 at 16:41
Yes. Again, it's only checking users and we need it to check machines, then users.
– eric.s
Dec 19 '12 at 16:44
Try creating a policy that search for machine groups.
– Letícia Rosa
Dec 19 '12 at 16:57
add a comment |
Create a policy where you deny access to all the computers you want. You won't need MAC for this.
answered Dec 18 '12 at 21:36
Letícia RosaLetícia Rosa
1
Any deny rule created denies to all, or still allows all. My logs are showing that no matter what, it's looking for user credentials and accepting/denying based on that. We want that to be secondary after connecting with a domain computer.
– eric.s
Dec 19 '12 at 15:17
Tried to put then in another ou or group?
– Letícia Rosa
Dec 19 '12 at 16:41
Yes. Again, it's only checking users and we need it to check machines, then users.
– eric.s
Dec 19 '12 at 16:44
Try creating a policy that search for machine groups.
– Letícia Rosa
Dec 19 '12 at 16:57
add a comment |
Create a policy where you deny access to all the computers you want. You won't need MAC for this.
answered Dec 18 '12 at 21:36
Letícia RosaLetícia Rosa
1
Create a policy where you deny access to all the computers you want. You won't need MAC for this.
answered Dec 18 '12 at 21:36
Letícia RosaLetícia Rosa
1
answered Dec 18 '12 at 21:36
Letícia RosaLetícia Rosa
1
answered Dec 18 '12 at 21:36
Letícia RosaLetícia Rosa
1
answered Dec 18 '12 at 21:36
Letícia RosaLetícia Rosa
1
1
Any deny rule created denies to all, or still allows all. My logs are showing that no matter what, it's looking for user credentials and accepting/denying based on that. We want that to be secondary after connecting with a domain computer.
– eric.s
Dec 19 '12 at 15:17
Tried to put then in another ou or group?
– Letícia Rosa
Dec 19 '12 at 16:41
Yes. Again, it's only checking users and we need it to check machines, then users.
– eric.s
Dec 19 '12 at 16:44
Try creating a policy that search for machine groups.
– Letícia Rosa
Dec 19 '12 at 16:57
add a comment |
Any deny rule created denies to all, or still allows all. My logs are showing that no matter what, it's looking for user credentials and accepting/denying based on that. We want that to be secondary after connecting with a domain computer.
– eric.s
Dec 19 '12 at 15:17
Tried to put then in another ou or group?
– Letícia Rosa
Dec 19 '12 at 16:41
Yes. Again, it's only checking users and we need it to check machines, then users.
– eric.s
Dec 19 '12 at 16:44
Try creating a policy that search for machine groups.
– Letícia Rosa
Dec 19 '12 at 16:57
Any deny rule created denies to all, or still allows all. My logs are showing that no matter what, it's looking for user credentials and accepting/denying based on that. We want that to be secondary after connecting with a domain computer.
– eric.s
Dec 19 '12 at 15:17
Any deny rule created denies to all, or still allows all. My logs are showing that no matter what, it's looking for user credentials and accepting/denying based on that. We want that to be secondary after connecting with a domain computer.
– eric.s
Dec 19 '12 at 15:17
Tried to put then in another ou or group?
– Letícia Rosa
Dec 19 '12 at 16:41
Tried to put then in another ou or group?
– Letícia Rosa
Dec 19 '12 at 16:41
Yes. Again, it's only checking users and we need it to check machines, then users.
– eric.s
Dec 19 '12 at 16:44
Yes. Again, it's only checking users and we need it to check machines, then users.
– eric.s
Dec 19 '12 at 16:44
Try creating a policy that search for machine groups.
– Letícia Rosa
Dec 19 '12 at 16:57
Try creating a policy that search for machine groups.
– Letícia Rosa
Dec 19 '12 at 16:57
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f458868%2fusing-nps-to-restrict-access-to-wlan%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
