Resources For IT Professionals

United Kingdom (Proper English-like)

Skip to locale bar

•  

Test Lab Guide: Demonstrate NAP for Remote Access VPN - TechNet Articles - United States (English) - TechNet Wiki

Step 1: Base Configuration test lab

Set up the base configuration test lab with the instructions found in Base Configuration TLG.

Step 2: Remote Access VPN test lab

Set up the remote access VPN test lab with the instructions found in Test Lab Guide: Demonstrate Remote Access VPNs.

Step 3: Set up DC1 as the NAP Health Policy Server

1. On DC1, in Server Manager, under Roles Summary, click Add Roles, and then click Next.
2. On the Select Server Roles page, select the Network Policy and Access Services check box, and then click Next twice.
3. On the Select Role Services page, select Network Policy Server, and then click Next.
4. On the Confirm Installation Selections page, click Install.
5. Verify that all installations were successful, and then click Close.
6. Click Start, type nps.msc, and then press ENTER.
7. In the details pane, under Standard Configuration, click Configure NAP.
8. On the Select Network Connection Method for Use with NAP page, under Network connection method, select Virtual private network (VPN), and then click Next.
9. On the Specify NAP Enforcement Servers Running VPN Server page, click Add.
10. In Friendly name, type EDGE1, in Address, type 10.0.0.2, in Shared secret, type secret in Shared secret and Confirm shared secret, click OK, and then click Next.
11. On the Configure User Groups and Machine Groups page, click Next. You do not need to configure groups for this test lab.
12. On the Configure an Authentication Method page, click Next.
13. On the Specify a NAP Remediation Server Group URL page, click New Group.
14. In Group Name, type DCs, and then click Add.
15. In Friendly name, type DC1, in IP address or DNS, type 10.0.0.1. Click Resolve, click OK twice, and then click Next.
16. On the Define NAP Health Policy page, verify that Windows Security Health Validator and Enable auto-remediation of client computers check boxes are selected, and then click Next.
17. On the Completing NAP Enforcement Policy and RADIUS Client Configuration page, click Finish.
18. In the Network Policy Server console tree, open Network Access Protection, type DC1, in IP address or DNS, type 10.0.0.1. Click Resolve, click OK twice, and then click Next.
19. On the Define NAP Health Policy page, verify that Windows Security Health Validator and Enable auto-remediation of client computers check boxes are selected, and then click Next.
20. System Health Validators\Windows Security Health Validator, and then click Settings.
21. In the details pane, double-click Default Configuration.
22. In the Windows Security Health Validator window, for the Windows 7/Windows Vista tab, clear all check boxes except A firewall is enabled for all network connections, and then click OK.
23. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
24. In the Active Directory Users and Computers console tree, right-click Contoso.com, point to New, and then click Group.
25. In the New Object - Group dialog box, under Group name, type NAP client computers.
26. Under Group scope, choose Global, under Group type, choose Security, and then click OK.
27. In the list, double-click the NAP client computers group.
28. Click the Members tab, click Add, click Object Types, select Computers, click OK, type CLIENT1, and then click OK twice.
29. Click Start, type gpme.msc, and then press ENTER.
30. Click the icon to create a new GPO, then type NAP client settings for the name of the new GPO.
31. Right-click NAP client settings, and then click Edit.
32. In the console tree of Group Policy Management Editor, open Computer Configuration\Policies\Windows Settings\Security Settings, and then click System Services.
33. In the details pane, double-click Network Access Protection Agent.
34. In the Network Access Protection Agent Properties dialog box, select Define this policy setting, click Automatic, and then click OK.
35. In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Network Access Protection\NAP Client Configuration, and then click Enforcement Clients.
36. In the details pane, right-click EAP Quarantine Enforcement Client, and then click Enable.
37. In the console tree, open Computer Configuration\Policies\Administrative Templates\Windows Components, and then click Security Center.
38. In the details pane, double-click Turn on Security Center (Domain PCs only), click Enabled, and then click OK. This enables the Windows Action Center on NAP client computers.
39. Click Start, type gpmc.msc, and then press ENTER.
40. In the tree, click NAP client settings.
41. In the details pane, under Security Filtering, click Authenticated Users, and then click Remove.
42. When you are prompted to confirm the removal of delegation privilege, click OK.
43. In the details pane, under Security Filtering, click Add.
44. In the Select User, Computer, or Group dialog box, under Enter the object name to select (examples), type NAP client computers, and then click OK.