How will corporate permissions affect my Vista Ultimate at home?

[Mike Hall]

I have VPN access so I can connect with our corporate network from home.
Problem is that there is no ability to connect my computer to a domain in
Windows Vista Home Premium (or XP Home Edition). I am thinking of upgrading
to Vista Ultimate, but they have tightened many permissions at work to block
us from installing any software or getting into 'system' areas, and I was
wondering what effect that would have on MY computer if I did log onto the
corporate server from home? Would my computer at home then inherit all the
restrictions that are in place on my desktop computer at work? I wouldn't
want that, and would really make me mad if I spent the $$ for an upgrade &
got locked out of my own PC!
--Mike Hall

 

[Bruce Chambers]

Re: How will corporate permissions affect my Vista Ultimate at home?

Mike Hall wrote:
> I have VPN access so I can connect with our corporate network from home.
> Problem is that there is no ability to connect my computer to a domain in
> Windows Vista Home Premium (or XP Home Edition). I am thinking of upgrading
> to Vista Ultimate, but they have tightened many permissions at work to block
> us from installing any software or getting into 'system' areas, and I was
> wondering what effect that would have on MY computer if I did log onto the
> corporate server from home? Would my computer at home then inherit all the
> restrictions that are in place on my desktop computer at work? I wouldn't
> want that, and would really make me mad if I spent the $$ for an upgrade &
> got locked out of my own PC!
> --Mike Hall


It would depend entirely upon how your employer's network administrator
has configured the domain, its group policies, and their requirements
for accessing the domain via VPN. In theory, your computer could be
pretty thoroughly controlled from the domain. You need to direct this
question to your employer's IT department. No one else can provide a
definitive answer.

While I understand your concerns about control of your personal
computer, no network administrator worth his salary would allow a
privately owned computer to access the network for whose security he's
responsible without placing some pretty heavy safeguards in place and
having nearly total control of that computer. If your employer wants
you to work from home, the company should provide you a computer for
that purpose.


--

Bruce Chambers

Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -Benjamin Franklin

Many people would rather die than think; in fact, most do. -Bertrand Russell

 

[Mike Hall]

Re: How will corporate permissions affect my Vista Ultimate at hom

Re: How will corporate permissions affect my Vista Ultimate at hom

The work-from-home is my idea, and I will get 1 chance to ask IT for some
sort of access, so I want to have my ducks in a row before I ask.
I have had VPN access for years, but since WinXP, I have logged onto our
network via VPN, then used RealVNC to 'remote control' my workstation at the
office which had a VNC server running on it. (Not approved by IT & recently
removed. IT used to use VNC to remote all of our workstations)
My question is, from a security standpoint, which of the following is my
best bet for getting IT to approve me having remote access again:
1) Reinstalling VNC on my workstation & 'remote controlling' it from home
via VPN.
1a) Using PC Anywhere to connect (any advantage here over using VNC?)
2) Logging onto a Terminal Server that is able to access the corp domain via
VPN.
3) Upgrading my home PC to Vista Ultimate & connecting direct to corp domain
via VPN. (I do have a spare PC I could dedicate to work if necessary)
4) Any other ideas that you think would be more secure & likely to be
approved? I realize you can't answer for our IT guys, but if YOU were the IT
guy, what method would you approve?
--Mike Hall

"Bruce Chambers" wrote:

> Mike Hall wrote:
> > I have VPN access so I can connect with our corporate network from home.
> > Problem is that there is no ability to connect my computer to a domain in
> > Windows Vista Home Premium (or XP Home Edition). I am thinking of upgrading
> > to Vista Ultimate, but they have tightened many permissions at work to block
> > us from installing any software or getting into 'system' areas, and I was
> > wondering what effect that would have on MY computer if I did log onto the
> > corporate server from home? Would my computer at home then inherit all the
> > restrictions that are in place on my desktop computer at work? I wouldn't
> > want that, and would really make me mad if I spent the $$ for an upgrade &
> > got locked out of my own PC!
> > --Mike Hall
>
>
> It would depend entirely upon how your employer's network administrator
> has configured the domain, its group policies, and their requirements
> for accessing the domain via VPN. In theory, your computer could be
> pretty thoroughly controlled from the domain. You need to direct this
> question to your employer's IT department. No one else can provide a
> definitive answer.
>
> While I understand your concerns about control of your personal
> computer, no network administrator worth his salary would allow a
> privately owned computer to access the network for whose security he's
> responsible without placing some pretty heavy safeguards in place and
> having nearly total control of that computer. If your employer wants
> you to work from home, the company should provide you a computer for
> that purpose.
>
>
> --
>
> Bruce Chambers
>
> Help us help you:
> http://dts-l.org/goodpost.htm
> http://www.catb.org/~esr/faqs/smart-questions.html
>
> They that can give up essential liberty to obtain a little temporary
> safety deserve neither liberty nor safety. -Benjamin Franklin
>
> Many people would rather die than think; in fact, most do. -Bertrand Russell
>

 

[Adam Leinss]

Re: How will corporate permissions affect my Vista Ultimate at hom

Re: How will corporate permissions affect my Vista Ultimate at hom

=?Utf-8?B?TWlrZSBIYWxs?= <MikeHall@discussions.microsoft.com> wrote in
news:021F3645-AF87-441E-AC78-F1E02B728B28@microsoft.com:

> I realize you can't answer for our IT guys, but if YOU were the IT
> guy, what method would you approve?


If I was your network administrator, I would provide equipment locked
down per company policies and allow you to VPN in with that device. I
would not allow you to VPN directly from your home PC as I have no
control over your PC.

I've seen other implementations: published applications via HTTPS.
Citrix has remote solutions. Perhaps you can be setup to VPN in to a
secured part of the network and then allowed to remote desktop to a
server within that secured network. They could setup the applications
you need to use and then use the remote desktop session as a security
boundary.

Are you unique? Are there any other employees that have VPN access?
How does IT handle them?

Adam
--
Visit my PC Tech blog at www.leinss.com/blog

 

[Mike Hall]

Re: How will corporate permissions affect my Vista Ultimate at hom

Re: How will corporate permissions affect my Vista Ultimate at hom



"Adam Leinss" wrote:
...
> I would not allow you to VPN directly from your home PC as I have no
> control over your PC.
>
> I've seen other implementations: published applications via HTTPS.
> Citrix has remote solutions. Perhaps you can be setup to VPN in to a
> secured part of the network and then allowed to remote desktop to a
> server within that secured network. They could setup the applications
> you need to use and then use the remote desktop session as a security
> boundary.
>
> Are you unique? Are there any other employees that have VPN access?
> How does IT handle them?
>
> Adam
> --
Most management personel (I'd guess a couple dozen) have VPN access at my
company. Now that you ask, they all have company issued laptops now (it
didn't used to be the case. We could dial up/VPN and log on from any PC). I
thought about asking them to post the report that I need on the secure
intranet that I have access to, but they would need to design it likely just
for 2 or 3 people to use. Not likely to happen.
I had authorized VPN access about 5 years ago, by connecting to a Terminal
Server session (is that called Remote Desktop now?). After awhile I noticed
that as upgrades were done to our business software program, they were not
being upgraded on the Terminal Server. It became clear that the server was
forgotten about, and that I must be the only one still using it. Then it
disappeared completely one day.
I have since stepped down to a non-management position, & my remote access
should have been revoked at that time. It was not, so I continued to enjoy
the convenience of logging on from home until technology started changing and
I no longer was in the loop for upgrades, etc.
I discovered that they used VNC to remote connect to my workstation, and
tried that over VPN from home one day & it worked, to my suprise. I had
access again via my desktop at work! I've been using it that way ever since,
even though IS stopped using VNC a couple years ago.
Typically, our IT guys were hired from other depts within the company to
work in IS. Then they were replaced by people with MCSE certificates and the
like, and the result is that we are now locked down pretty tight. I always
wondered why I could get into the registry editor and other system areas of
my computer, and get into some other peoples files on the server. Now I
cannot do any of that.
I think my best bet now is to keep quiet before I lose what little is left
of my remote access.
Thanks for the input, guys.
--Mike Hall