M
Maeliosa
Guest
I understand how the Vista profiles work. However I have issues with
this because on our domain I am not able to fully manage Vista
clients. Here's why:
In order for Vista to use the Domain Profile for the Firewall, every
active network connection on the PC must be authenticated to the
domain. If there are any other active network connections where the
network type is not "Domain" then the firewall profile "Public" is set
as active, and the machine cannot be communicated with.
I WANT the public profile to stay the way it is. This is safe because
when they take their machines away from the office, they are protected
automatically. However while in the office this causes many issues.
Our machines need to be FULLY managed. This means we need to be able
to ping, file share (for hidden admin shares), we use SMS, Antivirus
management tools, etc... So there are many firewall exceptions
defined on the Domain Profile using Group Policy.
Here's the issue:
Some machines have wireless cards. Well I have yet to find a way to
disable wireless cards automatically when they can connect to the
domain. If we can't do it automatically, then it isn't fully
manageable and our users can exploit the fact that they can make their
machine "invisible" on our network, except that we know they are
getting an IP through DHCP. This is bad.
And wireless cards aren't the end of it. Anyone that has any other
type of network adapter, like the virtual adapters VMWare installs.
Those are always an active connection. And that connection is
classified as "unidentified network" - which means anyone with VMWAre
installed on their machine will always use the public profile, unless
they manually disable all the VMWare adapters.
The Vista firewall is powerful, but it is not ideal for computers that
are used on the domain because of these reasons. For security reasons
if a computer is not fully manageable while on your domain, or if a
user can block you the administrators of the domain from having full
control of their domain computer, then that is a huge security risk.
The point of domain machines is that they are in a controlled
environment. Automatically applying the public profile to a domain
machine while it is on the domain, simply because it has other network
adapters, causes the machine to be authenticated to the domain, yet
the domain has no authority over that machine except when manual
intervention is used. This is very, very bad. Did no one think of
this when designing the firewall profiles? I expect to see more
people either disabling the Vista firewall completely, or putting
exceptions in their public profile to work around this issues, thereby
making the Vista firewall moot anyways.
If anyone knows how to address these issues in an AUTOMATED way -
meaning I can centrally control this and don't rely on manual
intervention on the clients (for security reasons we don't rely on the
users to configure their machines) - please respond. Taking away the
user's admin rights now is not enough. Now we have to figure out some
way to make sure the Vista machines are manageable without the user
simply turning on their wireless card to block admins from controlling
their machines. So far I have found no ideal solution without
loosening the public profile settings - I might as well just disable
the firewall feature completely and cross my fingers eh?
this because on our domain I am not able to fully manage Vista
clients. Here's why:
In order for Vista to use the Domain Profile for the Firewall, every
active network connection on the PC must be authenticated to the
domain. If there are any other active network connections where the
network type is not "Domain" then the firewall profile "Public" is set
as active, and the machine cannot be communicated with.
I WANT the public profile to stay the way it is. This is safe because
when they take their machines away from the office, they are protected
automatically. However while in the office this causes many issues.
Our machines need to be FULLY managed. This means we need to be able
to ping, file share (for hidden admin shares), we use SMS, Antivirus
management tools, etc... So there are many firewall exceptions
defined on the Domain Profile using Group Policy.
Here's the issue:
Some machines have wireless cards. Well I have yet to find a way to
disable wireless cards automatically when they can connect to the
domain. If we can't do it automatically, then it isn't fully
manageable and our users can exploit the fact that they can make their
machine "invisible" on our network, except that we know they are
getting an IP through DHCP. This is bad.
And wireless cards aren't the end of it. Anyone that has any other
type of network adapter, like the virtual adapters VMWare installs.
Those are always an active connection. And that connection is
classified as "unidentified network" - which means anyone with VMWAre
installed on their machine will always use the public profile, unless
they manually disable all the VMWare adapters.
The Vista firewall is powerful, but it is not ideal for computers that
are used on the domain because of these reasons. For security reasons
if a computer is not fully manageable while on your domain, or if a
user can block you the administrators of the domain from having full
control of their domain computer, then that is a huge security risk.
The point of domain machines is that they are in a controlled
environment. Automatically applying the public profile to a domain
machine while it is on the domain, simply because it has other network
adapters, causes the machine to be authenticated to the domain, yet
the domain has no authority over that machine except when manual
intervention is used. This is very, very bad. Did no one think of
this when designing the firewall profiles? I expect to see more
people either disabling the Vista firewall completely, or putting
exceptions in their public profile to work around this issues, thereby
making the Vista firewall moot anyways.
If anyone knows how to address these issues in an AUTOMATED way -
meaning I can centrally control this and don't rely on manual
intervention on the clients (for security reasons we don't rely on the
users to configure their machines) - please respond. Taking away the
user's admin rights now is not enough. Now we have to figure out some
way to make sure the Vista machines are manageable without the user
simply turning on their wireless card to block admins from controlling
their machines. So far I have found no ideal solution without
loosening the public profile settings - I might as well just disable
the firewall feature completely and cross my fingers eh?