One of the easiest and arguably most prevalent ways for nefarious software or Internet users to creep onto your network is not through holes in your firewall, or brute force password attacks, or anything else that might occur at your corporate headquarters or campus. | Deploying Network Access Quarantine Control One of the easiest and arguably most prevalent ways for nefarious software or Internet users to creep onto your network is not through holes in your firewall or brute force password attacks or anything else that might occur at your corporate headquarters or campus. It s through your mobile users when they try to connect to your business network while on the road. Consider why that is the case. Most remote users are only authenticated on the basis of their identity no effort is made to verify that their hardware and software meets a certain baseline requirement. Remote users could and do everyday fail any or all of the following guidelines The latest service pack and the latest security hotfixes are installed. The corporation-standard antivirus software is installed and running and the latest signature files are being used. Internet or network routing is disabled. Windows XP s ICF or any other approved firewall is installed enabled and actively protecting ports on the computer. You would expect your business desktops to follow policy but in the past mobile users have traditionally been forgotten or grudgingly accepted as exceptions to the rule. However Windows Server 2003 includes a new feature in its Resource Kit called Network Access Quarantine Control which allows you to prevent remote users from connecting to your network with machines that aren t up-to-date and secure. How Network Access Quarantine Works Network Access Quarantine Control or NAQC prevents unhindered free access to a network from a remote location until after the destination computer has verified the remote computer s configuration meets certain requirements and standards as outlined in a script. To use NAQC your remote access computers must be running any one of Windows 98 Second Edition Windows Millennium Edition Windows 2000 or Windows XP Home or Professional. These versions of Windows support a connectoid containing the connection information the .
