20411B-ENU-TrainerHandbook

6-24 Managing User Desktops with Group Policy

Review Questions

Question: Why do some Group Policy settings take two logons before going into effect?

Question: How can you support Group Policy preferences on Windows XP?

Question: What is the benefit of having a central store?

Question: What is the main difference between Group Policy settings and Group Policy preferences?

Question: What is the difference between publishing and assigning software through Group Policy?

Question: Can you use Windows PowerShell scripts as startup scripts?

PROHIBITED USE STUDENT .ONLY USE MCT

Lesson Objectives

After completing this lesson, you will be able to:

•Describe the components of a Network Access Services infrastructure.

•Describe the Network Policy and Access Services role.

•Describe Routing and Remote access.

•Explain network access authentication and authorization.

•Explain the types of authentication methods that are used for network access.

•Describe a public key infrastructure (PKI).

•Explain how Dynamic Host Configuration Protocol (DHCP) servers are used with the Routing and Remote Access Service.

Components of a Network Access Services Infrastructure

The underlying infrastructure in a complete Network Access Services infrastructure in Windows Server 2012 typically includes the following components:

•Virtual Private Network (VPN) Server. Provides remote access connectivity based on various VPN tunneling protocols over a public network, such as the Internet.

•Active Directory® Domain Services (AD DS). Services authentication requests from remote access client connection attempts.

•Active Directory Certificate Services (AD CS). You can use digital certificates to provide for authentication in remote access scenarios. By deploying AD CS, you can create a PKI in your organization to support the issue, management, and revocation of certificates.

•DHCP Server. Supplies accepted inbound remote access connections with an IP configuration for network connectivity to the corporate local area network (LAN).

•Network Policy Server (NPS). Provides authentication services for other network access components.

•Network Access Protection (NAP) components:

o NAP Health Policy Server. Evaluates system health against configured health policies that describe health requirements and enforcement behaviors, such as requiring that connecting clients must be compliant before they gain access to the network.

.ONLY

PROHIBITED USE STUDENT

What Is the Remote Access Role?

The Remote Access role enables you to provide users with remote access to your organization’s network using one of the following technologies:

•VPN Access. A VPN provides a point-to-point connection between components of a private network through a public network, such as the Internet. Tunneling protocols enable a VPN client to establish and maintain a connection to a VPN server’s listening virtual port. You also can connect branch offices to your network with VPN solutions, deploy fullfeatured software routers on your network,

and share Internet connections across the intranet.

PROHIBITED

7-6 Configuring and Troubleshooting Remote Access

EAP

With the Extensible Authentication Protocol (EAP), an arbitrary authentication mechanism authenticates a remote access connection. The remote access client and the authenticator (either the Remote Access server or the RADIUS server) negotiate the exact authentication scheme to be used. Routing and Remote Access includes support for EAP-Transport Level Security (EAP-TLS) by default. You can plug in other EAP modules to the server that is running Routing and Remote Access to provide other EAP methods.

Other Options

USE MCT

•The IP address of the DHCP server.

•The client-leased IP address (for later distribution to the Routing and Remote Access client).

•The time at which the lease was obtained.

•The time at which the lease expires.

•The lease duration.

All other DHCP option information that the DHCP server returns—such as server, scope, or reservation options—is discarded. When the client dials in to the server and requests an IP address (that is, when Server Assigned IP Address is selected), it uses a cached DHCP lease to provide the dial-up client with dynamic IP address configuration.

When the IP address is provided to the dial-up client, the client is unaware that the IP address has been obtained through this intermediate process between the DHCP server and the Remote Access server. The Remote Access server maintains the lease on the client’s behalf. Therefore, the only information that the client receives from the DHCP server is the IP address.

PROHIBITED