To limits the Domain access

[Bear]

In a win2k (or 2003) Domain, do you know if it's possible to restrict the
access to the domain only for the client yet registered (in the domain).
I'd like to inhibit the access from "workgroup" clients (outside the
domanin) using an account existing in the domain (same login and password).

Thanks in advance for any idea.
Bear

 

[Roger Abell [MVP]]

Currently perhaps the most direct way to accomplish this is by
implementing IPsec for domain isolation. In effect, you are
wanting to allow access to domain resources only from machines
that are joined to the domain. Someone with a valid domain
account should not be allowed access to domain resources except
when logged into a machine in the domain.
Right?

http://search.microsoft.com/results.aspx?mkt=en-US&setlang=en-US&q=domain+isolation
or http://tinyurl.com/y5qa5y

 

[Bear]

Thanks for your answer

Currently perhaps the most direct way to accomplish this is by
implementing IPsec for domain isolation.

I will investigate this way.

Someone with a valid domain
account should not be allowed access to domain resources except
when logged into a machine in the domain.
Right?

Exactly. I want to prevent the possibility for a user (that know a regular
domain account) to connect a laptop (not registered in the domain) using his
account. If this connection is possible (as today) it's easy for an internal
user to copy entire archives on a personal laptop and get them outside the
company....

http://search.microsoft.com/results.aspx?mkt=en-US&setlang=en-US&q=domain+isolation
or http://tinyurl.com/y5qa5y

Thanks, an interesting link to start from...
Bear

 

[Bear]

Thanks for your answer

Currently perhaps the most direct way to accomplish this is by
implementing IPsec for domain isolation.

I will investigate this way.

Someone with a valid domain
account should not be allowed access to domain resources except
when logged into a machine in the domain.
Right?

Exactly. I want to prevent the possibility for a user (that know a regular
domain account) to connect a laptop (not registered in the domain) using his
account. If this connection is possible (as today) it's easy for an internal
user to copy entire archives on a personal laptop and get them outside the
company....

http://search.microsoft.com/results.aspx?mkt=en-US&setlang=en-US&q=domain+isolation
or http://tinyurl.com/y5qa5y

Thanks, an interesting link to start from...
Bear