Dave Kearns on NAP and Active Directory
Dave Kearns has a nice write-up on the directory implications of NAC / NAP. He says:
What I find extraordinary in all the material Microsoft has published on NAP and NAC (both Cisco’s NAC and the generic NAC) is the extremely limited (i.e., I couldn’t find any) references to Active Directory! But all of this is firmly based on having an up-to-date, schema-extended Active Directory forest as the basis for identifying and tracking all of the hardware that’s either on or attempting to attach to your network.
Getting a handle on AD is certainly a requirement before doing NAP but in talking to customers I’m finding things are even worse than Dave describes. Often there are multiple forests of AD through acquisition or merger. Also, many organizations have LDAP servers as well which house their own user repository for certain groups. Microsoft would like organizations to use a single forest of AD for all their users and devices but in reality while that may be a goal for an enterprise, there are plenty of things which prevent that from happening.
Network identity management is about more than just directories and AAA. It has to be about making those directories do something useful in their current state of deployment, not just their idyllic environment as envisioned by the vendor. Some of the things a virtual directory can do for application IdM are just as useful in the network context. Only when we can easily identify the user and their device can we hope to write meaningful policies around what those elements can do on a network.
October 14th, 2006 at 3:53 am
There are no references to AD in the NAP documentation because no AD schema updates are required for NAP. The only thing that is required for is a Longhorn server running Network Policy Server. The AD schema updates Dave points out are for SMS 4.0. Of course, you will still want to have your AD in order to implement 802.1x and to a lesser extent IPSec.