|
Posted by =?Utf-8?B?VHJhbnNhbTM4OA==?= on June 12, 2006, 5:04 pm
If you were Registered and logged in, you could reply and use other advanced thread options
"Steven L Umbach" wrote:
> Assuming the workstation is XP Pro use ipsec. Just keep in mind that
> implementing ipsec requires that domain controllers be exempt from using or
> even attempting to use ipsec for any traffic ESP/AH between domain
> controllers and domain workstations but that can be easily done by having a
> rule with a permit filter action for all the IP addresses of all domain
> controllers for all traffic. Ipsec filters can specify destination/source
> IP, ports, and protocols so that you do not have to encrypt all traffic but
> just that you specify. I would not suggest implementing ipsec at the domain
> level but would put the servers [assuming not domain controllers] in an OU
> with an ipsec require policy for the ports/protocols in question and then
> move the workstations to an OU and implement a client/respond policy on a
> GPO linked to that OU. The links below explain more on ipsec. Ipsec can
> also be used on non domain computers but not using Kerberos for computer
> authentication. In that case preshared key and certificate authentication
> could be used with certificate being the preferred method as the pre shared
> key is stored in the registry in clear text if that would be a concern
> making it easier for someone on a non authorized computer being able to
> possibly discover and use the pre shared key. --- Steve
>
> implementing ipsec in a domain
>
http://www.microsoft.com/technet/security/topics/architectureanddesign/ipsec/ipsecapa.mspx
> --- Appendix A: Overview of IPsec Policy Concepts
> ipsec policy.
>
> > What would be the best way to encrypt data from a 2003 server going to a
> > XP
> > workstation? The data will be media related, probably MPEG with audio
> > being
> > the primary data but it is important that the information contained within
> > can be encrypted to the opening workstation. The files are going to be
> > centrally managed on the server and not downloaded to the workstation to
> > control the versions but due to security within company this needs
> > encryption
> > at server and decrypted at workstation. Thanks as always for your help!
>
>
>
| 
XML site map