Q9: How does Network Access Protection (NAP) work with vPro?
A9: Beginning with AMT 4.0 in July 2008, network security credentials can be embedded in vPro. This capability allows the Microsoft posture profile to be stored in hardware (in protected, persistent memory), and presented to the network even if the OS is absent. The network can now authenticate a PC before the OS and applications load, and before the PC is allowed to access the network. This capability also allows IT administrators to use their existing PXE infrastructure within a Microsoft NAP network. Statement of Health information for vPro clients including the System Boot Log, Approved Firmware versions & Security Parameters, and a digitally signed certificate can be sent back to the NAP Policy Server.

Intel vPro and Network Access Protection is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Network Access Protection is a great new feature of Windows Server 2008 that will help you understand the health of your client machines (Windows Vista and Windows XP Service Pack 3) and increase the trust in your network.

Server and Domain Isolation utilises IPsec to protect domain computers from un-trusted devices. Network Access Protection automates the process of moving machines between logical trusted and un-trusted IPsec networks.

Here are the links for Thursday the 13^th of March 2008:

• Blain Barton, an IT Pro Evangelist at Microsoft, takes you through NAP deployment an troubleshooting in TechNet Webcast: Windows Network Policy Server Fundamentals (Level 300)
• Here’s some recent content updates on TechNet for planning Server and Domain Isolation zones when implementing Windows Firewall with Advanced Security.
• TechNet Security Series Seminar III (29 Feb 2008) include Dennis Chung’s slides on Server and Domain Isolation with IPsec.
• Network World has a brief overview of their testing of Network Access Protection.
• Network World also has an article on recent vendor support for NAP: Security vendors rallying around NAP.
• Although a little brusque, Mike Rothman’s assessment of this take up is true. Vendor would be crazy not to be on the NAP bandwagon.
• Jason Slater gives his view on NAP in Why Network Access Protection is important to an SME.
• Jonathan Hassell, at SearchWindowsSecurity.com, covers NAP and IPsec enforcement, and has good stuff to say about this enforcement method. I don’t get the jab at DHCP enforcement though as this could never be considered secure.

The Short NAP: Thursday March 13 2008 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Network Access Protection is a great new feature of Windows Server 2008 that will help you understand the health of your client machines (Windows Vista and Windows XP Service Pack 3) and increase the trust in your network.

Server and Domain Isolation utilises IPsec to protect domain computers from un-trusted devices. Network Access Protection automates the process of moving machines between logical trusted and un-trusted IPsec networks.

Here are the links for Tuesday the 19^th of February 2008:

• Microsoft have released a heap of updated documentation for NAP. These are existing documents that have been updated for Windows Server 2008 RTM: Network Access Protection Platform Architecture, Introduction to Network Access Protection, Internet Protocol Security Enforcement in the Network Access Protection Platform, Step-by-Step Guide: Demonstrate NAP VPN Enforcement in a Test Lab, Step-by-Step Guide: Demonstrate NAP IPsec Enforcement in a Test Lab, Step-by-Step Guide: Demonstrate NAP DHCP Enforcement in a Test Lab and Step-by-Step Guide: Demonstrate NAP 802.1X Enforcement in a Test Lab. (The Demonstrate NAP VPN Enforcement download is currently the wrong document, hopefully that will be fixed soon).
• A new NAP knowledge-base article has been posted: Successful authentications occur even though the authentications do not participate in Network Access Protection on a Windows Vista-based computer. 
• The Lazy Admin has some detail, currently missing from the documentation, on configuring the NAP agent in Windows XP Service Pack 3.

The Short NAP: Tuesday February 19 2008 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Network Access Protection is a great new feature of Windows Server 2008 that will help you understand the health of your client machines (Windows Vista and Windows XP Service Pack 3) and increase the trust in your network.

Server and Domain Isolation utilises IPsec to protect domain computers from un-trusted devices. Network Access Protection automates the process of moving machines between logical trusted and un-trusted IPsec networks.

Here are the links for Thursday the 7^th of February 2008:

• The big news this week is obviously that Windows Server 2008 and Windows Vista Service Pack 1 have gone RTM, which means that the final NAP code is available. Hopefully Windows XP Service Pack 3 is just around the corner.
• Microsoft have released a number of NAP and IPsec documents that have been around during the Windows Server 2008 beta period or even earlier and have been updated for the RTM version: Introduction to Network Access Protection, Internet Protocol Security for Microsoft Windows Server 2003, Internet Protocol Security Enforcement in the Network Access Protection Platform and IEEE 802.1X for Wired Networks and Internet Protocol Security with Microsoft Windows.
• You might also want to check out the Group Policy Settings Reference for Windows Server 2008 document which includes the new NAP, 802.1x and IPsec polices available.
• Microsoft have also recently recently released an IPsec Diagnostic Tool. The UI is pretty basic but the diagnostic results should make short work of troubleshooting.
• Jeff Wettlaufer, Senior Technical Product Manager for System Centre Configuration Manager, has posted some great detail on SCCM integration with NAP. There’s a demo video and I gather from this quote: “a few weeks ago the North American region went into production NAP enforcement, so we really are practicing what we preach“, that Microsoft have moved from report only mode to full enforcement on their internal networks. That sounds pretty cool when you consider how big their network is.
• A new case study on NAP deployment has been published. Fulton County implemented NAP with IPsec enforcement.. Via Steve.
• There’s a new TechNet webcast today: NAP TAP Deployments in Windows Server 2008, which is detailing some best practices. Keep and eye out for the recorded version which should be available in the next few weeks.
• Chris Hoff generated all sorts of discussion with this post How the Hypervisor is Death By a Thousand Cuts to the Network IPS/NAC Appliance Vendors and it’s follow up Client Virtualization and NAC: The Fratto Strikes Back.
• Greg Shields at Redmond Mag has a nice overview of NAP here: A NAP Is Good for Your Health.

The Short NAP: Thursday February 7 2008 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

It’s a bit early for me to give you an idea of what the book is like, but from the brief look I’ve had it’s worth a place in your library if you’ll be dealing with Windows 2008′s networking features. The section dedicated to NAP takes up just under 1/2 of the book with some clear explanations of it’s components.

Here’s a list of the contents so you can see for yourself what’s in this book:

Part I Addressing and Packet Flow Infrastructure

• IPv4
• IPv6
• Dynamic Host Configuration Protocol
• Windows Firewall with Advanced Security
• Policy-Based Quality of Service
• Scalable Networking

Part II Name Resolution Infrastructure

• Domain Name System
• Windows Internet Name Service

Part III Network Access Infrastructure

• Authentication Infrastructure
• IEEE 802.11 Wireless Networks
• IEEE 802.1X–Authenticated Wired Networks
• Remote Access VPN Connections
• Site-to-Site VPN Connections

Part IV Network Access Protection Infrastructure

• Network Access Protection Overview
• Preparing for Network Access Protection
• IPsec Enforcement
• 802.1X Enforcement
• VPN Enforcement
• DHCP Enforcement

What was a pleasant surprise is that you get a complete PDF version on the included CD, as well as 2 more books in PDF format: Understanding IPv6 2nd Edition (complete version too) and TCP/IP Fundamentals for Microsoft Windows. Not bad for £26.

Sadly for any Australian readers, you won’t be getting anywhere near that price. These best I’ve found is $89.95 AU from Booktopia. That price difference doesn’t sound fair to me.

Book: Windows Server 2008 Networking and Network Access Protection is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Jeff Sigman spent Christmas day! creating a wiki for Network Access Protection. I think a better place for wiki would be on TechNet Edge..
• Microsoft have a new page on TechNet, Improving Network Compliance with Windows Server 2008 Network Access Protection, that brings together the various resources available to you for learning about Network Access Protection.
• An update is available for Windows Vista if you have implemented NAP with IPsec enforcement and are experiencing connectivity issues after running GPUPDATE /FORCE.
• IT’s Showtime has posted a video on network security including details of IPsec implementation by John Craddock and Sally Storey from Kimberry Associates.
• Steve Lamb has details on interoperability with IPsec on RedHat Linux and Windows Vista from testing performed by Port 25.
• Dark Reading discusses IPsec adoption for server and domain isolation, interoperability with Linux and NAP.
• Dennis Chung answers the question: Does IPSec make IPS/NDS redundant? Essentially – No, unless you are using encryption.
• Greg Shields highlights a new a whitepaper available that compares 5 NAC products. Unfortunately registration is required to read the paper.
• TechRepublic continues their articles on NAP with Take a NAP to secure your network. This is a great introduction article that also discusses Cisco’s NAC and PacketFence.

The Short NAP: Thursday January 10 2008 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• The Cable Guy gives a great overview, yet in-depth look at Network Access Protection in Windows Server 2008. Via Jeff.
• Avenda releases their NAP agent for Linux in beta with support for RedHat based distributions Via Jeff.
• TechNet Edge has a screencast of Network Access Protection integration with TS Gateway.
• Here’s a great TechNet article: Windows Server 2008 in an Organization’s Defense in Depth Strategy by Jay Paloma. This covers the Network Policy Server of which NAP is a component.
• Dave Northey gets some great feedback from a customer testing NAP in Ireland.
• Premier Support customers have a Security Health Check available to help them get their processes and policies in place. Enforcing those policies is what NAP is all about.
• Ronald Beekelaar has created a Server and Domain Isolation Demo for use with Virtual PC/Server. Ian Hameroff has more details and a Windows Vista/2008 version is on the way.
• TechRepublic has a number of new articles on NAP: Introducing Network Access Protection for Windows, Configuring Network Access Protection for Windows Server 2008, Enterprise considerations for Microsoft Network Access Protection, Wireless considerations and Network Access Protection resources and Learn how Windows Vista takes a NAP. Rick Vanover takes you through quite a good bit of information on NAP. The last paragraph of the ‘Enterprise consideration’ article is surprising given that the required information is actually well known:

It is not clear what implementation configuration would be required for Windows XP clients since Service Pack 3 is not yet available; nor is it clear how a Windows XP MS-NAP client would be managed — if at all possible — from a Windows Server 2008 functionality level Active Directory domain.

• Celestix announce their Network Access Protection appliance to be available not long after the release of Windows Server 2008. This should be an appealing solution, but I’m interested in how this integrates with existing Certificate Services implementations.
• Techworld reports on the current state of Network Access Control solutions – are current solutions delivering on their promise? With broad support already, Microsoft’s NAP could help to improve the situation.

Amongst all this news, as you’re most likely aready aware, Windows XP Service Pack 3, Windows Vista Service Pack 1 and Windows Server 2008 Release Candidates are available which give the best indication yet of what Network Access Protection is capable of.

The Short NAP: Monday December 17 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Network Access Protection with MSIT: an interview on Channel 9 with Jeff Sigman about NAP. This is worth checking out.
• A Windows Server 2003-based enterprise CA issues certificates that have incorrect alternate subject names and the certificates are not NAP-compliant: an update is available for Windows Server 2003 Certificate Services to better support NAP.
• Building Plug-ins for Network Access Protection: here’s where to start if you’re looking to build plug-ins for NAP.
• The Definitive Guide to NAP Logging: everything you’ve ever wanted to know about logging in NAP.
• TechNet Update for October (NPS/NAP and WSUS) completed, Resources available: Kleefy’s NAP technical overview presentation is available for download.
• TechNet VODcast – Network Access Protection: a NAP vodcast with a very relaxed looking Jeff Alexander.
• Microsoft Improves Security Policy Compliance with Network Access Protection: the case study to end all case studies – Microsoft’s own internal NAP deployment.
• System Center Configuration Manager 2007 Product Feature Quizzes: there’s a set of 10 questions there about NAP integration with Configuration Manager 2007.
• Partners Will Extend Network Access Protection to Linux and Mac Desktops, and Create a New Appliance Form Factor: that is seriously cool, now if I could only get OS X running on my new laptop. Via Jeff.
• NAP Infrastructure and Network Policy Server Infrastructure: new NAP and NPS troubleshooting material up on TechNet. Via Greg.
• Avenda Linux NAP Agent, Linux NAP SHV, Universal NAP SHA for Microsoft Vista and Windows XP and Anyclick for NAP: really cool 3rd party extentions for NAP. Via Jeff.
• Configure Terminal Services Clients as NAP Enforcement Clients for TS Gateway: exactly what it says on the tin.
• Does this smell funny to you?: Alan Shimel smells something fishy with the recent 3rd party NAP client announcements.

The Short NAP: Friday November 22 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• StillSecure Introduces Free Network Access Control Solution: StillSecure releases a free version of Safe Access which will help you view and report on your compliance status. This is pretty cool stuff and it comes as a pre-configured VMware appliance. Check out the Safe Access Lite site for more info.
• Serious About NAC: A great article on the realities and expectations of NAC products.
• Kaspersky Lab announces support for Microsoft NAP: Kaspersky’s on board with an agent and validator (which installs on the NAP server).
• Greetings from the Future (Or, At Least GMT+8): Ian Hameroff talks about his IPsec and NAP talks at TechEd 2007 SEA
• Know the health level of your machines on the network?? Pluto does…: Dennis Chung talks about Pluto Tech’s successful implementation of NAP (hmm, I wish I was somewhere where I could implement NAP..)
• TechNet Updates October: Network Policy Server, NAP and WSUS 3.0: If you’re in Australia and have got some free time in October, why not check out the TechNet Updates sessions on NAP?

And finally:

• Windows Server 2008 RC0 Released!: You knew this already so stop reading this post and start deploying NAP.

The Short NAP: Friday September 28 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

What Microsoft is saying about NAP:

• Louisiana State University Deploys NAP: Webcast about a real world NAP deployment
• Network Access Protection (NAP) Deployment Planning: If there’s only one NAP post you read this year, make it this one.
• Microsoft IT: 120,000 NAP Clients deployed – it’s just too darn easy!: Impressive stats takes alot of planning.
• TechEd NAP and SCCM Session Question: Ebony and Ivory? 802.1x and WOL?
• SCCM 2007 RC1 and NAP integration first thoughts: Kleefy looks at NAP integration with SCCM 2007.
• Network Access Protection with Cisco switches Blogcast: Kleefy does NAP home videos on Cisco and 802.1x
• Friday’s Security Nugget: Dave Northy’s NAP demo screencast.
• Is your IT Infrastructure Secure?: Not directly NAP related, but this is about the bigger picture.
• Securing Your Network: Down and dirty with IPsec.
• TechNet Webcast: Windows Server 2008: Advancing Network Security (Level 300): Amith Krishnan and Ian Hameroff on Windows Firewall with Advanced Security, Server and Domain Isolation, and NAP.
• TechNet Radio – Network Access Protection (NAP) for Windows Server 2008: More Amith Krishnan on NAP on TechNet Radio.
• Internet Protocol Security Enforcement in the Network Access Protection Platform: Updated whitepaper on IPsec and NAP.
• Network Access Protection in Configuration Manager: Network Access Protection integration details in the Configuration Manager TechCentre.
• Understanding Windows Server 2008 Networking and Network Access Protection: Chat transcript from a NAP chat in July.

What others are saying about NAP:

• SolutionBase: Increase remote access security with Network Access Protection in Windows Vista: TechRepublic on Windows Vista and NAP.
• Collection of published Vista SP1 API changes from MSDN: Long details API changes coming in Windows Vista SP1, including those that will match NAP in Windows Server 2008.
• Windows Server 2008 NAP (Network Access Protection) infrastructure: 4sysops’s introduction to NAP.
• Windows Update, Microsoft Update, Automatic Updates – Microsoft’s confusing terminology and NAP: Automatic Updates, Windows Update, Microsoft Update, Oh my!
• Intel adds desktop NAC to latest chips: NAC support on the CPU should accelerate adoption of NAC technologies.
• Windows Server and Domain Isolation: What it is and what it does: Greg Shields will talk about Server and Domain Isolation at TechMentor in October in Las Vegas.

The Short NAP: Wednesday September 12 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Jeff Sigman Gives Us Network Access Protection!: RunAs Radio’s interview with Jeff Sigman.
• Upcoming Chat: Understanding Windows Server 2008 Networking and Network Access Protection
• Webcast: Lessons Learned in a Real-World Network Access Protection Deployment (Level 300): Louisiana State University discusses their Network Access Protection deployment. Real world stuff is pretty cool, I feel so left out..
• Network Access Protection with IPSec Enforcement Virtual Lab: If there’s only one TechNet lab you do this year, make it this one.
• Brand Spanking New Server and Domain Isolation Case Study: Reading reams of technical pages about server and domain isolation can be a little boring so why not check out this case study on the City of Sapporo’s implementation for some real world stuff.
• Forum Topic: Network Access Protection: Another configuring Network Access Protection tutorial over at kaanosh.com.
• NAP 802.1x Enforcement – Switches we’ve tested w/NAP: From the horse’s mouth – switches the NAP team have tested for 802.1x enforcement
• Clinic 5936: Introducing Security and Policy Management in Microsoft Windows Server 2008: A e-learning clinic you can view offline too for an introduction to NAP.
• Network Policy Server TechCentre: If you’ll be working with NAP, you’ll be working with the Network Policy Server, check out the new page for it up on TechNet.

The Short NAP: Thursday July 12 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Citrix Acquires NAC Vendor: Citrix to enter the NAC space. Hopefully they’ll see the light when Windows Server 2008 is released, I really wish they wouldn’t go down this road.
• TechEd US 2007 Day 4: The End of the Booth: There’s an interview with Jeff Sigman somewhere, keep an eye on RunAs Radio for this soon (I hope).
• How Microsoft IT Uses Network Access Protection to Manage Network Health (Level 300): This webcast that I noted in a previous Short NAP is now available for offline viewing.
• Security and Policy Enforcement: Network Access Protection: Graziano Galante, from Microsoft Italy, speaks about Network Access Protection.
• Server and Domain Isolation Data Sheet: This two page document with an overview of server and domain isolation has been updated to version 1.5
• Ian Hameroff at TechEd US 2007: Ian interviews Rodrigo Immaginario about domain and server isolation at the Universidade de Vila Velha. This is a great video that I recommend watching. I’ve embedded the video here too:

The Short NAP: Thursday June 14 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• An Introduction to Network Access Protection (Part 7): Brian Posey’s latest installment in his detailed introduction to Network Access Protection. Curiously at the end of the article he mentions “I have heard a few rumors that Windows XP may eventually be retrofit to support NAP”. This is an odd statement given that the NAP client for Windows XP is currently in beta and has been for some time.
• Microsoft Takes Aim at Endpoint: Dark Reading covers the Intelligent Application Gateway Service Pack 1 with future support for NAP.
• TechNet Webcast: How Microsoft IT Uses Network Access Protection to Manage Network Health (Level 300): Kevin Rhodes will present on the internal use of NAP at Microsoft on June 12. I’ll be asleep when this is on, so I’ll have to catch up when the webcast is available offline.
• Introducing Windows Server 2008: The first Microsoft Press book off the ranks on Windows Server 2008 will include a chapter devoted to NAP.
• FullArmor Endpoint Policy Manager Ships: FullArmor have released their product for enforcing endpoint policies with integration into NAP.
• University Uses Existing Windows Investments to Tighten Network Security and Management: A case study on the Universidade de Vila Velha using domain isolation to help protect their network. Also check out this article by Rodrigo Immaginario the university’s CIO. Via Ian Hameroff.
• Exploring The Windows Firewall: Steve Riley takes a look at the Windows Firewall in Windows Vista.

The Short NAP: Thursday May 31 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• InteropLabs: Network Access Control (NAC) Initiative
  Lots of information about network access control technologies from Interop in Las Vegas
• TechNet Webcast: Windows Server 2008: Advancing Network Security (Level 300)
  Amith Krishnan and Ian Hammeroff present on Windows Firewall with Advanced Security, Server and Domain Isolation, and Network Access Protection (NAP) in Windows Server 2008
• NAP Longhorn Beta 3 Webcast (Offline)
  Jeff Sigman’s presention on NAP in Windows Server 2008 Beta 3
• TechEd 2007 AU and NZ Server Track: Changes
  Details on a NAP and SCCM 2007 session at TechNet AU/NZ still to come
• Download troubles of the NAP on XP Client – UPDATE!
  The NAP client for Windows XP Service Pack 2 is available for download, again.
• Juniper Networks and Microsoft Announce Unified Access Control and Network Access Protection to Interoperate
  Juniper Networks press release on how they intend to interoperate with NAP
• Network Access Protection (NAP) announcement with the Trusted Computing Group (TCG)
  Detailed announcement about the TCG’s interoperability with NAP
• Microsoft and Trusted Computing Group Announce Interoperability (PDF)
  TCG’s press release about interoperability with NAP
• Standardizing Network Access Control: TNC and Microsoft NAP to Interoperate (PDF)
  Some more technical details on TCG’s interoperability
• Extreme Networks Demonstrates Further Integration With Microsoft Network Access Protection
  This one is from February, but Extreme Networks demonstrate support for NAP
• Step-by-Step Guide: Demonstrate IPsec NAP Enforcement in a Test Lab
  This document has been updated again this month, the last update being in April

The Short NAP: Wednesday May 23 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• SEC304: Configuring Secure and Domain Isolation to Protect Your Network
  Ronald Beekelaar is presenting a session on domain isolation at the IT Pro Connections 2007 in Amsterdam, 19^th to the 20^th of June
• Chat Transcript: Network Policy Server in Longhorn
  Transcript of the NAP chat from April 10^th, lots of questions on some broad topics within NAP
• Upcoming Chat May 24, 2007: Deploying NAP
  “The Enterprise Networking Group is hosting a web chat that will focus on the deployment of Network Access Protection (NAP) that will cover different enforcement technologies. There will be the opportunity to ask questions of the developers, testers and program managers working on NAP.”
• TechNet Australia 2007 sessions
  The session “Microsoft Windows Server Network Policy Server Fundamentals: Implementing NAP” will be run at this year’s TechEd Australia at the Gold Coast Convention Centre, August 7^th to 10^th.

The Short NAP: Monday May 7 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

This edition of the Short NAP is a little earlier than expected as Microsoft has released a number of guides for configuring Network Access Protection in a lab environment. These documents have been around previously but they’ve been updated and re-released:

• Step By Step Guide: Demonstrate 802.1X NAP Enforcement in a Test Lab
• Setting Up Virtual Private Network Enforcement for Network Access Protection in a Test Lab
• Setting Up Dynamic Host Configuration Protocol Enforcement for Network Access Protection in a Test Lab
• Setting Up Internet Protocol Security Enforcement for Network Access Protection in a Test Lab

Brian Posey has also added part 6 of his introduction to Network Access Protection:

• An Introduction to Network Access Protection (Part 6)

UPDATE: Microsoft have also released an update to the Network Access Protection Platform Architecture document:

• Network Access Protection Platform Architecture

The Short NAP: Wednesday 25th April 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Bypassing NAC v2.0 by Ofir Arkin
  Death by PowerPoint (112 slides..) but a worthwhile read none the less.
• TechNet Radio – Community Corner: An interview with five time SMS MVP, Ed Aldrich
  This interview includes a short overview of System Centre Operations Manager 2007 and NAP ( listen from 9:06 to 11:33)
• Microsoft Network Infrastructure Servers Forum
  A new forum for discussions on DHCP, DNS, NPS, and RRAS
• Dodging Silver Bullet Syndrome or: How I Learned to Stop Worrying and Prepared for NAP (Part 1)
  Ian Hameroff asks ‘You’ve got your network policies in place right?’
• Vista’s Network Access Protection (NAP) helps keep ‘unhealthy’ computers off your LAN
  This one’s a few months old but I didn’t notice until today
• Network Access Protection: New Ways To Keep Your Network Healthy
  An introductory whitepaper on NAP over at Techworld.com

The Short NAP: Sunday 22nd April 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Whitepaper: Using Server Isolation to Protect the Key Management Service (KMS).
  Protect access to Volume Activation 2.0 Key Management Service hosts on your network – stop unauthorised machines from activating against your KMS hosts.
• Chat transcript: Deploying NAP End to End in your Enterprise.
  Good questions there about NAP deployment.
• Chat transcript: Network Access Protection System Health Agent/Validator.
  Unusually short chat about SH agents and validators.
• An Introduction to Network Access Protection, Part 4 and Part 5.
  Brian Posey’s ongoing series on NAP at windowsnetworking.com
• Upcoming chat: The Network Access Protection (NAP) Server.
  The NAP team will be hosting a chat all about the Network Policy Server

The Short NAP: Wednesday 4th April 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• MVP Summit – NAP Deep Dive Results
  Jeff Sigman prays to the demo gods at the MVP summit but they weren’t listening, so he fixes it himself, also setting up a NAP server in Longhorn beta 3 takes about 15 minutes after improvements in the server console.
• Upcoming chat – Network Policy Server in Longhorn, April 10
  Add the chat to your calendar here.
• Upcoming chat – DHCP enhancements in Windows Vista: NAP enforcement and DHCPv6 – Part 2, April 19
  Add the chat to your calendar here.
• Previous chat – Deploying NAP end to end in your Enterprise
  Keep an eye out for the transcript on the TechNet Chat Transcripts page.
• NAP compliancy rates at Redmond above 80%
  Jeff Sigmans follow up to Adam Carter’s original post about the rollout of NAP at Redmond.
• D-Link announces support for NAP
  Even D-Link? Who’d have thought?
• 10 Reasons to look at Windows Longhorn Part 6: Network Access Protection
  Arlindo Alves takes a look at NAP in his 10 part series look at Longhorn server.

The Short NAP: Tuesday March 20th 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Network Access Protection: Configuration Screencasts
  Michael Kleef has some great screencasts of NAP using IPSec as an enforcement policy (Hey Kleefy, it’s IPsec not IPSEC)
• Microsoft’s Answer to NAC Is Set to Take Off
  ITSecurity.com is has some good things to say about NAP even though Longhorn hasn’t yet been released
• Keep Unsecured Machines Off Your Network (A WinIT Pro Podcast)
  Ian Hammeroff chats with Karen Forster of Windows IT Pro about NAP, NAC, Domain & Server Isolation and the keynote speech at RSA 2007.
• Network Access Protection Client for Windows XP SP2 – Beta 3 Release
  The Beta 3 of the NAP Client for Windows XP Service Pack 2 is available up on Microsoft Connect

The Short NAP: Friday 2nd March 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Microsoft Network Access Protection Achieves 100-Partner Milestone
  The number partners supporting NAP hits 100, but anyone would be foolish to be left behind I think.
• Chat Transcript: EAPHost in Windows Vista and Longhorn (January 18, 2006)
  In-depth EAP chat, not for the feint of heart
• Windows Security Health Agent (WSHA) and Windows Security Health Validator (WSHV)
  Quick overview of the health agents and vaildators available in Vista/Longhorn and Windows XP
• Windows XP NAP client complete?
  Jeff Sigman’s not so subtle hint at the XP NAP client demo as RSA 2007
• NAP Web Chats coming your way!
  The ‘Using Microsoft’s RADIUS server to secure your Network’ chat has been and gone (hopefully a transcript soon) the ‘Network Access Protection (NAP) System Health Agent/Validator (SHA/SHV) SDK’ is still to come.

The Short NAP: Saturday 3rd February 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• An Introduction to Network Access Protection (Part 2)
• An Introduction to Network Access Protection (Part 3)
• Video: Sneak peak of NAP on XP + 802.1x/EAP

The Short NAP: Tuesday 23rd January 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Internet Protocol Security Enforcement in the Network Access Protection Platform
• Network Access Protection Platform Architecture
• Configuring Network Access Protection Policies in Windows Server “Longhorn”
• Introduction to Network Access Protection

The Network Access Protection Platform Architecture document looks to be the most interesting document that goes into some detail on the NAP components.

The Short NAP: Friday 5th Janurary 2007 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

One aspect of network security that is frustrating for many administrators is that they have no control over the configuration of remote computers. Although the corporate network might be running a highly secure configuration, there is presently nothing to prevent remote user from connecting to the corporate network using a computer that is infested with viruses or that contains outdated patches.

• An Introduction to Network Access Protection (Part 1)

Link: An Introduction to Network Access Protection is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

You can mitigate some of the risks associated with unauthorized and potentially unfriendly access to your network and its resources by creating an isolated network. There are different ways to create an isolated network. With the Microsoft® Windows® operating systems, you can create an isolated network by using the Active Directory® directory service and Group Policy settings to isolate both your domain and domain member servers that store sensitive data, thus limiting access to only authenticated and authorized users.

• Introduction to Server and Domain Isolation with Microsoft Windows

Link: Introduction to Server & Domain Isolation with Windows is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Q: Is it true that NAP will not be “fully implemented” until Windows Longhorn is released?
A: This is correct. We shipped the NAP client-side pieces on Vista. We will be shipping the server-side [components] of NAP on Longhorn Server in the next year, as well as additional NAP client releases for XP SP2+ and Windows Server 2003.

Q: Can you explain how the NAP client pieces can be used prior to Longhorn?
A: The NAP client components are included with Vista but NAP also requires server components that are included with Windows Longhorn. Prior to the Longhorn server you can use the client pieces for beta testing and pilots with beta versions of Longhorn servers. It is not possible to define NAP health and enforcement policies without Longhorn Server.

Q: Is the Cisco Clean Access Agent part of Vista or are the two just going to be able to coexist?
A: The NAP/NAC integration uses the built-in NAP client that comes with Windows Vista. Cisco’s EAP-Fast and EAP-over-UDP will be integrated into Windows and will be able to use the NAP Client to support the Microsoft Statement of Health (SOH). Please refer to the NAP/NAC Interoperability Whitepaper http://www.microsoft.com/nap.

Q: With Longhorn version of IAS and NAP, is there a way to do simultaneous machine and user authentication?
A: No, you can do only one of them in a single request.

Q: Is there a time schedule/plan for supporting Windows Mobile devices?
A: At the present time there is not a schedule for this. We are in the process of figuring this out.

Q: Will Microsoft release a Linux port for NAP?
A: As of now Microsoft has no plans to implement the NAP Client’s Linux port. But the SOH protocol, communication protocol required to contact the NAP server, is available for licensing. So 3rd parties in the future might implement a port.

World of Network Access Protection Chat Transcript Available is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Amrith joins Alan and me to get in depth about NAP and how Microsoft is delivering NAP in Vista and Longhorn. We also talk about Microsoft’s plans to make the NAP APIs available for 3rd parties to create non-Windows NAP agents. The Microsoft NAP and Cisco NAC announcement gets some scrutiny and we work really hard to pin down Amrith on Microsoft’s plans for TCG/TNC support (you’ll be very interested in what he has to say about TNC). Overall I think Amrith was very forthcoming about NAP and our podcast listeners will find this interview extremely interesting. This isn’t your typical corporate PR sanitized interview.

Mitchell Ashley is CTO and VP Customer Experience at StillSecure, who create Safe Control, a network access control product, so expect to see some integration with NAP. You can listen to the discussion from the 14:52 to 37:33 minute marks. Here’s a quick bullet point overview of what is discussed:

• Introduction
• What is NAP?
• NAP components
• NAP and Cisco ACS/NAC
• Clients for Windows XP/Windows 2000
• Clients for non-Windows OSs
• A little more on NAP and NAC
• Support for Trusted Computing Group‘s standards
• Enforcement options
• Remediation options
• Identity management
• Misconceptions about NAP
• Where will Microsoft be demoing NAP? (only useful if you live in the US)

NAP podcast with The Converging Network is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Network Access Protection (NAP) is a new policy enforcement technology in the Windows Vistaâ„¢ and Windows Server® Code Name “Longhorn” operating systems. NAP provides components and an application programming interface (API) set that help administrators enforce compliance with health requirements for network access and communication. This paper contains an introduction to NAP and instructions on how to set up a test lab to deploy NAP with the 802.1X enforcement method. The lab requires two server and two client computers, and an 802.1X compliant switch that supports the use of RADIUS tunnel attributes to specify the 802.1X client VLAN. With this test network, you can create and enforce client health requirements using NAP and the 802.1X features on your switch.

 802.1X NAP Enforcement Step by Step Guide

Step By Step Guide: Demonstrate 802.1X NAP Enforcement in a Test Lab is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Ian Hameroff: Come Together, Right Now: IPsec and VPN Co-Existence
• What is ForeFront Client Security and how will it protect my enterprise from malware? (This looks like a very compelling product and NAP integration makes it look even better)
• Simplifying IPsec Policy with the Simple Policy Update (This has been around for a while, but a requirement for Domain/Server Isolation with IPSec simplification)
• Quarterly TechNet Briefing: NAP Overview Slides (.PPT, thanks Jeff)

The Short NAP: November 14th 2006 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.