NAP Client Configuration

Network Access Protection (NAP), a new feature in Windows Vista® and Windows Server® 2008, allows you to control the access of client computers to network resources based on computer identity and compliance with corporate governance policy. To implement NAP, you must configure NAP settings on both servers and client computers.

There are three tools that you can use to configure NAP client settings:

  • The NAP Client Configuration console provides a graphical user interface with which you can configure NAP client settings on the local computer or in a configuration file that you can save and apply to other computers.

  • The Netsh commands for NAP client provide a command-line tool that you can use to configure client computers or to create a configuration file that you can save and apply to other computers.

  • If you want to manage NAP client settings on domain member client computers, you can use the Group Policy Management Console and the Group Policy Management Editor. When you configure NAP client settings in Group Policy, these settings are applied on NAP-capable domain member client computers when Group Policy is refreshed.

Important

If you configure NAP client settings in Group Policy, the settings configured using the NAP client configuration console or the Netsh command-line tool will be ignored.

For an overview of managing client computers that are NAP-capable, see NAP Client Configuration Overview.

For a list of steps that guide you through the NAP client configuration process, see NAP Client Configuration Checklist.

To enable and disable NAP enforcement clients, see Configure NAP Enforcement Clients.

To specify branding text and graphics for the NAP user interface, see Configure the NAP Client User Interface.

To specify the Health Registration Authority (HRA) servers with which a client computer communicates and to specify the cryptographic mechanism that client computers use to communicate with HRA servers, see Configure Health Registration Settings.

To configure NAP tracing, see Configure NAP Tracing.

To create and manage configuration files that contain NAP settings, see Use NAP Client Configuration Files.


NAP Overview

Network Access Protection (NAP) is one of the most anticipated features of the Windows Server® 2008 operating system. NAP is a new platform that allows network administrators to define levels of network access based on a client’s identity, the groups to which the client belongs, and the degree to which the client complies with corporate governance policy. If a client is not compliant, NAP provides a mechanism for automatically bringing the client into compliance (a process known as remediation) and then dynamically increasing its level of network access. NAP is supported by Windows® 7, Windows Vista®, Windows® XP with Service Pack 3 (SP3), Windows Server 2008, and Windows Server® 2008 R2.

Note

On NAP client computers running Windows 7, NAP is integrated into Action Center. If a NAP client computer is determined to be noncompliant with network health polices, you can obtain more information by reviewing the Network Access Protection category under Security. NAP client computers that are compliant with health requirements and computers that are not running the NAP Agent service do not display NAP information in Action Center.

NAP also includes an application programming interface (API) that developers and vendors can use to integrate their products and leverage this health state validation, access enforcement, and ongoing compliance evaluation. For more information about the NAP API, see Network Access Protection (http://go.microsoft.com/fwlink/?LinkId=128423).


NAP Infrastructure

A Network Access Protection (NAP) infrastructure includes NAP client computers, NAP enforcement points, and NAP health policy servers. Optional components include remediation servers and health requirement servers.

NAP client computers

To access the network, a NAP client first collects information about its health from locally installed software called system health agents (SHAs). Each SHA installed on the client computer provides information about current settings or activity that it is designed to monitor. Information from SHAs is collected by the NAP Agent, which is a service running on the local computer. The NAP Agent service summarizes the health state of the computer and passes this information to one or more NAP enforcement clients. An enforcement client is software that interacts with NAP enforcement points to access or communicate on the network.

NAP enforcement points

A NAP enforcement point is a server or hardware device that provides a level of network access to the NAP client computer. Each NAP enforcement technology uses a different type of NAP enforcement point. See the following table.

NAP enforcement method | NAP enforcement point
Internet Protocol security (IPsec) | Health Registration Authority (HRA) and Network Policy Server (NPS)
802.1X | Switch (wired) or wireless access point (wireless)
VPN | RRAS
DHCP | DHCP and NPS
Remote Desktop Gateway (RD Gateway) | RD Gateway and NPS

When a NAP enforcement point is running Windows Server 2008 or Windows Server 2008 R2, it is referred to as a NAP enforcement server. All NAP enforcement servers must be running Windows Server 2008 or Windows Server 2008 R2. In NAP with 802.1X enforcement, the NAP enforcement point is an IEEE 802.1X-compliant switch or wireless access point. NAP enforcement servers for the IPsec, DHCP, and RD Gateway enforcement methods must also be running NPS configured either as a RADIUS proxy or as a NAP health policy server. NAP with VPN enforcement does not require that NPS is installed on the VPN server.

NAP health policy servers

A NAP health policy server is a computer running Windows Server 2008 or Windows Server 2008 R2 with the NPS role service installed and configured to evaluate the health of NAP client computers. All NAP enforcement technologies require at least one health policy server. A NAP health policy server uses policies and settings to evaluate network access requests that are submitted by NAP client computers.

NAP remediation servers

NAP remediation servers provide updates and services to noncompliant client computers. Depending on the design of your remediation network, a remediation server might also be accessible by compliant computers. Some examples of NAP remediation servers include:

  • Antivirus signature servers. If health policies require that computers must have a recent antivirus signature, noncompliant computers must have access to a server to provide these updates.

  • Windows Server Update Services. If health policies require that computers have recent security updates or other software updates, you might provide these by placing WSUS on your remediation network.

  • System Center component servers. System Center Configuration Manager management points, software update points, and distribution points host the software updates required to bring computers into compliance. When you deploy NAP with Configuration Manager, NAP-capable computers require access to computers running these site system roles in order to download their client policy, scan for software update compliance, and download required software updates.

  • Domain controllers. Noncompliant computers might require access to domain services on the noncompliant network for authentication purposes, to download policies from Group Policy, or to maintain domain profile settings.

  • DNS servers. Noncompliant computers must have access to DNS in order to resolve host names.

  • DHCP servers. Noncompliant computers must have access to a DHCP server if the client’s IP profile changes on the noncompliant network or if the DHCP lease expires.

  • Troubleshooting servers. When you configure a remediation server group, you have the option of providing a troubleshooting URL with instructions about how to bring computers into compliance with your health policies. You can provide a different URL for each network policy. These URLs must be accessible on the remediation network.

  • Other services. You might provide access to the Internet on your remediation network so that noncompliant computers can reach remediation services such as Windows Update and other Internet resources.

NAP health requirement servers

A health requirement server is a computer that provides health policy requirements and health evaluation information to one or more system health validators (SHVs). If the health status reported by NAP client computers can be validated by NPS without consulting another device, then a health requirement server is not required. For example, WSUS is not considered a health requirement server when used with Windows Security Health Validator (WSHV). Even though an administrator can use WSUS to specify which updates client computers must have, it is the client computer that reports whether it has installed these updates. In this scenario, WSUS is a remediation server, not a health requirement server.

A health requirement server is used if you deploy NAP with the Configuration Manager SHV. The Configuration Manager SHV contacts a global catalog server to validate the client’s health state by checking the health state reference that is published to Active Directory Domain Services (AD DS). Therefore, a domain controller is a health requirement server if you have deployed the Configuration Manager SHV. Other SHVs might also use health requirement servers.

Additional references

  • NAP Overview


NAP Health Policy Servers

A Network Access Protection (NAP) health policy server is a computer running Windows Server 2008 or Windows Server 2008 R2 with the Network Policy Server (NPS) role service installed and configured to evaluate the health of NAP client computers. All NAP enforcement technologies require at least one health policy server. A NAP health policy server uses policies and settings to evaluate network access requests that are submitted by NAP client computers. These policies and settings are defined in the following sections:

  • Connection Request Policies

  • Network Policies

  • Health Policies

  • System Health Validators

  • RADIUS Clients and Servers

  • Remediation Server Groups


Connection Request Policies

Connection request policies use conditions and settings to authenticate network access requests and govern where this authentication is performed. One connection request policy is required for each Network Access Protection (NAP) enforcement method that is deployed. When you select a network connection method using the NAP configuration wizard, connection request policies are configured with the required authentication settings automatically.

Additional references

  • NAP Health Policy Servers


Network Policies

Network policies use conditions, settings, and constraints to authorize a level of access for clients attempting to connect to a network. For Network Access Protection (NAP), you must configure at least one network policy that will be applied to computers that are compliant with the health requirements and at least one network policy that will be applied to computers that are noncompliant. You can also configure a network policy that will be applied to computers that are non-NAP-capable. You might configure additional network polices to specify unique health requirements for different computers or segments of the network.

Additional references

  • NAP Health Policy Servers


Health Policies

Health policies define which system health validators (SHVs) are evaluated, as well as how they are used to evaluate the health status of Network Access Protection (NAP) client computers. Based on the results of SHV checks, health policies classify client health status. When you create a health policy, you can enable one or more installed SHVs and select one of the following SHV checks.

You must select at least one SHV to use in a health policy. SHVs that are not selected in a health policy are not evaluated by the policy. The following types of SHV checks are available in a health policy:

  • Client passes all SHV checks. Use this setting to create a health policy that requires a client computer to meet the requirements of all enabled SHVs. This is the most restrictive setting that you can use to evaluate compliant computers.

  • Client fails all SHV checks. Use this setting to create a health policy that requires a client computer to fail to meet requirements of all enabled SHVs. This is the least restrictive setting that you can use to evaluate noncompliant computers.

  • Client passes one or more SHV checks. Use this setting to create a health policy that requires a client computer to meet the requirements of at least one enabled SHV. This is the least restrictive setting that you can use to evaluate compliant computers.

  • Client fails one or more SHV checks. Use this setting to create a health policy that requires a client computer to fail to meet requirements of at least one enabled SHV. This is the most restrictive setting that you can use to evaluate noncompliant computers.

  • Client reported as transitional by one or more SHVs. Use this setting to create a health policy for clients that report a status of transitional in extended state information. To use this setting, the SHV must support extended state reporting as part of the health evaluation process. A transitional state indicates that required services on the client are not ready to report health status. The transitional state can be temporary. For example, a client might report a status of transitional if services have been recently started.

  • Client reported as infected by one or more SHVs. Use this setting to create a health policy for clients that report a status of infected in extended state information. To use this setting, the SHV must support extended state reporting as part of the health evaluation process. This extended state information is used primarily by an antivirus system health agent (SHA) that is capable of reporting that the client is infected with malicious software (also called malware) that it cannot remove.

  • Client reported as unknown by one or more SHVs. Use this setting to create a health policy for clients that report a status of unknown in extended state information. To use this setting, the SHV must support extended state reporting as part of the health evaluation process. An unknown state indicates that the credentials of the end host cannot be determined. The unknown state can be temporary.

Although some SHVs check multiple settings on a client computer, an SHV check is an evaluation of the client computer against all requirements of the SHV. For example, the Windows Security Health Validator (WSHV) can check client computers for multiple software requirements and settings. A client computer might pass some of these checks, but it must meet all requirements of the SHV to pass the SHV check.

The Setting option under SHVs used in this health policy is new in Windows Server 2008 R2. If an SHV supports the storing of multiple configurations, you can use this setting to choose one of these configurations to use with your health policy. If an SHV does not support the storing of multiple configurations, you must configure settings in the Default Configuration.

Additional references

  • NAP Health Policy Servers


System Health Validators

When a NAP client computer is connected to the network, it is monitored to ensure it is current with health requirements. A Network Access Protection (NAP) client computer is able to monitor health status continuously by using software called system health agents (SHAs). Health requirements are defined on NAP servers using corresponding software called system health validators (SHVs). Many different types of SHA and SHVs are available.

Windows Security Health Validator

The Windows Security Health Validator (WSHV) is included with Windows Server 2008 and Windows Server 2008 R2. The WSHV evaluates the operational status of the following components on NAP client computers:

  • Firewall: If this requirement is enabled, the client computer must have a firewall that is registered with Windows Security Center and enabled for all network connections.

  • Virus Protection: If this requirement is enabled, the client computer must have an antivirus application installed, registered with Windows Security Center, and turned on. The client computer can also be checked to ensure that the antivirus signature file is up-to-date.

  • Spyware Protection: If this requirement is enabled, the client computer must have an antispyware application installed, registered with Windows Security Center, and turned on. The client computer can also be checked to ensure that the antispyware signature file is up-to-date. Spyware protection applies only to NAP clients running Windows Vista or Windows 7.

  • Automatic Updating: If this requirement is enabled, the client computer must be configured to check for updates from Windows Update. You can choose whether to download and install them.

  • Security Update Protection: If this requirement is enabled, the client computer must have security updates installed based on one of four possible values that match security severity ratings from the Microsoft Security Response Center (MSRC). The client must also check for these updates during a specified time interval. You can use Windows Server Update Services (WSUS), Windows Update, or both to obtain security updates.

Additional references

  • NAP Health Policy Servers

  • System Health Validator Settings

  • System Health Validator Error Codes


System Health Validator Settings

System health validator (SHV) settings allow you to configure the system health requirements for Network Access Protection (NAP) client computers. If an SHV is designed to work with a health requirement server, you might configure some or all SHV settings on this server. To configure SHV settings on Network Policy Server (NPS), click Configure in the SHV properties window to open the SHV configuration dialog box.

If an SHV supports the storing of multiple configurations, you can create additional SHV settings for use with your health policies.

Additional references

  • System Health Validator Error Codes


System Health Validator Error Codes

System health validator (SHV) error codes can be returned for an SHV when the associated system health agent (SHA) on a Network Access Protection (NAP) client computer requests access to the network. If an error code is returned, you can choose whether to evaluate the NAP client computer as compliant or noncompliant with health requirements. By default, all error codes are set to noncompliant.

The following is a description of available error codes:

  • SHV unable to contact required services. This error can occur if Network Policy Server (NPS) loses connectivity to a health requirement server, such as an antivirus signature server.

  • SHA unable to contact required services. This error can occur if the SHA is unable to successfully read the client configuration.

  • SHA not responding to NAP Client. This error can occur if an SHA is not properly initialized and registered.

  • SHV not responding. This error can occur if the performance of an SHV is degraded (for example, if NPS is out of memory).

  • Vendor specific error code received. This error can occur if NPS receives an error code that is unique to the SHA or SHV vendor. Some vendors might return this code when NPS is unable to contact a health requirement server.

Additional references

  • System Health Validator Settings


RADIUS Clients and Servers

RADIUS clients are network access servers or devices. If you specify a RADIUS client in Network Policy Server (NPS), then the corresponding RADIUS server configuration is required on the RADIUS client device. For example, remote Health Registration Authority (HRA) servers are configured as RADIUS clients on NPS.

If the Network Access Protection (NAP) enforcement server is located on the same server as the NAP health policy server, then you do not need to configure RADIUS clients.

Additional references

  • NAP Infrastructure

  • NAP Health Policy Servers


Remediation Server Groups

Remediation server groups are used to specify servers that are available to noncompliant Network Access Protection (NAP) clients for the purpose of remediating their health state to comply with health requirements. The type of remediation servers that are required depend on your health requirements and network access methods.

Remediation servers do not only provide updates to noncompliant computers. They can also provide network services that noncompliant computers require in order to update their health, or to perform a limited set of tasks while they are in a restricted status. For example, a remediation server might provide DHCP services to computers that have been placed on a noncompliant VLAN. Remediation servers might also host Web sites that provide instructions users can follow to make their computers compliant.

Remediation servers can be accessible to both compliant and noncompliant computers or to noncompliant computers only. The methods for providing access to remediation servers depend on the NAP enforcement method.

IPsec enforcement

In an Internet Protocol security (IPsec) enforcement design, remediation servers should be placed in the IPsec logical boundary network. You must issue NAP exemption certificates to remediation servers and configure IPsec policy so that they can freely communicate with noncompliant computers. Placing remediation servers in a remediation servers group in the NPS console has no effect on access to these servers when you use NAP with IPsec enforcement.

802.1X enforcement

In an 802.1X enforcement design, the placement of remediation servers depends on whether virtual LANS (VLANs) or access control lists (ACLs) are used to restrict the network access of noncompliant clients. NAP enforcement points might support both or only one of these methods.

  • 802.1X enforcement with VLANs. Remediation servers must be placed on the noncompliant VLAN or access must be provided through inter-VLAN routing methods. If remediation servers must also be accessible to compliant NAP client computers, the remediation server is placed on a trunking port or dual-homed to provide access to multiple VLANs.

  • 802.1X enforcement with ACLs. Access of noncompliant computers is restricted to the IP addresses and service port numbers of remediation servers only.

Placing remediation servers in a remediation servers group in the NPS console has no effect on access to these servers when you use NAP with 802.1X enforcement.

VPN enforcement

In a VPN enforcement design, two methods are available for providing access to remediation servers: remediation server groups and IP filters. Both of these methods can be used to provide noncompliant NAP clients with access to remediation servers. When you configure a remediation server group, noncompliant NAP client computers are automatically granted access to the IP address of each server in the list. IP filters have the added advantage of allowing you to specify that access is granted only to a specified service port number.

Important

If no remediation server groups or IP filters are configured in noncompliant network policy for VPN enforcement, full network access is granted to noncompliant NAP client computers.

DHCP enforcement

In a DHCP enforcement design, noncompliant NAP client computers are provided with classless static host routes to each member device that is configured in a remediation servers group using the NPS console. If remediation servers are located on a subnet different from the subnet on which NAP clients appear, the DHCP server uses the 003 Router option from the default NAP class to provide noncompliant computers with static host routes to remediation servers. The routing device configured in this scope option must be capable of forwarding requests from noncompliant NAP clients to the remediation server. You can also configure classless static host routes to remediation servers by using scope option 121 in the default NAP class.

RD Gateway enforcement

NAP with Remote Desktop Gateway (RD Gateway) enforcement does not support the use of remediation server groups. If remediation servers are required, they must be made available to client computers before connecting to the RD Gateway enforcement server.

Additional references

  • NAP Health Policy Servers


NAP Client Configuration Overview

Before you can use Network Access Protection (NAP) to enforce health policies on client computers, you need to configure NAP settings on your client computers. The NAP Client Configuration console and NAP client configuration settings in the Group Policy Management Console provide a graphical user interface for configuring NAP client settings.

Why do I need to manage NAP settings on client computers?

NAP relies on both server and client components. To make the server components and client components work together, you must configure NAP settings on both the servers and the client computers.

The server components are responsible for validating the health of client computers and specifying which network resources are available to client computers.

The client components are responsible for compiling health status statements on client computers, maintaining a client computer's health state, and communicating a client computer's health state to the server components.

The NAP Client Configuration console helps you configure NAP user interface settings, NAP enforcement client settings, and Health Registration Authority (HRA) settings on your client computers. A NAP enforcement client is responsible for enforcing network access restrictions.

For most NAP scenarios, you need to configure NAP enforcement client settings only. Configuration of interface settings is optional, and you do not need to configure NAP health registration authority settings unless you deploy Internet Protocol security (IPsec)-based enforcement. By default, the built-in NAP enforcement clients are disabled. To enforce health policies on a client computer, you must enable at least one NAP enforcement client.

What can I do with NAP Client Configuration?

You can use the NAP Client Configuration console to perform the following tasks on your client computers:

  • Enable and disable NAP enforcement clients, including the built-in NAP enforcement clients that are provided with the NAP platform and any non-Microsoft NAP enforcement clients.

  • Configure branding text and graphics for the NAP user interface that appears on client computers.

  • Specify with which HRA servers you want client computers to communicate.

  • Specify the cryptographic mechanism that you want client computers to use when communicating with HRA servers.

In addition, you can use NAP Client Configuration to enable and disable NAP tracing, specify the level of detail you want to capture in a tracing log file, and import and export NAP client settings using an .xml-based configuration file.

When should I use NAP Client Configuration?

NAP Client Configuration is one of three tools you can use to configure NAP settings on your client computers. In addition to NAP Client Configuration, you can configure NAP settings on local client computers by using the Netsh commands for NAP client, or you can use the Group Policy Management Console (GPMC) to configure the NAP Client Configuration Group Policy settings. When you configure NAP client settings in Group Policy, these settings are automatically configured on NAP-capable domain member client computers when Group Policy is refreshed.

Important

If you configure NAP client settings in Group Policy, any settings that are configured using the Netsh command-line tool for NAP client or the NAP Client Configuration Console will be ignored.

You should use NAP Client Configuration on a local computer when any of the following are true:

  • You want to use a graphical user interface to configure NAP settings on a local computer instead of using the Netsh commands for NAP client.

  • Your organization uses Group Policy to manage domain member client computers and you want to create an .xml configuration file that you can use to configure the NAP Group Policy settings.

  • You have a small number of computers that require custom configuration settings and you want to configure each computer individually.

  • You want to configure all of your client computers in exactly the same way, but you cannot automate or manage the configuration process by using scripts or Group Policy.

You should use NAP Client Configuration through Group Policy when your organization uses Group Policy to manage client computers and you want NAP Group Policy settings applied to client computers when Group Policy settings are applied.

NAP Client Configuration can be used to configure NAP-capable computers only. A computer is NAP-capable if it has the NAP components installed and it can verify its health by creating a statement of health (SoH). Computers running Windows® 7, Windows Vista®, Windows XP Service Pack 3 (SP3), Windows Server® 2008, and Windows Server® 2008 R2 are NAP-capable. You cannot use NAP Client Configuration to manage computers that are not NAP-capable.

Note

You cannot use NAP Client Configuration to configure NAP settings on a remote computer. NAP Client Configuration can be used only to configure NAP settings on a local computer or to create an .xml configuration file on a local computer.

Additional references

  • Use NAP Client Configuration Files

  • Configure NAP Enforcement Clients

  • Configure the NAP Client User Interface

  • Configure Health Registration Settings

  • Configure NAP Tracing


NAP Client Configuration Checklist

Use the following checklist to help ensure that you correctly configure Network Access Protection (NAP) settings on client computers.

Step | Reference
Review NAP client configuration concepts. (Optional) | NAP Client Configuration Overview
Determine whether you want to import a configuration file. (Optional) | Import NAP Client Configuration Settings
Enable one or more NAP enforcement clients. (Required) | Configure NAP Enforcement Clients
Specify branding text and graphics for the NAP user interface. (Optional) | Configure NAP Client Request Policy
Specify the Health Registration Authority (HRA) servers with which a client computer will communicate. (Optional) | Configure Trusted Server Groups for NAP Clients
Specify the cryptographic mechanism that client computers use to communicate with HRA servers. (Optional) | Configure NAP Client Request Policy
Configure NAP tracing and the level of detail you want to record in a tracing log file. (Optional) | Configure NAP Tracing
Determine whether you want to save NAP settings to a configuration file. (Optional) | Export NAP Client Configuration Settings


Use NAP Client Configuration Files

You can use the NAP Client Configuration console to import NAP client settings from an *.xml format configuration file or to export NAP client settings to an *.xml format configuration file. This allows you to create a configuration file on one computer and then import the configuration to multiple computers, reducing the administrative overhead of manually configuring every computer.

You can also use a configuration file to configure Network Access Protection (NAP) Group Policy settings by importing an existing configuration file into the NAP Client Configuration Group Policy extension. The NAP Client Configuration Group Policy extension is located within the Group Policy Management Console. If you configure NAP client settings in Group Policy, these settings are applied to all NAP-capable domain member computers when Group Policy is applied.

When to perform this task

You should export your settings to a configuration file when:

  • You want to apply the same NAP settings to multiple computers using the NAP Client Configuration console.

  • You want to configure NAP Group Policy settings by importing the configuration file into the Group Policy Management Console.

To complete this task, perform the following procedures:

Export NAP Client Configuration Settings

Import NAP Client Configuration Settings

Additional references

  • NAP Client Configuration Overview

  • NAP Client Configuration Checklist


Export NAP Client Configuration Settings

Exporting settings to a configuration file

  • Using the Windows interface

  • Using a command line

To export settings to a configuration file by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Right-click NAP Client Configuration, and then click Export.

  3. In the Export NAP Configuration dialog box, in Save in, click the location where you want to save the file.

  4. In File name, type a file name for the configuration file.

  5. Click Save.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To export settings to a configuration file by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client export filename = <filename>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<filename> | Any string. | The path and file name for the configuration file.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Import NAP Client Configuration Settings

  • Command-line syntax notation


Import NAP Client Configuration Settings

Importing settings from a configuration file

  • Using the Windows interface

  • Using a command line

To import settings from a configuration file by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Right-click NAP Client Management, and then click Import.

  3. In the Import NAP Configuration dialog box, in Look in, click the location where the configuration file is stored.

  4. In File name, type the file name for the configuration file.

  5. Click Open.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To import settings from a configuration file by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client import filename = <filename>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<filename> | Any string. | The path and file name for the configuration file.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Export NAP Client Configuration Settings

  • Command-line syntax notation


Configure NAP Enforcement Clients

You can use the Network Access Protection (NAP) Client Configuration console, NAP client configuration settings in Group Policy, or Netsh commands for NAP client configuration to enable and disable NAP enforcement clients. A NAP enforcement client is responsible for requesting access to a network, communicating a client computer's health status to the NAP server that is authorizing the network access, and communicating the connection status of the client computer to other components of the NAP client architecture.

There are six available enforcement clients corresponding to the following network access mechanisms:

Enforcement client | Description
Dynamic Host Configuration Protocol (DHCP) | Enforces health policies when a client computer attempts to obtain an IP address from a NAP-enabled DHCP server.
Internet Protocol security (IPsec) | Enforces health policies when a client computer attempts to communicate with another computer using IPsec.
Remote Desktop Gateway (RD Gateway) | Enforces health policies on a computer attempting to access a remote desktop gateway.
Extensible Authentication Protocol (EAP) | Enforces health policies when a client computer attempts to access a network through an EAP-authenticated network connection, such as 802.1X wired and wireless connections. If the client computer is running Windows® 7, the EAP enforcement client is also used for virtual private network (VPN) connections.
Remote access | Enforces health policies when a client computer running Windows Vista® or Windows XP with Service Pack 3 (SP3) attempts to gain access to the network through a NAP-enabled VPN server.
Wireless EAP over LAN (EAPOL) | Enforces health policies when a client computer running Windows XP SP3 attempts to access a network through an 802.1X-authenticated wireless connection network connection.

When to perform this task

To deploy NAP in your organization, you must enable at least one NAP enforcement client on client computers. You might also need to enable additional enforcement clients as your network health requirements change and you want to enforce health policies through other network access mechanisms.

You might need to disable enforcement clients when you are troubleshooting network access problems or when your health requirements change and you want to enforce health policies by using other enforcement clients.

To complete this task, perform the following procedures:

Enable and Disable the DHCP Enforcement Client

Enable and Disable the IPsec Enforcement Client

Enable and Disable the RD Gateway Enforcement Client

Enable and Disable the EAP Enforcement Client

Enable and Disable the Remote Access Enforcement Client

Enable and Disable the Wireless EAPOL Enforcement Client

Additional references

  • NAP Client Configuration Overview

  • NAP Client Configuration Checklist


Enable and Disable the DHCP Enforcement Client

Enabling and disabling the DHCP enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the DHCP enforcement client by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Click Enforcement Clients.

  3. Right-click DHCP Enforcement Client, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable and disable the DHCP enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. To enable or disable the DHCP enforcement client, do one of the following:

    1. To enable the DHCP enforcement client, type: netsh nap client set enforcement ID = 79617 ADMIN = "ENABLE"

    2. To disable the DHCP enforcement client, type: netsh nap client set enforcement ID = 79617 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure NAP Enforcement Clients


Enable and Disable the IPsec Enforcement Client

Enabling and disabling the IPsec enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the IPsec enforcement client by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Click Enforcement Clients.

  3. Right-click IPsec Relying Party, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • You must have Internet Protocol security (IPsec) policies and domain isolation deployed in your organization to enforce network access restriction with the IPsec enforcement client.

To enable and disable the IPsec enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. To enable or disable the IPsec enforcement client, do one of the following:

    1. To enable the IPsec enforcement client, type: netsh nap client set enforcement ID = 79619 ADMIN = "ENABLE"

    2. To disable the IPsec enforcement client, type: netsh nap client set enforcement ID = 79619 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • You must have IPsec policies and domain isolation deployed in your organization to enforce network access restriction with the IPsec enforcement client.

Additional references

  • Configure NAP Enforcement Clients


Enable and Disable the RD Gateway Enforcement Client

Enabling and disabling the RD Gateway enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the RD Gateway enforcement client by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Click Enforcement Clients.

  3. Right-click RD Gateway Quarantine Enforcement Client, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable or disable the RD Gateway enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. To enable or disable the RD Gateway enforcement client, do one of the following:

    1. To enable the RD Gateway enforcement client, type: netsh nap client set enforcement ID = 79621 ADMIN = "ENABLE"

    2. To disable the RD Gateway enforcement client, type: netsh nap client set enforcement ID = 79621 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure NAP Enforcement Clients


Enable and Disable the EAP Enforcement Client

Enabling and disabling the EAP enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the EAP enforcement client by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Click Enforcement Clients.

  3. Right-click EAP Quarantine Enforcement Client, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable and disable the EAP enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. To enable or disable the EAP enforcement client, do one of the following:

    1. To enable the EAP enforcement client, type: netsh nap client set enforcement ID = 79623 ADMIN = "ENABLE"

    2. To disable the EAP enforcement client, type: netsh nap client set enforcement ID = 79623 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure NAP Enforcement Clients


Enable and Disable the Remote Access Enforcement Client

Enabling and disabling the remote access enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the remote access enforcement client by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Click Enforcement Clients.

  3. Right-click Remote Access Quarantine Enforcement Client, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable or disable the remote access enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. To enable or disable the remote access enforcement client, do one of the following:

    1. To enable the remote access enforcement client, type: netsh nap client set enforcement ID = 79618 ADMIN = "ENABLE"

    2. To disable the remote access enforcement client, type: netsh nap client set enforcement ID = 79618 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure NAP Enforcement Clients


Enable and Disable the Wireless EAPOL Enforcement Client

Enabling and disabling the wireless EAPOL enforcement client

  • Using a command line

Note

The wireless EAPOL enforcement client is only available on NAP client computers running Windows XP with Service Pack 3 (SP3). To enable the wireless EAPOL enforcement client, you must use Group Policy or a command line.

To enable or disable the wireless EAPOL enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. To enable or disable the wireless EAPOL enforcement client, do one of the following:

    1. To enable the wireless EAPOL enforcement client, type: netsh nap client set enforcement ID = 79620 ADMIN = "ENABLE"

    2. To disable the wireless EAPOL enforcement client, type: netsh nap client set enforcement ID = 79620 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure NAP Enforcement Clients


Configure the NAP Client User Interface

You can use the NAP Client Configuration console to configure the NAP Status user interface that appears on a client computer. The NAP Status user interface consists of one dialog box and provides information about the system health agents (SHAs) that are enabled on the computer, network enforcement status, and remediation status.

By default, the NAP dialog box contains no branding information. Adding branding information is optional.

You should customize the user interface when:

  • You want users to have a clear understanding that their network access is being controlled by your organization.

  • You want to provide your users with contact information for your IT department so that they can get assistance when a computer has limited network access.

You can customize the following optional user interface elements:

Element | Details
Title | Appears as a banner at the top of the NAP Status dialog box and is usually the name of your organization or the name of your organization's IT department.
Description | Appears under the title and is usually the slogan for your organization or your organization's IT department. The description can also contain contact information for your organization's Help desk or IT department.
Image | Appears next to the title and is usually the logo for your organization or IT department. The image you specify must be one of the following file types: .jpg, .bmp, .png, or .gif. The maximum file size allowed is 1.0 megabyte (MB) and the image dimensions must be 64 × 64 pixels or smaller in size. Large images are not resized.
Important

If your server has a Language Interface Pack (LIP) installed, you must also install this LIP on NAP client computers. NAP client computers that do not have the same LIP installed will not display custom title and description text.

Additional references

  • Specify Title Text for the NAP Client User Interface

  • Specify Description Text for the NAP Client User Interface

  • Specify an Image for the NAP Client User Interface

  • NAP Client Configuration Overview

  • NAP Client Configuration Checklist


Specify Title Text for the NAP Client User Interface

Specifying title text for the NAP client user interface

  • Using the Windows interface

  • Using a command line

To specify title text for the NAP client user interface by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Click User Interface Settings.

  3. Right-click User Interface, and then click Properties.

  4. In the User Interface Properties dialog box, in Title, type the title text that you want to appear in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To specify title text for the NAP client user interface by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client set userinterface title = <title>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<title> | Any string. | The title that you want to display in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure the NAP Client User Interface

  • Command-line syntax notation


Specify Description Text for the NAP Client User Interface

Specifying description text for the NAP client user interface

  • Using the Windows interface

  • Using a command line

To specify the description text for the NAP client user interface by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Click User Interface Settings.

  3. Right-click UI Settings, and then click Properties.

  4. In the UI Settings Properties dialog box, in Description, type the description text that you want to appear in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To specify the description text for the NAP client user interface by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client set userinterface text = <text>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<text> | Any string. | The description that you want to display in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure the NAP Client User Interface

  • Command-line syntax notation


Specify an Image for the NAP Client User Interface

Specifying an image for the NAP client user interface

  • Using the Windows interface

  • Using a command line

To specify an image for the NAP client user interface by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Click User Interface Settings.

  3. Right-click UI Settings, and then click Properties.

  4. In the UI Settings Properties dialog box, click Browse, and then select the image that you want to appear in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To specify an image for the NAP client user interface by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client set userinterface image = <image>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<image> | The path to an image that is saved in one of the following file formats: .jpg, .bmp, .png, or .gif. | The image that you want to display in the NAP client user interface.
Note

To concurrently specify the NAP client user interface title, description, and image, type: netsh nap client set userinterface title = <title> text = <text> image = <image>

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure the NAP Client User Interface

  • Command-line syntax notation


Configure Health Registration Settings

You can use the NAP Client Configuration console to specify the security mechanisms that a client computer uses to communicate with Health Registration Authority (HRA) servers. In addition, you can use the NAP Client Configuration console to specify the HRA servers with which a client computer can communicate. A client computer must communicate with an HRA server to obtain a health certificate. A health certificate is required for NAP with Internet Protocol security (IPsec)-based enforcement.

To specify which security mechanism a client uses to communicate with an HRA server, you must configure the request policy. The request policy specifies the asymmetric key algorithm, hash algorithm, and cryptographic service provider a client computer uses when it initiates communication with an HRA server. You can specify only one asymmetric key algorithm, hash algorithm, and cryptographic service provider on a client computer.

When you configure an asymmetric key algorithm, hash algorithm, or cryptographic service provider on the client, you must configure exactly the same request policy on the HRA server. For example, if you configure your clients to encrypt communication using only the Rivest-Shamir-Adelman (RSA) asymmetric key algorithm with a minimum key length of 128, then you must configure your HRA servers to accept communication that is encrypted with exactly the same asymmetric key algorithm and exactly the same minimum key length. If your HRA servers and client computers are not configured to use the same request policy, then your HRA servers will not be able to communicate with your client computers; your client computers might be determined to be noncompliant and their network connectivity might be limited. If you do not configure request policy settings on a client computer, the client computer initiates a negotiation process with the HRA server using the default security mechanism for encrypting communication.

Important

You should not modify request policy settings unless you have thoroughly tested your request policy settings in a secure test environment. Altering request policy settings can cause your client computers to lose network connectivity.

To specify which HRA servers you want a client computer to communicate with, you must configure a trusted server group. A trusted server group consists of one or more HRA servers. If you have more than one HRA server in a trusted server group, you can specify the order in which client computers attempt to contact the servers. This is useful if you have several HRA servers in different network segments or domains and you want to prioritize which servers a client attempts to access first. You must configure at least one trusted server group; otherwise, a client computer will not know how to contact an HRA server to obtain a certificate of health.

Configure NAP Client Request Policy

Configure Trusted Server Groups for NAP Clients

Additional references

  • NAP Client Configuration Overview

  • NAP Client Configuration Checklist


Configure NAP Client Request Policy

You can use the NAP Client Configuration console to specify the security mechanisms a client computer uses to communicate with Health Registration Authority (HRA) servers. These settings, known as request policy settings, determine which hash algorithm and cryptographic service provider (CSP) a client computer uses to encrypt communication with HRA servers. You can only specify one hash algorithm and CSP on a client computer. When specified, the client computer will use only that security mechanism to communicate with HRA servers.

You do not need to configure request policy settings on your client computers. By default, a NAP-capable client computer initiates a negotiation process with an HRA server using a mutually acceptable default security mechanism for encrypting communication. It is recommended that you use the default request policy settings.

Important

You should not modify request policy settings unless you have thoroughly tested your request policy settings in a secure test environment. Altering request policy settings can cause your client computers to lose network connectivity.

If you configure request policy settings on your client computers, you must configure identical request policy settings on your HRA servers. If your HRA servers are not configured to use exactly the same hash algorithm and CSP as your client computers, then your HRA servers will not be able to communicate with client computers and client computers might be deemed unhealthy, resulting in limited network connectivity.

Specify a Hash Algorithm

Specify a Cryptographic Service Provider

Additional references

Configure Health Registration Settings


Specify a Hash Algorithm

Specifying a hash algorithm

  • Using the Windows interface

  • Using a command line

To specify a hash algorithm by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Open Health Registration Settings, and click Request Policy.

  3. Right-click Hash Algorithm, and then click Properties.

  4. In the Hash Algorithm Properties dialog box, click Specific, and then click the hash algorithm you want to use.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • If you configure request policy settings on your client computers, you must configure identical request policy settings on your Health Registration Authority (HRA) servers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash algorithm, and cryptographic service provider as your client computers, then your HRA servers will not be able to communicate with your client computers. Your client computers might be determined to be noncompliant and their network connectivity might be limited.

To specify a hash algorithm by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type the following to obtain a list of the hash algorithms that are supported on the client computer: netsh nap client show hashes

  3. Type: netsh nap client set hash oid = <oid>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<oid> | The object identifier (OID) of any supported hash algorithm. | The object identifier of the hash algorithm you want to use to encrypt communication between a client computer and an HRA server. The default is 1.3.14.3.2.29 (sha1RSA).

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • If you configure request policy settings on your client computers, you must configure identical request policy settings on your HRA servers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash algorithm, and cryptographic service provider as your client computers, then your HRA servers will not be able to communicate with your client computers. Your client computers might be determined to be noncompliant and their network connectivity might be limited.

Additional references

  • Configure NAP Client Request Policy

  • Configure Health Registration Settings


Specify a Cryptographic Service Provider

Specifying a cryptographic service provider

  • Using the Windows interface

  • Using a command line

To specify a cryptographic service provider by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Open Health Registration Settings, and click Request Policy.

  3. Right-click Cryptographic Service Provider, and then click Properties.

  4. In the Cryptographic Service Provider Properties dialog box, click Specific, and then click the cryptographic service provider you want to use.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • If you configure request policy settings on your client computers, you must configure identical request policy settings on your Health Registration Authority (HRA) servers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash key algorithm, and cryptographic service provider as your client computers, then your HRA servers will not be able to communicate with your client computers. Your client computers might be determined to be noncompliant and their network connectivity might be limited.

To specify a cryptographic service provider by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type the following to obtain a list of the cryptographic service providers that are supported on the client computer: netsh nap client show csps

  3. Type: netsh nap client set csp name = <name> keylength = <keylength>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<name> | Any supported cryptographic service provider. | The name of the cryptographic service provider you want to use to encrypt communication between a client computer and an HRA server.
<keylength> | Any integer. (Optional) | Specifies the length of the asymmetric key. The default is 2048.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • If you configure request policy settings on your client computers, you must configure identical request policy settings on your HRA servers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash key algorithm, and cryptographic service provider as your client computers, then your HRA servers will not be able to communicate with your client computers. Your client computers might be determined to be noncompliant and their network connectivity might be limited.

Additional references

  • Configure NAP Client Request Policy

  • Configure Health Registration Settings


Configure Trusted Server Groups for NAP Clients

You can use the NAP Client Configuration console to specify the Health Registration Authority (HRA) servers that a client computer uses to obtain a health certificate. To do this, you must create a trusted server group, which is an ordered list of one or more HRA servers. If there is more than one HRA server listed in a trusted server group, a client computer attempts to contact each HRA server in the order specified until an available server is found.

You must configure a trusted server group only if you are using the Internet Protocol security (IPsec) enforcement client to enforce health policies. The IPsec enforcement client relies on health certificates and HRA servers to enforce health policies. If you are not using the IPsec enforcement client, you do not need to configure trusted server groups.

Create a Trusted Server Group

Delete a Trusted Server Group

Add an HRA Server to a Trusted Server Group

Remove an HRA Server from a Trusted Server Group

Change the Name of a Trusted Server Group

Change the Order of the HRA Servers in a Trusted Server Group

Change the URL of an HRA Server in a Trusted Server Group

Additional references

  • Configure Health Registration Settings


Create a Trusted Server Group

Creating a trusted server group

  • Using the Windows interface

  • Using a command line

To create a trusted server group by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Double-click Health Registration Settings.

  3. Right-click Trusted Server Groups, and then click New.

  4. On the Group Name page of the New Trusted Server Group wizard, type the name of the new trusted server group, and then click Next.

  5. On the Add Servers page, type the URL of an HRA server you want to add to the trusted server group, and then click Add. If your HRA server does not use server verification, then you must clear the Require server verification (https:) for all servers in this group check box before clicking Add.

  6. Repeat step 5 until you have added all of the HRA servers to the trusted server group.

  7. Click Next to review the group name and the URLs of trusted servers, and then click Finish.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To create a trusted server group by using the command prompt

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client add trustedservergroup name = <group> requirehttps = <requirehttps>

  3. Type: netsh nap client add server group = <group> url = <url> processingorder = <processingorder>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are creating.
<requirehttps> | ENABLE, DISABLE (Optional) | If set to DISABLE, then server verification (HTTPS) is not required. If no value is entered or requirehttps is set to ENABLE, then HTTPS is required.
<url> | Any valid URL, UNC path, or IP address. If requirehttps is set to ENABLED, the URL must use the https:// prefix. (Required) | The URL of the HRA server that you want to add to the trusted server group. To add multiple URLs, reuse the same server group name.
<processingorder> | Any integer less than or equal to the total number of trusted server groups. Cannot be zero (0). (Optional) | The processing priority to assign to this trusted server group.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure Trusted Server Groups for NAP Clients


Delete a Trusted Server Group

Deleting a trusted server group

  • Using the Windows interface

  • Using a command line

To delete a trusted server group by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, right-click the name of your trusted server group, and then click Delete.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To delete a trusted server group by using the command prompt

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client delete trustedservergroup name = <name>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<name> | Any text string. (Required) | The name of the trusted server group that you are deleting.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure Trusted Server Groups for NAP Clients


Add an HRA Server to a Trusted Server Group

Adding an HRA server to a trusted server group

  • Using the Windows interface

  • Using a command line

To add an HRA server to a trusted server group by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, double-click the name of your trusted server group.

  4. In the Trusted Server Group Properties dialog box, type the URL of a trusted server that you want to add, click Add, and then click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To add an HRA server to a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client add server group = <group> url = <url> processingorder = <processingorder>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are modifying.
<url> | Any valid URL, UNC path, or IP address. (Required) | The HRA server that you want to add to the trusted server group.
<processingorder> | Any integer. Cannot be zero (0). (Optional) | The processing priority to assign to this HRA server.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure Trusted Server Groups for NAP Clients


Remove an HRA Server from a Trusted Server Group

Removing an HRA server from a trusted server group

  • Using the Windows interface

  • Using a command line

To remove an HRA server from a trusted server group by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, double-click the name of your trusted server group.

  4. In the Trusted Server Group Properties dialog box, click the URL of a trusted server that you want to remove, and then click Remove.

  5. Click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To remove an HRA server from a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client delete server group = <group> url = <url>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are changing.
<url> | Any text string. (Required) | The URL of the HRA server that you want to remove from the trusted server group.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure Trusted Server Groups for NAP Clients


Change the Name of a Trusted Server Group

Changing the name of a trusted server group

  • Using the Windows interface

  • Using a command line

To change the name of a trusted server group by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, right-click the name of your trusted server group, and then click Rename.

  4. Type the name of the trusted server group, and then press ENTER.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To change the name of a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client rename trustedservergroup name = <name> newname = <newname>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<name> | Any text string. (Required) | The name of the trusted server group that you are changing.
<newname> | Any text string. (Required) | The new name of the trusted server group.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure Trusted Server Groups for NAP Clients


Change the Order of the HRA Servers in a Trusted Server Group

Changing the order of the HRA servers in a trusted server group

  • Using the Windows interface

  • Using a command line

To change the order of the HRA servers in a trusted server group by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, double-click the name of your trusted server group.

  4. In the Trusted Server Group Properties dialog box, click the URL of a trusted server that you want to move up or down in the list, and then click Move Up or Move Down.

  5. Click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To change the order of the HRA servers in a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client set server group = <group> url = <url> processingorder = <processingorder>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are modifying.
<url> | Any valid URL, UNC path, or IP address. (Required) | The URL of the HRA server that you want to move up or down in the trusted server group.
<processingorder> | Any integer. Cannot be zero (0). (Required) | The processing priority to assign to this HRA server.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure Trusted Server Groups for NAP Clients


Change the URL of an HRA Server in a Trusted Server Group

Changing the URL of an HRA server in a trusted server group

  • Using the Windows interface

  • Using a command line

To change the URL of an HRA server in a trusted server group by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, double-click the name of your trusted server group.

  4. In the Trusted Server Group Properties dialog box, click the URL of a trusted server that you want to change, and then click Edit.

  5. In the Edit URL dialog box, type the URL of the trusted server, and then click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To change the URL of an HRA server in a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. Type: netsh nap client rename server group = <group> url = <url> newurl = <newurl>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are modifying.
<url> | Any text string. (Required) | The URL of the HRA server that you want to change.
<newurl> | Any text string. (Required) | The new URL of the HRA server.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure Trusted Server Groups for NAP Clients


Configure NAP Tracing

You can use the NAP Client Configuration console to configure Network Access Protection (NAP) tracing. Tracing records NAP events in a log file and is useful for troubleshooting and maintenance. You can also use tracing logs to evaluate the health and security of your network. You can configure three levels of tracing: Basic, Advanced, and Debug.

By default, NAP tracing is disabled, which means that no NAP events are recorded in the NAP tracing log files.

When to perform this task

You should enable NAP tracing when:

  • You are troubleshooting NAP problems.

  • You want to evaluate the overall health and security of the computers in your organization.

To complete this task, perform the following procedures:

Enable and Disable NAP Tracing

Specify Level of Detail in the NAP Tracing Log

Additional references

  • NAP Client Configuration

  • NAP Client Configuration Checklist


Enable and Disable NAP Tracing

Enabling and disabling NAP tracing

  • Using the Windows interface

  • Using a command line

To enable or disable NAP tracing by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Right-click NAP Client Configuration(Local Computer), and then click Properties.

  3. In the NAP Client Configuration(Local Computer) Properties dialog box, select Enabled or Disabled.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable or disable NAP tracing by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. To enable or disable NAP tracing, do one of the following:

    1. To enable NAP tracing, type: netsh nap client set tracing state = enable

    2. To disable NAP tracing, type: netsh nap client set tracing state = disable

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure NAP Tracing


Specify Level of Detail in the NAP Tracing Log

Specifying the detail that is recorded in the NAP trace log

  • Using the Windows interface

  • Using a command line

To specify the detail that is recorded in the NAP trace log by using the Windows interface

  1. To open the NAP Client Configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and then click OK.

  2. Right-click NAP Client Configuration(Local Computer), and then click Properties.

  3. In the NAP Client Configuration(Local Computer) Properties dialog box, confirm that Enabled is selected.

  4. Under Specify the level of detail at which the tracing logs are written, select Basic, Advanced, or Debug.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To specify the detail that is recorded in the NAP trace log by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.

  2. To configure NAP tracing, do one of the following:

    1. To configure NAP tracing so that basic information is recorded, type: netsh nap client set tracing state = enable level = basic

    2. To configure NAP tracing so that advanced information is recorded, type: netsh nap client set tracing state = enable level = advanced

    3. To configure NAP tracing so that debug information is recorded, type: netsh nap client set tracing state = enable level = verbose

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Configure NAP Tracing


Command-line syntax notation

The following table describes the notation used to indicate command-line syntax.

Notation | Description
Text without brackets or braces | Items you must type as shown
<Text inside angle brackets> | Placeholder for which you must supply a value
[Text inside square brackets] | Optional items
{Text inside braces} | Set of required items; choose one
Vertical bar (|) | Separator for mutually exclusive items; choose one
Ellipsis (…) | Items that can be repeated