topic Re: Global Protect Limitations in General Topics

Global Protect Limitations

rrau — Thu, 07 Apr 2016 21:06:00 GMT

Is there a way to stop disabled AD computer accounts from connecting to GP? We have a HIP profile attached to the GP rules which force the user to be compliant (ie. member of domain and have AntiVirus). however, when we disable their computer account, they are still able to connect. We can stop them from connecting by removing their user account from the allowed AD group however, we dont disable user accounts as much as we do computer accts.

Re: Global Protect Limitations

Raido_Rattameister — Thu, 07 Apr 2016 21:37:46 GMT

You authenticate based on user credentials?

Maybe you add second factor - computer certificate that you roll out from AD.

Re: Global Protect Limitations

rrau — Fri, 08 Apr 2016 13:29:11 GMT

Yes, we authenticate based on user creds.

maybe we could user certs..hmmm

Re: Global Protect Limitations

Raido_Rattameister — Fri, 08 Apr 2016 13:43:15 GMT

Yes you can.

AD cert service will enroll user certs to all users.

And GP can authenticate based on cert, username/password or both.

Re: Global Protect Limitations

rrau — Fri, 08 Apr 2016 13:58:02 GMT

ok so if we base on cert and the machine become disabled in AD, we can revoke the cert and eliminate users from connecting?

Re: Global Protect Limitations

Raido_Rattameister — Fri, 08 Apr 2016 14:58:29 GMT

Yes.

Or modify this powershell a bit to check disabled computer accounts instead of user accounts and schedule it to run every now and then to disable certificates automatically.

http://mikepfeiffer.net/2013/04/restricting-access-to-lync-for-disabled-active-directory-users/