Well of course you need to educate your users so the moment they think the laptop is gone should pull up their cell phone and phone the IT department so the box can be blocked or killswitch signal sent and then phone the police to issue a police report etc. The point of "pre-logon" is that only the basics are allowed through your inner firewalls. For example only thing allowed with "pre-logon" will be stuff like (which is up to you as admin to decide): - DHCP (if needed, often handled by the VPN itself) - DNS (like own limited zone) - AD (to authenticate) - AV (to update your signatures) - WSUS (to update your MS OS) and basically thats it. Not until the box is fully authenticated the user in front of the screen will have access to fileservers, mailservers etc. If the thief can stick cain and abel on your remote device without problems you have for sure other security issues with your design - and this scenario can happen even without pre-logon (dump the SAM db locally from the computer and you in most cases have the AD admin and other high level useraccounts incl hashes in front of you - use the already installed user cert to pick up the VPN and voila you are AD admin). Thats why you need other counter-measurements aswell... for example encrypt the harddrives (so it isnt just a matter of booting on Backtrack and dump the SAM db's), educate the users to phone the IT department as soon as they think their device has been stolen etc (there are other stuff to consider like the "evil maid" regarding when you use encrypted boot devices etc), dont leave your device on its own when you are outside the corporate building(s) and so on.
... View more
