Domain join with IPSec activated

regarding rare articles on internet, should possible join
a client domain using regular domain join, whenever ipsec activated
on domain controllers - far os of participating hosts
windows server 2008 , windows vista or higher. i've use
ntlmv2 authentication, new in os versions.

i created connection security rule, requires authentication
all inbound communication ntlmv2 protocol. have added ntlmv2
computer authentication (optional) , second method have added
ntlmv2 user authentication (not optional). further created inbound
firewall rule traffic, says "allow". configuration,
it's not possible me, join client domain. in test lab i've
got 1 dc (w2k8) , 1 client (windows 7).

the client not able, ask dns service on dc
domain information. yes: understand - articles telling me,
that work under vista , higher. so: i'm doing wrong ,
i missed configure? in 1 of rare articles, writing
something like: "by enabling new feature in ipsec windows vista ,
windows server 2008 automatically determines when use ipsec, no
longer havve configure exemptions domain controllers, simplifying
ipsec policy , deplayment of ipsec protection in domain." - feature
and how enable it???

thanks lot clarification , help!

regards,
cal77

hi,

 

based on testing, seems client computer use logon credential user ntlm authentication. therefore, need create domain user account same user name , password user logon client computer.

 

the following detailed steps reference:

 

1.    run commands below create connection security rules on both client computer , dc:

netsh advfirewall consec add rule name=”tcp 389” endpoint1=172.16.0.11/24 endpoint2=172.16.0.16/24 action=requireinrequestout port1=389 port2=any protocol=tcp auth1=anonymous auth2=userntlm
netsh advfirewall consec add rule name=”udp 389” endpoint1=172.16.0.11/24 endpoint2=172.16.0.16/24 action=requireinrequestout port1=389 port2=any protocol=udp auth1=anonymous auth2=userntlm

2.    create domain user account same user name , password local user logon client computer.

3.    logon client computer local user account.

4.    join domain.

 

thanks.

---

this posting provided "as is" no warranties, , confers no rights.

Windows Server  >  Security